Re: [sidr] FW: I-D Action: draft-huston-rpki-validation-00.txt

Hi,

I took a look at this draft, but haven't read it in depth yet. One 
potential issue I see is that it removes the possibility of an 
optimization technique that could significantly decrease the processing 
time needed for RPKI validation. It's currently possible to optimize 
validation for CA certs that don't inherit resources by validating each 
parent-child link independently of the parent's parent or the child's 
children. One benefit of this is that links can be verified in parallel 
on a multi-core machine. If the validation status of each link is stored 
in a database, then another benefit is that adding a new leaf node 
certificate only requires validating the leaf against its parent and 
checking the database for the validity of the parent. Also, if the 
resources of a TA change, the children and affected grandchildren need 
to be re-validated but the unaffected grandchildren don't need any 
additional processing. If I understand this document's proposal 
correctly, all of these optimizations would become invalid.

On 2013-07-11 06:20, Murphy, Sandra wrote:
> I just saw this.  Looks interesting.
>
> --Sandy, speaking as regular ol' member
>
> ________________________________________
> From: i-d-announce-bounces@ietf.org [i-d-announce-bounces@ietf.org]
> on behalf of internet-drafts@ietf.org [internet-drafts@ietf.org]
> Sent: Monday, July 08, 2013 4:12 PM
> To: i-d-announce@ietf.org
> Subject: I-D Action: draft-huston-rpki-validation-00.txt
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
>
>
>         Title           : RPKI Validation Reconsidered
>         Author(s)       : Geoff Huston
>                           George Michaelson
>         Filename        : draft-huston-rpki-validation-00.txt
>         Pages           : 12
>         Date            : 2013-07-08
>
> Abstract:
>    This document reviews the certificate validation procedure 
> specified
>    in RFC6487 and highlights aspects of operational management of
>    certificates in the RPKI in response to the movement of resources
>    across registries, and the associated actions of Certification
>    Authorities to maintain certification of resources during this
>    movement.  The document describes an alternative validation 
> procedure
>    that reduces the operational impact of certificate management 
> during
>    resource movement.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-huston-rpki-validation
>
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-huston-rpki-validation-00
>
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> I-D-Announce mailing list
> I-D-Announce@ietf.org
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> _______________________________________________
> sidr mailing list
> sidr@ietf.org
> https://www.ietf.org/mailman/listinfo/sidr

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/