Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-01.txt

----- Original Message -----
From: "Sean Turner" <turners@ieca.com>
To: "t.petch" <ietfc@btconnect.com>
Cc: "Christopher Morrow" <morrowc.lists@gmail.com>; <sidr@ietf.org>;
<sidr-chairs@ietf.org>
Sent: Friday, April 13, 2012 2:19 PM

> Tom,
>
> Responses inline.
>

Sean

yes, that looks fine

Tom


> spt
>
> On 4/13/12 6:33 AM, t.petch wrote:
> > ----- Original Message -----
> > From: "Christopher Morrow"<morrowc.lists@gmail.com>
> > To:<sidr@ietf.org>;<sidr-chairs@ietf.org>; "Sean Turner"<turners@ieca.com>;
> > "t.petch"<ietfc@btconnect.com>
> > Sent: Wednesday, March 28, 2012 2:33 PM
> > Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-01.txt
> >
> >
> > Sean/Tom,
> > Tom had some comments on the previous (I believe) version of this
> > draft, are they addressed to your satisfaction Tom?
> >
> > <tp>
> > Not really; it still says
> >
> > "    o BGPSEC Router Certificates MUST include the BGPSEC EKU defined in
> >        Section 3.9.5."
> > but the I-D has no section 3.9.5 so it is unclear what is meant.
>
> So this has been there for a while :(  It should be pointing to the EKU
> defined in s3.1.3.1.  It's an just an OID you stick in the EKU extension.
>
> > And I [still] find it hard to parse
> > ' The validation procedure used for BGPSEC Router Certificates is
> >     identical to the validation procedure described in Section 7 of
> >     [RFC6487] except that where "this specification" refers to [RFC6487]
> >     in that profile in this profile "this specification" is this
> >     document.'
> > {a bit like those brain teasers where a single sentence has 13 consecutive
> > 'and's but lacks punctuation}
>
> I'm trying to avoid copying all the text from 6487 over in to this
> draft.  I would just point there, but I can see somebody doing something
> silly like not understanding that the restrictions on the validation
> procedure are in bgpsec-pki-profiles draft.  So how about this:
>
>    The validation procedure used for BGPSEC Router Certificates is
>    identical to the validation procedure described in Section 7 of
>    [RFC6487].  The exception is that the constraints applied come
>    from this specification (e.g., in step 3: the certificate
>    contains all the field that must be present - refers to the
>    fields that are required by this specification).
>
> > Tom Petch
> > </tp>
> >
> >
> > Sean, if Tom's ok with the changes, should we move this along?
> >
> > -Chris
> > <cochair>
> >
> > On Mon, Dec 5, 2011 at 1:20 PM,<internet-drafts@ietf.org>  wrote:
> >>
> >> A New Internet-Draft is available from the on-line Internet-Drafts
> > directories. This draft is a work item of the Secure Inter-Domain Routing
> > Working Group of the IETF.
> >>
> >> Title : A Profile for BGPSEC Router Certificates, Certificate Revocation
> > Lists, and Certification Requests
> >> Author(s) : Mark Reynolds
> >> Sean Turner
> >> Steve Kent
> >> Filename : draft-ietf-sidr-bgpsec-pki-profiles-01.txt
> >> Pages : 11
> >> Date : 2011-12-05
> >>
> >> This document defines a standard profile for X.509 certificates for
> >> the purposes of supporting validation of Autonomous System (AS) paths
> >> in the Border Gateway Protocol (BGP), as part of an extension to that
> >> protocol known as BGPSEC. BGP is a critical component for the proper
> >> operation of the Internet as a whole. The BGPSEC protocol is under
> >> development as a component to address the requirement to provide
> >> security for the BGP protocol. The goal of BGPSEC is to design a
> >> protocol for full AS path validation based on the use of strong
> >> cryptographic primitives. The end-entity (EE) certificates specified
> >> by this profile are issued under Resource Public Key Infrastructure
> >> (RPKI) Certification Authority (CA) certificates, containing the AS
> >> Identifier Delegation extension, to routers within the Autonomous
> >> System (AS). The certificate asserts that the router(s) holding the
> >> private key are authorized to send out secure route advertisements on
> >> behalf of the specified AS. This document also profiles the
> >> Certificate Revocation List (CRL), profiles the format of
> >> certification requests, and specifies Relying Party certificate path
> >> validation procedures. The document extends the RPKI; therefore,
> >> this documents updates the RPKI Resource Certificates Profile (draft-
> >> ietf-sidr-res-cert-profile).
> >>
> >>
> >> A URL for this Internet-Draft is:
> >>
http://www.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-01.txt
> >>
> >> Internet-Drafts are also available by anonymous FTP at:
> >> ftp://ftp.ietf.org/internet-drafts/
> >>
> >> This Internet-Draft can be retrieved at:
> >>
ftp://ftp.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-01.txt
> >>
> >> _______________________________________________
> >> sidr mailing list
> >> sidr@ietf.org
> >> https://www.ietf.org/mailman/listinfo/sidr
> >
> >
> >
> >
>