On 06/10/2009, at 11:28 PM, Stephen Kent wrote:
So legitimate transfers will breed duplicates? My recollection of
that discussion that there would be timing in place that
certificate validity times would be tuned (with sparse use of CRLs)
to effect the transfers. Or am I mistaken?
I have been told that it is likely that certs issued in conjunction
with transfers will overlap in validity intervals.
so two organisations, at some point in time, will have the ability to
issue valid and conflicting statements.
I think that is really hairy. I can guess it was for the concern of
maintaining connectivity, ie not creating break scenarios. But to me
it appears to muddy the water. Surely there are better ways to achieve
a low impact transfer? ie place an embargo on ROA/BOA creation for a
time slice either side of the transfer. That would have the effect of
degrading the trust statement, but not conflicting it nor breaking
routing, for the period of transfer.. But still allows a clear
delineation of 'ownership'.
Although I'm not sure if that is in the IETF bailiwick to discuss.
Maybe since having global operations impact it is.
...
If your software can change the contents of the 3779 extensions,
would it not be a simple exercise to change the SIA value?
The model for our local TA management system does not require any
changes to SIA values, because all of the changes are purely local.
And, as I noted, 3rd party CAs are not consistent with the CP.
My thoughts would be that a local TA would also run a local repository
for itself, and any subordinate entities.
Cheers
Terry
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
