Re: [Sidrops] adopt draft-ymbk-sidrops-rpki-has-no-identity please

[Randy Bush <[e-mail]>]

>>> When someone asks me to put a string into a webserver file or into my
>>> DNS zone file to "prove" I have administration access, they don't want
>>> to identify me, they just want me to prove I already have access to
>>> the resource at the "business end" of it.
>>
>> usually because dns is the purpose of the exercise
>>
>>> RSC is the same thing, I prove I can create ROAs and/or RSCs
>>
>> as sra would say, you can demonstrate that the same unknown attacker
>> can create objects.
> 
> The attacker has access to private keys behind the specific INR. We
> have bigger problems than the one here, Surely?

indeed.  some are proposing to grant them access to someone's bank
account because they can sign some roa

> (or, can you show me the attack vector, which does not imply loss of
> privacy over a public-private keypair?)

we have been over this multiple times, george.  read the draft

randy