On Mon, 14 Jun 2010, Sean Turner wrote:
Geoff Huston wrote:
On 15/06/2010, at 5:08 AM, Sean Turner wrote:
Geoff,
In the rpki-algs document there's a note in section 3 that talks about
algorithm agility. Part of it copied below:
The alternate approach, of allowing
multiple signature algorithms in the RPKI certificate profile, and in
the specification of CMS signatures as used in manifests, ROAS, other
signed objects, and in the provisioning protocol, allows for
algorithm transition to occur within a single RPKI framework, and
allows for individual CAs to commence use of multiple algorithms in a
piecemeal fashion without reliance on the algorithm transition of the
immediate superior CA and without a forced synchronisation of
algorithm transition with subordinate CAs. In the light of this
consideration, this document recommends the comprehensive revision of
the existing RPKI specification and architecture documents to include
provision for multiple signatures with multiple algorithms in order
to support an orderly transition to longer key sizes and to other
signature algorithms in the RPKI.
Question: Is the first sentence suggesting that the certificates should
have two signatures applied? I.e., do you consider a certificate to be an
"other signed object."
nope! (although its an interesting idea, I was assuming that RFC5280 was
more or less cast in concrete rather than plasticine.)
Can you say more about what this means for the certificates?
Does this mean that there might be mulitple certificates, one per
algorithm? If so, how would this avoid the problems of consistency and
coherency you note:
The latter option, that of the concurrent
operation of parallel RPKI structures, poses some complex issues in
terms of synchronisation of actions across the set of RPKI CAs, as
well as issues of consistency and coherency in the operation of
multiple parallel RPKI frameworks, as well as the uncertainties
associated with a global determination of when any such transition
can be considered "complete".
Pretty sure I'm not understanding the draft's recommendation here.
--Sandy, speaking as someone who wants to clarify the wg document, so
probably as wg member
This is good news ;) There's one place to put a signature value and it's a
single valued field.
spt
I was referring in that text to signed objects and the use of CMS and the
option in CMS for multiple signatures, and I was advocating consideration
of an approach that used a single collection of such signed objects. I'm
sorry if the words are less than clear. Perhaps they should be removed in
the next iteration of this draft in any case.
Geoff
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
