Re: [Sidrops] draft-ietf-sidrops-rpki-has-no-identity-00

[Russ Housley <[e-mail]>]

Tim:

>> I am confused.  The RPKI design purposely avoids binding IIJ's identity to the resources assigned to IIJ. What kind of assertions need two signatures, one that ca be validated with an RPKI certificate and the other can be validated with a certificate from an identity-confirming PKI?
> 
> I believe that the main point here is that a parent RPKI CA does not attest to the identity of a child. It just associates INRs to $their public key.
> 
> However, with RSC/RTA the operator of that child CA could then sign an attestation containing anything else, including a public B-PKI key that they may wish to associate with their INRs in specific use cases.
> 
> At least that is how understood George's words. Please correct me if I misunderstood George :)

I think that RSC/RTA are saying that the holder of an INR has signed a statement.  The identity is not important in that context.  The fact that the are the holder of that INR is waht is important to validate the signed statement.

Russ