Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-01.txt

Tom,

Okay posting new version shortly.

spt

On 4/13/12 1:32 PM, t.petch wrote:
> ----- Original Message -----
> From: "Sean Turner"<turners@ieca.com>
> To: "t.petch"<ietfc@btconnect.com>
> Cc: "Christopher Morrow"<morrowc.lists@gmail.com>;<sidr@ietf.org>;
> <sidr-chairs@ietf.org>
> Sent: Friday, April 13, 2012 2:19 PM
>
>> Tom,
>>
>> Responses inline.
>>
>
> Sean
>
> yes, that looks fine
>
> Tom
>
>
>
>> spt
>>
>> On 4/13/12 6:33 AM, t.petch wrote:
>>> ----- Original Message -----
>>> From: "Christopher Morrow"<morrowc.lists@gmail.com>
>>> To:<sidr@ietf.org>;<sidr-chairs@ietf.org>; "Sean Turner"<turners@ieca.com>;
>>> "t.petch"<ietfc@btconnect.com>
>>> Sent: Wednesday, March 28, 2012 2:33 PM
>>> Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-01.txt
>>>
>>>
>>> Sean/Tom,
>>> Tom had some comments on the previous (I believe) version of this
>>> draft, are they addressed to your satisfaction Tom?
>>>
>>> <tp>
>>> Not really; it still says
>>>
>>> "    o BGPSEC Router Certificates MUST include the BGPSEC EKU defined in
>>>         Section 3.9.5."
>>> but the I-D has no section 3.9.5 so it is unclear what is meant.
>>
>> So this has been there for a while :(  It should be pointing to the EKU
>> defined in s3.1.3.1.  It's an just an OID you stick in the EKU extension.
>>
>>> And I [still] find it hard to parse
>>> ' The validation procedure used for BGPSEC Router Certificates is
>>>      identical to the validation procedure described in Section 7 of
>>>      [RFC6487] except that where "this specification" refers to [RFC6487]
>>>      in that profile in this profile "this specification" is this
>>>      document.'
>>> {a bit like those brain teasers where a single sentence has 13 consecutive
>>> 'and's but lacks punctuation}
>>
>> I'm trying to avoid copying all the text from 6487 over in to this
>> draft.  I would just point there, but I can see somebody doing something
>> silly like not understanding that the restrictions on the validation
>> procedure are in bgpsec-pki-profiles draft.  So how about this:
>>
>>     The validation procedure used for BGPSEC Router Certificates is
>>     identical to the validation procedure described in Section 7 of
>>     [RFC6487].  The exception is that the constraints applied come
>>     from this specification (e.g., in step 3: the certificate
>>     contains all the field that must be present - refers to the
>>     fields that are required by this specification).
>>
>>> Tom Petch
>>> </tp>
>>>
>>>
>>> Sean, if Tom's ok with the changes, should we move this along?
>>>
>>> -Chris
>>> <cochair>
>>>
>>> On Mon, Dec 5, 2011 at 1:20 PM,<internet-drafts@ietf.org>   wrote:
>>>>
>>>> A New Internet-Draft is available from the on-line Internet-Drafts
>>> directories. This draft is a work item of the Secure Inter-Domain Routing
>>> Working Group of the IETF.
>>>>
>>>> Title : A Profile for BGPSEC Router Certificates, Certificate Revocation
>>> Lists, and Certification Requests
>>>> Author(s) : Mark Reynolds
>>>> Sean Turner
>>>> Steve Kent
>>>> Filename : draft-ietf-sidr-bgpsec-pki-profiles-01.txt
>>>> Pages : 11
>>>> Date : 2011-12-05
>>>>
>>>> This document defines a standard profile for X.509 certificates for
>>>> the purposes of supporting validation of Autonomous System (AS) paths
>>>> in the Border Gateway Protocol (BGP), as part of an extension to that
>>>> protocol known as BGPSEC. BGP is a critical component for the proper
>>>> operation of the Internet as a whole. The BGPSEC protocol is under
>>>> development as a component to address the requirement to provide
>>>> security for the BGP protocol. The goal of BGPSEC is to design a
>>>> protocol for full AS path validation based on the use of strong
>>>> cryptographic primitives. The end-entity (EE) certificates specified
>>>> by this profile are issued under Resource Public Key Infrastructure
>>>> (RPKI) Certification Authority (CA) certificates, containing the AS
>>>> Identifier Delegation extension, to routers within the Autonomous
>>>> System (AS). The certificate asserts that the router(s) holding the
>>>> private key are authorized to send out secure route advertisements on
>>>> behalf of the specified AS. This document also profiles the
>>>> Certificate Revocation List (CRL), profiles the format of
>>>> certification requests, and specifies Relying Party certificate path
>>>> validation procedures. The document extends the RPKI; therefore,
>>>> this documents updates the RPKI Resource Certificates Profile (draft-
>>>> ietf-sidr-res-cert-profile).
>>>>
>>>>
>>>> A URL for this Internet-Draft is:
>>>>
> http://www.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-01.txt
>>>>
>>>> Internet-Drafts are also available by anonymous FTP at:
>>>> ftp://ftp.ietf.org/internet-drafts/
>>>>
>>>> This Internet-Draft can be retrieved at:
>>>>
> ftp://ftp.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-01.txt
>>>>
>>>> _______________________________________________
>>>> sidr mailing list
>>>> sidr@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/sidr
>>>
>>>
>>>
>>>
>>
>
>
>