[Sidrops] Re: Notification for draft-spaghetti-sidrops-rpki-ta-tiebreaker

[Russ Housley <[e-mail]>]

Job and co-authors:

I think that this document needs to be clear that this is talking about a TA renewing its own certificate.  If a TA does a rekey in accordance with RFC 6489, there is no need for tiebreaking.

Russ

> On Jun 19, 2024, at 7:45 PM, Job Snijders <job=[e-mail]> wrote:
> 
> Dear SIDROPS,
> 
> In context of Relying Parties maybe having acquired access to multiple
> different valid issuances of a Trust Anchor certificate, Ties de Kock
> pointed out potential issues relating to certification path validation.
> 
> An implementation to demonstrate a tiebreaking scheme in the presence of
> another TA certificate was instrumented in OpenBSD rpki-client, and we
> documented our effort in this internet-draft.
> 
> Your feedback is most welcome!
> 
> Kind regards,
> 
> Job
> 
> ----- Forwarded message from [e-mail] -----
> 
> Date: Wed, 19 Jun 2024 16:11:54 -0700
> From: [e-mail]
> To: Job Snijders <[e-mail]>, Theo Buehler <[e-mail]>, Ties de Kock
> 	<[e-mail]>
> Subject: New Version Notification for
> 	draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt
> 
> A new version of Internet-Draft
> draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt has been successfully
> submitted by Job Snijders and posted to the
> IETF repository.
> 
> Name:     draft-spaghetti-sidrops-rpki-ta-tiebreaker
> Revision: 00
> Title:    Tiebreaking Resource Public Key Infrastructure (RPKI) Trust Anchors
> Date:     2024-06-19
> Group:    Individual Submission
> Pages:    7
> URL:      https://www.ietf.org/archive/id/draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt
> Status:   https://datatracker.ietf.org/doc/draft-spaghetti-sidrops-rpki-ta-tiebreaker/
> HTML:     https://www.ietf.org/archive/id/draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.html
> HTMLized: https://datatracker.ietf.org/doc/html/draft-spaghetti-sidrops-rpki-ta-tiebreaker
> 
> 
> Abstract:
> 
>   A Trust Anchor (TA) in the RPKI is represented by a self-signed X.509
>   Certification Authority (CA) certificate.  Over time, Relying Parties
>   (RP) may have acquired multiple different issuances of valid TA
>   certificates from the same TA operator.  This document proposes a
>   tiebreaking scheme to be used by RPs to select one TA certificate for
>   certification path validation.  This document updates RFC 8630.
> 
> 
> 
> The IETF Secretariat
> 
> 
> 
> ----- End forwarded message -----
> 
> _______________________________________________
> Sidrops mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]