While implementing the "compound trust anchor structure" described in
draft-ietf-sidr-ta-02, we noticed that some semantics were not
explicitly stated, so a couple of us implementers were not 100% certain
of the correct behavior.
This following is clear. The compound TA structure consists of:
1. An ETA ("external TA") CA cert without RFC 3779 extensions.
2. A single ETA EE cert without RFC 3779 extensions.
3. A CRL for revoking the ETA EE cert.
4. An RTA ("RPKI TA") cert with RFC 3779 extensions, which is contained
inside a CMS blob signed by the ETA EE cert.
The clearly stated intent is to allow the RTA to be replaced relatively
frequently due to changes in the resource holdings encoded into the
RTA's 3779 extensions. The ETA CA cert can remain the long-term trust
anchor.
I believe the following was also intended (but it was not 100% clear):
if either the ETA CA cert expires or the ETA EE cert is revoked, then
the RTA must also be considered invalid. That is, the relationship
between the ETA EE certificate and the RTA is a full "issuer-subject"
relationship, not simply a secure delivery mechanism.
If that's true, could a sentence be added that states it explicitly?
Thanks,
Andrew Chi
BBN
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
