[Sidrops] Re: Notification for draft-spaghetti-sidrops-rpki-ta-tiebreaker

[Job Snijders <[e-mail]>]

Dear Russ,

Are you sure TA’s can rekey themselves using RFc 6489? I thought that’s a
CA-only procedure.

Kind regards,

Job

On Thu, 20 Jun 2024 at 19:56, Russ Housley <[e-mail]> wrote:

> Job and co-authors:
>
> I think that this document needs to be clear that this is talking about a
> TA renewing its own certificate.  If a TA does a rekey in accordance with
> RFC 6489, there is no need for tiebreaking.
>
> Russ
>
> > On Jun 19, 2024, at 7:45 PM, Job Snijders <job=
> [e-mail]> wrote:
> >
> > Dear SIDROPS,
> >
> > In context of Relying Parties maybe having acquired access to multiple
> > different valid issuances of a Trust Anchor certificate, Ties de Kock
> > pointed out potential issues relating to certification path validation.
> >
> > An implementation to demonstrate a tiebreaking scheme in the presence of
> > another TA certificate was instrumented in OpenBSD rpki-client, and we
> > documented our effort in this internet-draft.
> >
> > Your feedback is most welcome!
> >
> > Kind regards,
> >
> > Job
> >
> > ----- Forwarded message from [e-mail] -----
> >
> > Date: Wed, 19 Jun 2024 16:11:54 -0700
> > From: [e-mail]
> > To: Job Snijders <[e-mail]>, Theo Buehler <[e-mail]>, Ties
> de Kock
> >       <[e-mail]>
> > Subject: New Version Notification for
> >       draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt
> >
> > A new version of Internet-Draft
> > draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt has been successfully
> > submitted by Job Snijders and posted to the
> > IETF repository.
> >
> > Name:     draft-spaghetti-sidrops-rpki-ta-tiebreaker
> > Revision: 00
> > Title:    Tiebreaking Resource Public Key Infrastructure (RPKI) Trust
> Anchors
> > Date:     2024-06-19
> > Group:    Individual Submission
> > Pages:    7
> > URL:
> https://www.ietf.org/archive/id/draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.txt
> > Status:
> https://datatracker.ietf.org/doc/draft-spaghetti-sidrops-rpki-ta-tiebreaker/
> > HTML:
> https://www.ietf.org/archive/id/draft-spaghetti-sidrops-rpki-ta-tiebreaker-00.html
> > HTMLized:
> https://datatracker.ietf.org/doc/html/draft-spaghetti-sidrops-rpki-ta-tiebreaker
> >
> >
> > Abstract:
> >
> >   A Trust Anchor (TA) in the RPKI is represented by a self-signed X.509
> >   Certification Authority (CA) certificate.  Over time, Relying Parties
> >   (RP) may have acquired multiple different issuances of valid TA
> >   certificates from the same TA operator.  This document proposes a
> >   tiebreaking scheme to be used by RPs to select one TA certificate for
> >   certification path validation.  This document updates RFC 8630.
> >
> >
> >
> > The IETF Secretariat
> >
> >
> >
> > ----- End forwarded message -----
> >
> > _______________________________________________
> > Sidrops mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
>