Re: [Sidrops] I-D Action: draft-ietf-sidrops-cms-signing-time-03.txt

Hi Job,

> On 18 Jan 2024, at 23:03, Job Snijders <job=40fastly.com@dmarc.ietf.org> wrote:
> 
> Dear all,
> 
> Another pass was made over the text to improve the structure of the
> document and complete the surgery updates to RFC 6488. The
> "Implementation Status" section was also updated.

Can you clarify why the document now mandates that binary signing is disallowed?

This has significant	impact on implementations that are fully conforming to
rfc6488 and has a significant impact on those implementations, effectively
invalidating their test set of objects.

It also invalidates objects generated by public CA implementations if a feature
is enabled.

Please elaborate on the improvement in security posture this gives iff any.

Kind regards,
Ties

> 
> Many thanks to everyone who reviewed the document this week!
> 
> As indicated, the authors would like to move towards WGLC.
> 
> Kind regards,
> 
> Job
> 
> On Thu, Jan 18, 2024 at 01:49:08PM -0800, internet-drafts@ietf.org wrote:
>> Internet-Draft draft-ietf-sidrops-cms-signing-time-03.txt is now available. It
>> is a work item of the SIDR Operations (SIDROPS) WG of the IETF.
>> 
>>   Title:   On the use of the CMS signing-time attribute in RPKI Signed Objects
>>   Authors: Job Snijders
>>            Tom Harrison
>>   Name:    draft-ietf-sidrops-cms-signing-time-03.txt
>>   Pages:   12
>>   Dates:   2024-01-18
>> 
>> Abstract:
>> 
>>   In the Resource Public Key Infrastructure (RPKI), Signed Objects are
>>   defined as Cryptographic Message Syntax (CMS) protected content types
>>   by way of a standard template (RFC 6488).  That template includes an
>>   optional CMS signing-time attribute, representing the purported time
>>   at which the object was signed by its issuer.  At the time when the
>>   standard template was defined, rsync was the only distribution
>>   mechanism for RPKI repositories.
>> 
>>   Since the publication of the standard template, a new, additional
>>   protocol for distribution of RPKI repositories has been developed:
>>   the RPKI Repository Delta Protocol (RRDP).  While RPKI repository
>>   operators must provide rsync service, RRDP is typically deployed
>>   alongside it as well, and preferred by default by most Relying Party
>>   (RP) implementations.  However, RP implementations also support
>>   fallback to rsync in the event of problems with the RRDP service.  As
>>   deployment experience with RRDP has increased, the usefulness of
>>   optimizing switchovers by RPs from one mechanism to the other has
>>   become apparent.
>> 
>>   This document describes how Publishers and RPs can use the CMS
>>   signing-time attribute to minimize the burden of switching over from
>>   RRDP to rsync.  Additionally, this document updates RFC 6488 by
>>   mandating the presence of the CMS signing-time attribute and
>>   disallowing the use of the binary-signing-time attribute.
>> 
>> The IETF datatracker status page for this Internet-Draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-sidrops-cms-signing-time/
>> 
>> There is also an HTMLized version available at:
>> https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-cms-signing-time-03
>> 
>> A diff from the previous version is available at:
>> https://author-tools.ietf.org/iddiff?url2=draft-ietf-sidrops-cms-signing-time-03
>> 
>> Internet-Drafts are also available by rsync at:
>> rsync.ietf.org::internet-drafts
>> 
>> 
>> _______________________________________________
>> Sidrops mailing list
>> Sidrops@ietf.org
>> https://www.ietf.org/mailman/listinfo/sidrops
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops