Re: [Sidrops] draft-ietf-sidrops-rpki-has-no-identity-00

[Randy Bush <[e-mail]>]

> However, with RSC/RTA the operator of that child CA could then sign an
> attestation containing anything else, including a public B-PKI key
> that they may wish to associate with their INRs in specific use cases.

is your intent to authorize the non-rpki identity to act in all matters
for the INR?  i.e. how would one constrain the use cases?  e.g. may the
non-rpki identity write to the RPKI parent, e.g. ripe, and order the
transfer of the INR?  and don't tell me about administrative procedures;
this is a PKI discussion.

so the real-world identity system would sign the rpki INR which then
signs the LOA?  but why is the rpki INR even needed if the real world
identity can simply sign the LOA?

i thought that, way back when, ggm was trying to do the inverse.  using
the rpki private key to authorize some action in the real world.  the
example i remember was a letter of authorization to run a circuit, aka
an LOA for a PNI.

and what also confuses me; well i guess many things about this do; is
that i am not seeing/understanding where CA cross-certification, in the
normal up-the-tree sense, fits.  but i am not an expert on this.

and can we try to reduce use of long complex erudite seeming text
designed to impress rather than explain?

randy