Subject: [Sidr] SIDR BOF Minutes from IETF 65

From: Geoff Huston <[email-masked]>
Date: Fri, 24 Mar 2006 00:54:25 +1100

SIDR BOF
WEDNESDAY, March 22 2006
1510-1610

BOF Chair - Geoff Huston

AGENDA

1. Agenda Bashing, Scribe Victimization

2. BOF Status Review
                 Chair

3. Briefing on a PKI proposal for IP resource certification
                 Steve Kent

4. Update on APNIC resource certification trial
                   Geoff Huston

5. Discussion

NOTES (Mark Andrews, Tony Tauber)

2. BOF Status Review

   2nd BOF.  IETF 64 featured extended charter discussion. The proposed SIDR
   Charter was submitted to the ADs in November 2005. Ross Callon (incoming
   AD) reported that the AD consideration of the proposed charter was close
   to completion and would be scheduled for IESG consideration in the near
   future. The advise to SIDR was to assume chartering and commence the work
   plan.

   This meeting has BOF-style presentations to describe motivation rather
   than specific work items.

3. Briefing on a PKI proposal for IP resource certification
                 Steve Kent

    [presentation]

    Jeff Schiller: How does the ROA structure operate when attempting to
    shift upstream providers?

         A: Request a time-limited ROA from old provider to allow the new
         provider to originate the old address during a transition.

      What happens when old provider doesn't co-operate?

         A: That is a business problem

    Pekka Savola: How are the early allocations dealt with?

         A: handled by IANA?  Need to be accommodated in some fashion, but
         this is not a direct question for SIDR.

    Eric Rescorla: Who will be the root? Could this have multiple roots?

         A: There may be a set of trust anchors, or a single trust anchor.
         This is a certificate validation question and the trust anchors are
         a matter for the relying parties to determine.

4. Update on APNIC resource certification trial
                   Geoff Huston

    [presentation]

         ftp://ftp.apnic.net/pub/test-certs/

    Pekka Savola: How is the public key handled?

         A: This is a trial of technology only.  There are no real client
         private keys, and the public / private key pairs are generated by
         the trial engine. Both keys are in the repository. This is not
         standard repository practice.

    Sandy Murphy: Software for handling certificates?

         A: George Michaelson: CPAN based, available rsn

    Sandy Murphy: What about the repository?

        A: Stephen Kent: the query from replying parties is not quite a case
        of "give me everything" and more likely one of "give me what has
        changed".  Start simple.

         A: George Michaelson: APNIC Trial repository is ~9 MB.  Largest
         Cert is 8k

    Steve Casner: Information update delay.  Will it be multiple days?

         A: Geoff Huston: CPS need to written.  Within RIR is business
         decision.

_______________________________________________
Sidr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sidr

---

From: Henk Uijterwaal <[email-masked]>
Date: Fri, 24 Mar 2006 22:41:17 +0100

All,

Since Geoff asked about work items for this group...

One thing that I'd find particularly useful, is a requirements document
for RIRs.   Assume that the RIRs will set up a PKI and hand out a (or more)
certificate(s) for each IP/AS allocation.

* Vendors/protocol designers
   = Requirements that will allow the certificates to be used with
     {s|so|ps|...}BGP.  I don't want to choose a protocol, but I do want
     to make sure that we don't force people into a certain direction
     before the various technologies are fully mature.
   = ...

* LIRs/ISPs
   = How do they see themselves use these certificates
   = What would make them useful/useless.
   = What happens if a block is transferred to a customer.
   = What happens if resources are exchanged (traded) between ISPs.
   = What should be common amongst all 5 RIRs.
   = Interaction with IRRs and such
   = Can they use certificates from other bodies, who controls their
     identity.
   = ...

* Government bodies:
   = Requirements on the PKI (EU, DHS, ...)
     (We will hand out certificates that are used world-wide, so we better
      make sure that they confirm to all relevant local regulations).
   = ...

* Other expected use cases

There is probably a lot more.  However, APNIC has set up a trial PKI,
RIPE NCC has a project in this direction, so we better document
requirements.

Henk

------------------------------------------------------------------------------
Henk Uijterwaal                           Email: henk.uijterwaal(at)ripe.net
RIPE Network Coordination Centre          http://www.amsterdamned.org/~henk
P.O.Box 10096          Singel 258         Phone: +31.20.5354414
1001 EB Amsterdam      1016 AB Amsterdam  Fax: +31.20.5354445
The Netherlands        The Netherlands    Mobile: +31.6.55861746
------------------------------------------------------------------------------

1160438400. Watch this space...