Re: [Sidrops] draft-ietf-sidrops-rpki-has-no-identity-00

[Randy Bush <[e-mail]>]

> If another mechanism can provide positive proof (eg an x509 identity
> certificate which lies under a non-RPKI TA you trust) then there is no
> barrier to countersigning an assertion over that proof (the public key
> and a nonce, for example) binding the INR you can validate inside the
> RPKI, and an identity which lies outside the RPKI.
> 
> and
> 
> No part of the RPKi validation can "prove" the identity in the
> signing. What it can do, is relate the INR in RPKI, to a specific
> assertion about identity. Validation of that assertion is not subject
> to RPKI validation. Validation of the INR which is being associated,
> is a function of the RPKI

are you trying to say

  the owner of some j random inr is attesting to some identity binding
  in some k random pki?

maybe a concrete example would help me wrap what is left of my head
around this.

there exists an rpki cert attesting to a holding of 192.83.230.0/24.
iij has a corporate x.509-based employee database in which i have a
cert.  so the unknown owner of 192.83.230.0/24 cross-signs (let's
leave out the ugnlies) my iij cert.  what is the real world meaning of
this?  in few small words.

or, what is the meaning if i cross-sign the cert for 203.119.101.18
from iij?

what are the attestations and what is the trust?

randy

---
[e-mail]
`gpg --locate-external-keys --auto-key-locate wkd [e-mail]`
signatures are back, thanks to dmarc header butchery