[Sidrops] Re: Key rollover of BPKI keys

Tim Bruijnzeels <tbruijnzeels@ripe.net> Tue, 09 July 2024 06:37 UTC

Return-Path: <tbruijnzeels@ripe.net>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EBD8C180B75 for <sidrops@ietfa.amsl.com>; Mon, 8 Jul 2024 23:37:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TFFgMJAyvH_s for <sidrops@ietfa.amsl.com>; Mon, 8 Jul 2024 23:37:49 -0700 (PDT)
Received: from mail-ej1-x629.google.com (mail-ej1-x629.google.com [IPv6:2a00:1450:4864:20::629]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8C57C180B5A for <sidrops@ietf.org>; Mon, 8 Jul 2024 23:37:49 -0700 (PDT)
Received: by mail-ej1-x629.google.com with SMTP id a640c23a62f3a-a77e5929033so328674066b.0 for <sidrops@ietf.org>; Mon, 08 Jul 2024 23:37:49 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ripe.net; s=google1; t=1720507068; x=1721111868; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=DVN/O/wNpW44N2oPRsdNWAgrpGc4L7+2SOxVzyG+qjI=; b=EVmMCx19FAEMA+/YtIMizOwVgKGmJiuunO04jMTjhEtPPGQgVk6yfkzpRB8WRQeAaR i72uaU4YUOcLuj4S8G7nWwZYZ8xhNejZw/Fs3jNhFlzg6P3SEzTREq/f8BvRHJhcNizf zTAaDSiII6LRkyWjs+XuGQrEJHYxPaUKlgZ06Pe7swEm25jNu6EtT3L3iH1THu68E427 4mx0kUAIwbISzuz7793BW/eLBOHB4ada1Fb9l9YRf8UTFdeFgxVLXaEKpeeYh8LSLy4C t9CpXRcQgX+JQdP9mh5s8Ho67LqUsnHZb6W1T593pknn+jSyrmIv/VA8MRtcuge9s+U+ IJCg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720507068; x=1721111868; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=DVN/O/wNpW44N2oPRsdNWAgrpGc4L7+2SOxVzyG+qjI=; b=LIk+dZg1SMvj8MuGKolk+oi5ioPlMEXpX14qoz3xll0WyYrB5MXg9VrkGTNAnpLjFt FTS700JOERg2r5MUCkrPM3vi+byRLMED9OrAg5+QuxqwE8TPK6dZZddVAOOwe7T1txRj SLMRIrxICDzaTzQ+lZaALBSd4HVFlPjN1t6AuvrLkz/prpC4kyPx2l4mwgF6wa5cbXug 0IcoI0eJEOVZCyCmkn7mVJaRXGkaDIp0Issbw+g4PVKoCFg21jEMNWy7mkCEZKr9Z8we MwF1fbVVbnP/DEQluNaBaJyV6tG7hJhTngUyC/qa1f22pauOZvc2+bf//jsgdQgK3zVS AnjA==
X-Gm-Message-State: AOJu0YzL4nmp/Br/wLP6UXCCL3YWXaJlUo5n0oDSGNEiwyIp0yL35d0m XT3VRJ8LdFEEz0McKDQeHXLgc/zawyj+ZEpRKPCKPlItUtl7FUz9OM1+rEdrTEHNABDfDgu/m89 EvA7NRoGd7aYhIAgkaH2qNxHirqvVr97Z/o1MTIwGlh1Kdy/Q
X-Google-Smtp-Source: AGHT+IGUeIzpRGdnr0NTj6+jZOxDB1tLl3K/PwO9B9qj5mT3yfvaZXV3erR3xvmLk4IBqPtueG7c8M+6m9g1xGK2EJc=
X-Received: by 2002:a17:906:6a06:b0:a6f:b78a:b39 with SMTP id a640c23a62f3a-a780b688a1amr125511466b.1.1720507067457; Mon, 08 Jul 2024 23:37:47 -0700 (PDT)
MIME-Version: 1.0
References: <CAMEWqGsUmW=qMXZABdqeeM-OhyMmGga=EJF7RDvKty+U0=vDDQ@mail.gmail.com>
In-Reply-To: <CAMEWqGsUmW=qMXZABdqeeM-OhyMmGga=EJF7RDvKty+U0=vDDQ@mail.gmail.com>
From: Tim Bruijnzeels <tbruijnzeels@ripe.net>
Date: Tue, 09 Jul 2024 08:37:36 +0200
Message-ID: <CADN5fM59CHuHQK5s+oTOiGM2A849MED6y7m2WV=XX-nVkmKD-w@mail.gmail.com>
To: Q Misell <q=40as207960.net@dmarc.ietf.org>
Content-Type: multipart/alternative; boundary="00000000000096ffaa061ccac41e"
Message-ID-Hash: VYEGRICNLMTNL7LIRRIR6QUZENPFBIGZ
X-Message-ID-Hash: VYEGRICNLMTNL7LIRRIR6QUZENPFBIGZ
X-MailFrom: tbruijnzeels@ripe.net
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-sidrops.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: sidrops@ietf.org
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [Sidrops] Re: Key rollover of BPKI keys
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/UUQ7jmm2OZ1vl18MVE_rNCmE0KU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Owner: <mailto:sidrops-owner@ietf.org>
List-Post: <mailto:sidrops@ietf.org>
List-Subscribe: <mailto:sidrops-join@ietf.org>
List-Unsubscribe: <mailto:sidrops-leave@ietf.org>

Hi Q Misel

Perhaps we can meet up in Vancouver.

I still have an interest in this subject and I know of others who share
this interest.

My own initial write up is here:
https://datatracker.ietf.org/doc/html/draft-timbru-sidrops-rpki-publication-v2-00

It’s expired but I was planning to work on it again soon. Unfortunately I
had no time to do so earlier but signs are good that I will have time in
Q3/4 of this year.

Regards
Tim


Op ma 8 jul 2024 om 16:16 schreef Q Misell <q=40as207960.net@dmarc.ietf.org>

> Hi all,
>
> I was reading through the Krill docs recently and noticed the following
> text (on this page https://krill.docs.nlnetlabs.nl/en/v0.14.2/hsm.html)
>
> But, unfortunately, there is no standards supported way to perform a key
> rollover for the identity key that Krill uses for its communication with
> parent (and child) CAs and its Publication Server. We are planning to work
> on a solution for this and will reach out to the IETF to seek
> standardisation.
>
> I had some free time today and this prompted me to attempt a first draft
> at a spec for TA updates. My somewhat hasty I-D is at
> https://datatracker.ietf.org/doc/draft-misell-rpki-bpki-key-rollover/.
> I'll be at the IETF in Vancouver, so feel free to chat to be about the
> draft there, or the ML.
>
> Thanks,
> Q Misell
> ------------------------------
>
> Any statements contained in this email are personal to the author and are
> not necessarily the statements of the company unless specifically stated.
> AS207960 Cyfyngedig, having a registered office at 13 Pen-y-lan Terrace,
> Caerdydd, Cymru, CF23 9EU
> <https://www.google.com/maps/search/13+Pen-y-lan+Terrace,+Caerdydd,+Cymru,+CF23+9EU?entry=gmail&source=g>,
> trading as Glauca Digital, is a company registered in Wales under №
> 12417574
> <https://find-and-update.company-information.service.gov.uk/company/12417574>,
> LEI 875500FXNCJPAPF3PD10. ICO register №: ZA782876
> <https://ico.org.uk/ESDWebPages/Entry/ZA782876>. UK VAT №: GB378323867.
> EU VAT №: EU372013983. Turkish VAT №: 0861333524. South Korean VAT №:
> 522-80-03080. AS207960 Ewrop OÜ, having a registered office at Lääne-Viru
> maakond, Tapa vald, Porkuni küla, Lossi tn 1, 46001, trading as Glauca
> Digital, is a company registered in Estonia under № 16755226. Estonian VAT
> №: EE102625532. Glauca Digital and the Glauca logo are registered
> trademarks in the UK, under № UK00003718474 and № UK00003718468,
> respectively.
> _______________________________________________
> Sidrops mailing list -- sidrops@ietf.org
> To unsubscribe send an email to sidrops-leave@ietf.org
>