Re: [Sidrops] what to do when the CRL is hosed?

[Martin Hoffmann <[e-mail]>]

Job Snijders wrote:
> 
> Of course - in making strong statements like this one I can not afford
> to assume I am right, so if you disagree - please tell me how I am
> wrong (in detail :-) ).

Let me counter with a different strong statement: In the context of
RPKI, CRLs offer no additional value and can safely be ignored.

The reason is the manifests. Unlike CRLs which only say "these
certificates are not to be considered valid anymore", manifests say
"this is the complete set of objects currently issued by this CA". They
also refer to concrete objects, identifying them both by URI and a hash
over their content. This is a much more powerful mechanism than CRLs.

What’s more, they offer a soft and a hard deadline for validity. Their
next update field is a soft deadline, much like with CRLs. But there’s
also a hard deadline in that the certificate they’ve been signed with
expires eventually. While the former has the same ambiguity as the next
update field of the CRL, the latter doesn’t. If the manifest is
expired, the CA is basically gone.

Further, the CRL is included in the manifest. So you can’t even replay
an old CRL without also replaying the old manifest.

Essentially, no information conveyed by the CRL isn’t also conveyed by
the manifest. The CRL solely serves to provide additional complexity
for the code generating and validating RPKI objects and, apparently,
creates ambiguity in the interpretation of the specification.

Kind regards,
Martin