[Sidrops] Request for Call for WG Adoption (Was: New Version Notification for draft-snijders-constraining-rpki-trust-anchors-08.txt)

[Job Snijders <[e-mail]>]

Dear all,

We'd like to request the chairs to issue a call for WG Adoption for
draft-snijders-constraining-rpki-trust-anchors.

At IETF 121 I presented on the concept of "Constraining RPKI Trust
Anchors", as implemented in rpki-client.

VIDEO: https://youtu.be/pXBPjNQFJmI?si=UJv9braA9Cs3jz99&t=3034
SLIDES: https://datatracker.ietf.org/meeting/121/materials/slides-121-sidrops-constraining-rpki-trust-anchors-00

By now (May 2025) we have some experience with the approach: the
proposed functionality has been available (and enabled by default) since
rpki-client version 8.7 (released in December 2023).

The document is not yet ready for RFC publication as-is. For example,
the constraints listed in "Appendix A" likely would be out-of-date by
the time the document gets to the RFC editor, therefor appendix A
probably ought to be removed before publication.

We'd like to jointly work with SIDROPS towards the following objectives:

* Standardize a domain-specific language for RP implementations in order
  to constrain RPKI Trust Anchors.
* Standardize how the information expressed in the DSL can be applied to
  RPKI validation (e.g. the constraints apply to End-Entity certificates).
* Document how RIR resource transfer policies (or lack thereof) impact
  a Trust Anchor operator's effective signing authority.

Kind regards,

Job

----- Forwarded message from [e-mail] -----

Date: Mon, 05 May 2025 03:33:06 -0700
From: [e-mail]
To: Job Snijders <[e-mail]>, Theo Buehler <[e-mail]>
Subject: New Version Notification for
	draft-snijders-constraining-rpki-trust-anchors-08.txt

A new version of Internet-Draft
draft-snijders-constraining-rpki-trust-anchors-08.txt has been successfully
submitted by Job Snijders and posted to the
IETF repository.

Name:     draft-snijders-constraining-rpki-trust-anchors
Revision: 08
Title:    Constraining RPKI Trust Anchors
Date:     2025-05-05
Group:    Individual Submission
Pages:    103
URL:      https://www.ietf.org/archive/id/draft-snijders-constraining-rpki-trust-anchors-08.txt
Status:   https://datatracker.ietf.org/doc/draft-snijders-constraining-rpki-trust-anchors/
HTML:     https://www.ietf.org/archive/id/draft-snijders-constraining-rpki-trust-anchors-08.html
HTMLized: https://datatracker.ietf.org/doc/html/draft-snijders-constraining-rpki-trust-anchors
Diff:     https://author-tools.ietf.org/iddiff?url2=draft-snijders-constraining-rpki-trust-anchors-08

Abstract:

   This document describes an approach for Resource Public Key
   Infrastructure (RPKI) Relying Parties (RPs) to impose locally
   configured Constraints on cryptographic products subordinate to
   publicly-trusted Trust Anchors (TAs), as implemented in OpenBSD's
   rpki-client validator.  The ability to constrain a Trust Anchor
   operator's effective signing authority to a limited set of Internet
   Number Resources (INRs) allows Relying Parties to enjoy the potential
   benefits of assuming trust - within a bounded scope.



The IETF Secretariat



----- End forwarded message -----