Re: [Sidrops] WG Last Call for draft-ietf-sidrops-signed-tal-14

[Job Snijders <[e-mail]>]

On Mon, Feb 26, 2024 at 09:38:25AM +0100, Tim Bruijnzeels wrote:
> > On Feb 25, 2024, at 11:50, Tom Harrison <[e-mail]> wrote:
> > 
> > On Sun, Feb 25, 2024 at 10:34:06AM +0100, Job Snijders wrote:
> >> I'm not aware of new Signed TAL developments since September 2023 (I
> >> think it was around that time the suggestion was brought forward to
> >> start a WGLC), but perhaps the draft authors know more than I do?
> > 
> > There hasn't been any further implementation work since that time, as
> > far as I know.
> 
> I did some work, a while back, on the basic object support in the rpki-rs library. 
> 
> https://github.com/NLnetLabs/rpki-rs/pull/240
> 
> Note, this is just basic object support, no generation/validation in Krill or
> Routinator - the primary users of this library.  Still, basic object support is a better
> data point, then no support.
> 
> Tom, could you share a TAK object with me (off list) then I can double check that I
> can parse it. Job / rpki-client folk, could you parse the example TAK I created below
> (base64 formatted for email..).

Thanks! Output below:

File:                     test2.tak
Hash identifier:          8PJn8xe2WhoVPCF6DSB33awnVozDJKgKGXrpvknQSDE=
Subject key identifier:   C4:8A:7F:03:C2:78:C0:54:0A:32:E7:A3:9C:0C:27:2C:1B:F5:1D:B9
Certificate issuer:       /CN=E64AD7801CB8A301FE4F9E59B9F07FEC708D9C0B
Certificate serial:       01
Authority key identifier: E6:4A:D7:80:1C:B8:A3:01:FE:4F:9E:59:B9:F0:7F:EC:70:8D:9C:0B
Authority info access:    rsync://example.com/rsync/ta.cer
Subject info access:      rsync://example.com/ta/tak.tak
TAK not before:           Mon 26 Feb 2024 08:24:57 +0000
TAK not after:            Tue 27 Feb 2024 08:24:57 +0000
TAL derived from the 'current' Trust Anchor Key:

	# My nice TA

	https://example.com/ta.cer
	rsync://example.com/rsync/ta.cer

	MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr9LGShKrTjhSDuj+Ql8d
	nGA6eUry4GqQx65j6RiQ5GkAOLUADgkNWmCIScsd9e/HOqIp7QjiYZhSN0lyMoPf
	tlgZ9tPvpu0mtMfHGiymJBUcpxVnx6aPjTsn1J+CUGlMpsRLQ5f2NbkKkDJvRcdQ
	MHAdbFRgrF/VKhTLlHCiVveZcieiJ2D2b69825v2H4AqMzOyN+kCBXST4jNab+FZ
	oNFvilFHUMmiuOzfQZ9dImRyX/cBZ1y/+5pY7aDXAdeurlAJxN4UmJVt0dw9wHaE
	9Nl2J1r61g3qOHLSq7dyAc2noDPD6R571G9UG/hb4BrkoNPMizqfC3yuG9hwV8QC
	zwIDAQAB

TAL derived from the 'predecessor' Trust Anchor Key:

	# My nice TA

	https://example.com/ta.cer
	rsync://example.com/rsync/ta.cer

	MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr9LGShKrTjhSDuj+Ql8d
	nGA6eUry4GqQx65j6RiQ5GkAOLUADgkNWmCIScsd9e/HOqIp7QjiYZhSN0lyMoPf
	tlgZ9tPvpu0mtMfHGiymJBUcpxVnx6aPjTsn1J+CUGlMpsRLQ5f2NbkKkDJvRcdQ
	MHAdbFRgrF/VKhTLlHCiVveZcieiJ2D2b69825v2H4AqMzOyN+kCBXST4jNab+FZ
	oNFvilFHUMmiuOzfQZ9dImRyX/cBZ1y/+5pY7aDXAdeurlAJxN4UmJVt0dw9wHaE
	9Nl2J1r61g3qOHLSq7dyAc2noDPD6R571G9UG/hb4BrkoNPMizqfC3yuG9hwV8QC
	zwIDAQAB

TAL derived from the 'successor' Trust Anchor Key:

	# My nice TA

	https://example.com/ta.cer
	rsync://example.com/rsync/ta.cer

	MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr9LGShKrTjhSDuj+Ql8d
	nGA6eUry4GqQx65j6RiQ5GkAOLUADgkNWmCIScsd9e/HOqIp7QjiYZhSN0lyMoPf
	tlgZ9tPvpu0mtMfHGiymJBUcpxVnx6aPjTsn1J+CUGlMpsRLQ5f2NbkKkDJvRcdQ
	MHAdbFRgrF/VKhTLlHCiVveZcieiJ2D2b69825v2H4AqMzOyN+kCBXST4jNab+FZ
	oNFvilFHUMmiuOzfQZ9dImRyX/cBZ1y/+5pY7aDXAdeurlAJxN4UmJVt0dw9wHaE
	9Nl2J1r61g3qOHLSq7dyAc2noDPD6R571G9UG/hb4BrkoNPMizqfC3yuG9hwV8QC
	zwIDAQAB

Validation: Failed, unable to get local issuer certificate