Re: [Sidrops] draft-ietf-sidrops-rpki-has-no-identity-00

Russ:

> On 11 May 2021, at 16:45, Russ Housley <housley@vigilsec.com> wrote:
> 
> Tim:
> 
>>> I am confused.  The RPKI design purposely avoids binding IIJ's identity to the resources assigned to IIJ. What kind of assertions need two signatures, one that ca be validated with an RPKI certificate and the other can be validated with a certificate from an identity-confirming PKI?
>> 
>> I believe that the main point here is that a parent RPKI CA does not attest to the identity of a child. It just associates INRs to $their public key.
>> 
>> However, with RSC/RTA the operator of that child CA could then sign an attestation containing anything else, including a public B-PKI key that they may wish to associate with their INRs in specific use cases.
>> 
>> At least that is how understood George's words. Please correct me if I misunderstood George :)
> 
> I think that RSC/RTA are saying that the holder of an INR has signed a statement.  The identity is not important in that context.  The fact that the are the holder of that INR is waht is important to validate the signed statement.

Indeed, I think we are saying the same thing.

What I am saying, and understanding George to say, is that data part in the signed statement can _contain_ identity information. Such as a B-PKI public key, or public PGP key, to be used in out of band communications about the resources.

But again George, if I misunderstood you correct me..

Tim

> 
> Russ
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops