Hi Steve,
On 15/09/2009, at 11:03 AM, Stephen Kent wrote:
Terry,
I think you misunderstand the nature of trust anchors in PKIs. No
entity can force all relying parties adopt the entity as a TA,
period. The acceptance of a TA is always a local matter, if the
software is properly designed. For example, in most of my browsers I
can choose to remove the many self-signed CA certs that the browser
vendor has chosen to present to me as TAs. Only if the user (RP) is
forced to use software that fails to offer such choices does a third
party have an ability to impose it's view of who is and is not a TA.
This "sphere of influence" notion is applicable in some contexts,
but it is not applicable to all the ISPs in the world.
I see slight differences in the RPKI, in that we have overlap and
uniqueness issues. I agree that no one can force any replying party to
use any particular single or set of trust anchors. But lets say two
entities near this sphere of influence have the same prefix in their
TA which filters down to two contradictory ROAs. How does a relying
party make that "TA use" statement? How do they reasonably or
programmatically decide? Does your software help them choose which is
true? Or is this just a position of the RPKI is TA value agnostic? And
if that is so, should the drafts be made to reflect that? Last time I
looked there were numerous references to the IANA->RIR->etc hierarchy
and technically that is fine - but I think misses David's scenario.
So, rather than characterizing the local TA management model that I
presented as "rose coloured validation glasses" I would say that it
is a realistic representation of what RPs ought to be able to do,
and what they will be able to do with the RP software that BBN will
make available in open source form.
As I said.. I think it is good work. excuse my glib remark, I didn't
mean to marginalize it. More as a representation of what a relying
party receives and interprets in BGP and in RPKI versus what is
announced (by them) and published in RPKI repositories (by them).
So it certainly has its place - but doesn't address David's
position completely where an organisation, such as the UK
government, might wish to validly assert their own independent
trust anchor for their 51/8 SIDR hierarchy and have the rest of the
relying parties on the internet collect it and validate routes
against it.
The problem is that nobody, including the UK gov, can ensure that
every ISP in the world will recognize it as a TA, period.
Sure. But if we are looking for a qualitative trust statement of TAs,
where does one look? Or don't we? Is this just not a problem to care
about?
The sooner folks get past tjis notion the faster we can have
meaningful discussions on this topic.
Any discussion that helps clarify a situation or lack of understanding
is meaningful.
Terry
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
