[Sidrops] Re: Notification for draft-spaghetti-sidrops-rpki-ta-tiebreaker

[Russ Housley <[e-mail]>]

Job:

You are correct, the part of RFC 6489 is about a CA:

   In order to perform the equivalent of a key rollover, the CA
   creates a "new" instance of itself, with a new key pair, and then
   effectively substitutes this "new" CA instance into the RPKI
   hierarchy in place of the "old" CA instance.

However, the point about renewal vs. rekey should still be discussed.

Russ

> On Jun 20, 2024, at 2:13 PM, Job Snijders <[e-mail]> wrote:
> 
> Dear Russ,
> 
> Are you sure TA’s can rekey themselves using RFc 6489? I thought that’s a CA-only procedure.
> 
> Kind regards,
> 
> Job
> 
> On Thu, 20 Jun 2024 at 19:56, Russ Housley <[e-mail] <mailto:[e-mail]>> wrote:
>> Job and co-authors:
>> 
>> I think that this document needs to be clear that this is talking about a TA renewing its own certificate.  If a TA does a rekey in accordance with RFC 6489, there is no need for tiebreaking.
>> 
>> Russ
>> 
>> > On Jun 19, 2024, at 7:45 PM, Job Snijders <job=[e-mail] <mailto:[e-mail]>> wrote:
>> > 
>> > Dear SIDROPS,
>> > 
>> > In context of Relying Parties maybe having acquired access to multiple
>> > different valid issuances of a Trust Anchor certificate, Ties de Kock
>> > pointed out potential issues relating to certification path validation.
>> > 
>> > An implementation to demonstrate a tiebreaking scheme in the presence of
>> > another TA certificate was instrumented in OpenBSD rpki-client, and we
>> > documented our effort in this internet-draft.
>> > 
>> > Your feedback is most welcome!
>> > 
>> > Kind regards,
>> > 
>> > Job
>> > 
>> > ----- Forwarded message from [e-mail] <mailto:[e-mail]> -----
>> > 
>> > Date: Wed, 19 Jun 2024 16:11:54 -0700
>> > From: [e-mail] <mailto:[e-mail]>
>> > To: Job Snijders <[e-mail] <mailto:[e-mail]>>, Theo Buehler <[e-mail] <mailto:[e-mail]>>, Ties de Kock
>> >       <[e-mail] <mailto:[e-mail]>>
>> > Subject: New Version Notification for
>> >       draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt
>> > 
>> > A new version of Internet-Draft
>> > draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt has been successfully
>> > submitted by Job Snijders and posted to the
>> > IETF repository.
>> > 
>> > Name:     draft-spaghetti-sidrops-rpki-ta-tiebreaker
>> > Revision: 00
>> > Title:    Tiebreaking Resource Public Key Infrastructure (RPKI) Trust Anchors
>> > Date:     2024-06-19
>> > Group:    Individual Submission
>> > Pages:    7
>> > URL:      https://www.ietf.org/archive/id/draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt
>> > Status:   https://datatracker.ietf.org/doc/draft-spaghetti-sidrops-rpki-ta-tiebreaker/
>> > HTML:     https://www.ietf.org/archive/id/draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.html
>> > HTMLized: https://datatracker.ietf.org/doc/html/draft-spaghetti-sidrops-rpki-ta-tiebreaker
>> > 
>> > 
>> > Abstract:
>> > 
>> >   A Trust Anchor (TA) in the RPKI is represented by a self-signed X.509
>> >   Certification Authority (CA) certificate.  Over time, Relying Parties
>> >   (RP) may have acquired multiple different issuances of valid TA
>> >   certificates from the same TA operator.  This document proposes a
>> >   tiebreaking scheme to be used by RPs to select one TA certificate for
>> >   certification path validation.  This document updates RFC 8630.
>> > 
>> > 
>> > 
>> > The IETF Secretariat
>> > 
>> > 
>> > 
>> > ----- End forwarded message -----
>> > 
>> > _______________________________________________
>> > Sidrops mailing list -- [e-mail] <mailto:[e-mail]>
>> > To unsubscribe send an email to [e-mail] <mailto:[e-mail]>
>>