Re: [Sidrops] John Scudder's No Objection on draft-ietf-sidrops-rpki-has-no-identity-06: (with COMMENT)

[Job Snijders <[e-mail]>]

On Tue, Apr 19, 2022 at 11:54:19AM -0700, Warren Kumari wrote:
> > On Tue, Apr 19, 2022 at 12:52 PM, Randy Bush <[e-mail]> wrote:
> > > In April, Job wrote:
> > > Randy, is this 'no-identity' document intended to obstruct publication of
> > > https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-rsc ?
> >
> > nope. sorry you seem to see it that way. it does add clarity to how RSC
> > and MTA may be properly used. all this was discussed extensively in the wg.
> 
> The document even references draft-ietf-sidrops-rpki-rsc and uses it as an
> example of something that doesn't run afoul of this.
> 
> Section 4 (Security Considerations) it says:
> "When a document is signed with the private key associated with an
>    RPKI certificate, the signer is speaking for the INRs, the IP address
>    space and Autonomous System (AS) numbers, in the certificate.  This
>    is not an identity; this is an authorization.  In schemes such as
>    [I-D.ietf-sidrops-rpki-rta] and [I-D.ietf-sidrops-rpki-rsc] the
>    signed message further narrows this scope of INRs.  The INRs in the
>    message are a subset of the INRs in the certificate.  If the
>    signature is valid, the message content comes from a party that is
>    authorized to speak for that subset of INRs."

OK! Good to hear everyone is on the same page.

Kind regards,

Job