Hi Jeff, you are right that concerns for securing the allocation data and the operational use of routing authorization are different - even when the routing authorization has to build on the allocation data (hierarchy).
The concerns for operational use of routing authorization need more attention. you wrote: > Just to clarify. > > On Mon, Sep 21, 2009 at 10:41:58AM -0400, Sandra Murphy wrote: > > We decided way back that the authorization to originate a route to a > > prefix must come from the prefix holder. > > I agree. > > > And that identification of a prefix holder comes from the entity > > that allocated the prefix. > > I agree, however I believe it is important that the "entity that > allocated the prefix" should not be in a position to unilaterally make > the prefix unroutable by the prefix holder after the allocation is > complete. yes, this seems to be a crucial concern of operators. So far I see two factors to deal with it: (1) agree on policies for operating the RPKI that only allows revocation (2) muck with the revocation mechanism/implementation I think both factors should be used: (1) to make explicit the intended rules and have them implemented most of the time and (2) as a safety belt against "errors" and interference from whatever parties... I guess (2) means that some non standard variation of PKI needs to be invented; how painful is that going to be for PKI folks? Other question: Operators see "uncontrolled" revocation of the authorization chain as a threat to using the RPKI to control routing. Are there other relevant threats? So far I found only "revocation" and "unexpected expiration"; where "unexpected expiration" should be dealt with by avoiding short expiration times and processes for advance expiration checking and reminders (without mucking around with the protocol). Ruediger Ruediger Volk Deutsche Telekom AG -- Internet Backbone Engineering _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
