On Oct 7, 2009, at 12:47 PM, Robert Kisteleki wrote:
Terry, see below...
Terry manderson wrote:
On 06/10/2009, at 11:28 PM, Stephen Kent wrote:
So legitimate transfers will breed duplicates? My recollection of
that discussion that there would be timing in place that
certificate validity times would be tuned (with sparse use of
CRLs) to effect the transfers. Or am I mistaken?
I have been told that it is likely that certs issued in
conjunction with transfers will overlap in validity intervals.
so two organisations, at some point in time, will have the ability
to issue valid and conflicting statements.
They have that ability today, it is being used and it's useful.
Would you want to take that ability away from them, should they want
to use RPKI?
I think that is really hairy. I can guess it was for the concern of
maintaining connectivity, ie not creating break scenarios. But to
me it appears to muddy the water. Surely there are better ways to
achieve a low impact transfer? ie place an embargo on ROA/BOA
creation for a time slice either side of the transfer. That would
have the effect of degrading the trust statement, but not
conflicting it nor breaking routing, for the period of transfer..
But still allows a clear delineation of 'ownership'.
Suppose you're ISP1, and want to sell some part of your clients to
ISP2 (this happens: mergers, splits, you name it). In other words,
you want to transfer a live, routed and used chunk of space to
another party. How would you execute this while ROAs are in place?
If you think about it you'll realize that there have to be multiple
ROAs which overlap in terms of validity time, otherwise you
introduce exact timing, which sounds pretty difficult to execute
with 30K+ participants.
Of course the whole story is a lot easier if you don't need to keep
the network alive.
Operators will always opt to keep their network alive, anything that
risks keeping the network operational will have a hard time finding a
place in networks.
I can think of other cases I'm not going to enumerate here, but
typically transfers of customers and space take months if not years to
sort out, while actual network control may happen more immediately. I
think we still have customers on "NTT" space that are homed on the
Cogent network from some prior transfers.
- Jared
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
