Re: [Sidrops] draft-ietf-sidrops-6486bis-04.txt

[Job Snijders <[e-mail]>]

On Mon, Jun 14, 2021 at 05:06:10PM +0200, Tim Bruijnzeels wrote:
> I believe that for normal top-down validation RPs need not consider
> any objects not found on manifests. This seems to align with what you
> are saying.
> 
> But what I am after is the following. RTA as proposed supports the
> idea of out-of-band exchanges of RTA objects, where those objects may
> NOT appear in RPKI. I believe RSC supports this option as well (but I
> need to re-read). So, in short, they may or may not appear on
> manifests. So, I would prefer that RPs can still do ad-hoc validation
> of RTA objects which they received out-of-band. Typically the RTA EE
> certificate would refer to a CRL and parent CA certificate which can
> be found in the RPKI (and manifests).
> 
> Open to other text and discussion.

RSC is always distributed 'out-of-band', thus they MUST NOT appear on a
Manifest, please see:
https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-rsc-04#section-2

As a consequence, RSC objects do not have a 'Subject Information Access'
extension. The RSC's AIA and CRLDP point to objects in the global RPKI.

A (currently valid under RIPE TA) example RSC file can be found here:
https://mailarchive.ietf.org/arch/msg/sidrops/TbCem3eu_PW8BRyBl48oqh1La74/

Kind regards,

Job