Re: [Trust-router] Considering delaying BOF Request

[Sam Hartman <[e-mail]>]

>>>>> "David" == David Chadwick <[e-mail]> writes:

    David> These only talk about the protocol and model, but not about
    David> how actual implementations are initially configured. Maybe my
    David> questions are only ones that Sam and his team of implementors
    David> can answer

Well, this list is most a protocol list, so you'll get a
protocol-centered answer here.

The trust router protocol needs to support fairly robust  filtering. In
particular I think it needs to support the following:

1) A COI managed at a single point (plus redundancy).
That COI membership information is flooded throughout the
network. Filters prevent announcements related to that COI from being
made except along the path that the COI administrator's announcements
would take.

2) Multiple points of administration equally trusted.  As an example if
Eduroam used this model then each continent could inject routes. There
would not be filters between continents, but there would be filters
rejecting routes from lower levels.

3) A model where some subset of the namespace is permitted to be
injected  by people delegated to administer that.  For example  say that
some entity in  kent.ac.uk is permitted to add any realm ending in
kent.ac.uk to a particular COI. Filters permit this but would reject
other routes.

Other models may be required.

Our current implementation only implements the temporary identity
protocol and does not yet implement the trust router protocol or
flooding.  As a result, the trust router, which really ends up just
being a temporary identity proxy, must be given complete topology of the
entire world at startup.

We have had discussions of configuration and proposed filter types on
the moonshot-community list, but those are not implemented yet.
I don't know how much of that will  make its way into the internet
drafts.  We will probably need to specify minimum filter support that
implementations need to have in order to be able to have secure
topology.

--Sam