Re: [Sidrops] RPKI Signed Checklists - draft-spaghetti-sidrops-rpki-rsc-01

[Job Snijders <[e-mail]>]

Dear working group,

I.... hopefully managed to generate the world's first RPKI Signed
Checklist! It is possible this RSC was generated incorrectly, I don't
have a proper validator yet. Generating this RSC .sig involved an ASN.1
to C to XML to DER conversion process, the Lament Configuration, and vi.

Attached to this email are 3 files:

    432K Feb  5 21:31 b42_ipv6_loa.png             \_ arbitrary files
    212B Feb  5 21:31 b42_service_definition.json  /
    1.6K Feb  5 21:31 checklist.sig                <!-- the RSC!

The 'b42_ipv6_loa.png' and 'b42_service_definition.json' files are part
of an imaginary private business to business process in which I try to
prove to a service provider I'm authorized to use 2001:67c:208c::/48.

The 'b42_service_definition.json' could be part of a challenge/response
process initiated by the ISP. The RPKI can now be used to sign arbitrary
files, even hand-written BYOIP Letters Of Authority (LOAs) like the .png :-)

The content-type OID in 'checklist.sig' is '1.3.6.1.4.1.41948.49'. This
OID is a placeholder from the PEN realm, for testing until an assignment
in the relevant SMI registry has been created. Make sure to keep this
OID on a feature branch or hidden behind a compile time option! The
on-the-wire format can still change in future versions of the draft!

The EE certificate in 'checklist.sig' should be validatable via SKI
2C:CA:BC:2A:5D:CB:91:61:AA:B6:27:1A:68:B9:7A:20:01:92:B0:9E (a copy can
be found here: http://console.rpki-client.org/rpki.ripe.net/repository/DEFAULT/LMq8Kl3LkWGqticaaLl6IAGSsJ4.cer.html)
towards the RIPE NCC Trust Anchor.

The 'checklist.sig' eContent is also available in XML format here:
https://github.com/job/draft-rpki-checklists/blob/main/example/b42.xml

The ASN.1 module is here https://datatracker.ietf.org/doc/html/draft-spaghetti-sidrops-rpki-rsc-01

I hope this helps interested parties to implement signers or validators.

Kind regards,

Job