Geoff,
In the rpki-algs document there's a note in section 3 that talks about
algorithm agility. Part of it copied below:
The alternate approach, of allowing
multiple signature algorithms in the RPKI certificate profile, and in
the specification of CMS signatures as used in manifests, ROAS, other
signed objects, and in the provisioning protocol, allows for
algorithm transition to occur within a single RPKI framework, and
allows for individual CAs to commence use of multiple algorithms in a
piecemeal fashion without reliance on the algorithm transition of the
immediate superior CA and without a forced synchronisation of
algorithm transition with subordinate CAs. In the light of this
consideration, this document recommends the comprehensive revision of
the existing RPKI specification and architecture documents to include
provision for multiple signatures with multiple algorithms in order
to support an orderly transition to longer key sizes and to other
signature algorithms in the RPKI.
Question: Is the first sentence suggesting that the certificates
should have two signatures applied? I.e., do you consider a
certificate to be an "other signed object."
spt
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
