[Sidrops] Signed TAL

[Tim Bruijnzeels <[e-mail]>]

Dear working group,

Following the discussion at the microphone at IETF99, we have uploaded an updated version of the signed TAL document:
https://datatracker.ietf.org/doc/draft-tbruijnzeels-sidrops-signed-tal/

Two issues were brought up:

1) magic numbers used for staging periods

We removed the time after which a Signed TAL should be removed - opting instead for a model where a TA can publish what it believes should be considered its current TAL at all times. RPs that have already learned this TAL can just ignore it. 

We kept 24 hour staging period in key rolls (section 6.2). I don’t think we strictly need it to be honest, but it is in-line with how things are done in CA key rolls (RFC6489).

We also kept a 24 hour period when withdrawing a publication point. Although there is no explicit guarantee about how frequently RPs re-sync, most RPs do use a much high frequency than this. The 24 hour value is in-line with key rolls, and should be more than enough time.

2) Lessons from RFC5011 (Automated Updates of DNS Security (DNSSEC) Trust Anchors)

As I read the mechanisms described here are not applicable to RPKI because we do not have explicit TTLs defined, and we do not have the concept of Trust Anchor Sets. Therefore we still propose a model based on the existing TAL format that we believe is simpler.


We would now like to ask for working group adoption of this document.

Kind regards

Tim