Geoff Huston wrote:
On 15/06/2010, at 5:08 AM, Sean Turner wrote:
Geoff,
In the rpki-algs document there's a note in section 3 that talks about
algorithm agility. Part of it copied below:
The alternate approach, of allowing
multiple signature algorithms in the RPKI certificate profile, and in
the specification of CMS signatures as used in manifests, ROAS, other
signed objects, and in the provisioning protocol, allows for
algorithm transition to occur within a single RPKI framework, and
allows for individual CAs to commence use of multiple algorithms in a
piecemeal fashion without reliance on the algorithm transition of the
immediate superior CA and without a forced synchronisation of
algorithm transition with subordinate CAs. In the light of this
consideration, this document recommends the comprehensive revision of
the existing RPKI specification and architecture documents to include
provision for multiple signatures with multiple algorithms in order
to support an orderly transition to longer key sizes and to other
signature algorithms in the RPKI.
Question: Is the first sentence suggesting that the certificates should have two
signatures applied? I.e., do you consider a certificate to be an "other signed
object."
nope! (although its an interesting idea, I was assuming that RFC5280 was more
or less cast in concrete rather than plasticine.)
This is good news ;) There's one place to put a signature value and
it's a single valued field.
spt
I was referring in that text to signed objects and the use of CMS and the
option in CMS for multiple signatures, and I was advocating consideration of an
approach that used a single collection of such signed objects. I'm sorry if the
words are less than clear. Perhaps they should be removed in the next iteration
of this draft in any case.
Geoff
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
