Re: [Sidrops] I-D Action: draft-ietf-sidrops-cms-signing-time-05.txt

[Job Snijders <[e-mail]>]

Dear all,

A small update on deployment statistics:

* From my testing, it appears that nowadays for 4 out of 5 RIRs their
  top-level rsync repositories complies with the guidance in Section 2.1

* I've not observed any Signed Object without CMS signing-time attribute
  since I started looking into this on June 6th, 2022 (602 days ago).
  To me this means that RPKI CAs are already consistently compliant with
  the proposed changes, and have been for a while.

* For 83.8% of Signed Objects in the public rsync repositories, the CMS
  signing-time timestamp matches the file's mod-time observed via rsync.
  This means that nowadays RPs will really see a big efficiency increase
  after implementing Section 2.2.

Kind regards,

Job

On Mon, Jan 29, 2024 at 02:01:41PM -0800, [e-mail] wrote:
> Internet-Draft draft-ietf-sidrops-cms-signing-time-05.txt is now available. It
> is a work item of the SIDR Operations (SIDROPS) WG of the IETF.
> 
>    Title:   On the use of the CMS signing-time attribute in RPKI Signed Objects
>    Authors: Job Snijders
>             Tom Harrison
>    Name:    draft-ietf-sidrops-cms-signing-time-05.txt
>    Pages:   12
>    Dates:   2024-01-29
> 
> Abstract:
> 
>    In the Resource Public Key Infrastructure (RPKI), Signed Objects are
>    defined as Cryptographic Message Syntax (CMS) protected content types
>    by way of a standard template (RFC 6488).  That template includes an
>    optional CMS signing-time attribute, representing the purported time
>    at which the object was signed by its issuer.  At the time when the
>    standard template was defined, rsync was the only distribution
>    mechanism for RPKI repositories.
> 
>    Since the publication of the standard template, a new, additional
>    protocol for distribution of RPKI repositories has been developed:
>    the RPKI Repository Delta Protocol (RRDP).  While RPKI repository
>    operators must provide rsync service, RRDP is typically deployed
>    alongside it as well, and preferred by default by most Relying Party
>    (RP) implementations.  However, RP implementations also support
>    fallback to rsync in the event of problems with the RRDP service.  As
>    deployment experience with RRDP has increased, the usefulness of
>    optimizing switchovers by RPs from one mechanism to the other has
>    become apparent.
> 
>    This document describes how Publishers and RPs can use the CMS
>    signing-time attribute to minimize the burden of switching over from
>    RRDP to rsync.  Additionally, this document updates RFC 6488 by
>    mandating the presence of the CMS signing-time attribute and
>    disallowing the use of the binary-signing-time attribute.
> 
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-sidrops-cms-signing-time/
> 
> There is also an HTMLized version available at:
> https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-cms-signing-time-05
> 
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-sidrops-cms-signing-time-05
> 
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
> 
> 
> _______________________________________________
> Sidrops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sidrops