Subject: [sidr] One and only one RPKI

From: Andy Newton <[email-masked]>
Date: Tue, 18 Nov 2008 10:17:01 -0500

After witnessing the CP document discussion, I'm left wondering if there is
to be one and only one RPKI.  Does the IETF endorse a specific RPKI?  Can
the IETF restrict any RPKI use to policies of this CP?

-andy

_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: Randy Bush <[email-masked]>
Date: Tue, 18 Nov 2008 10:01:58 -0600

Andy Newton wrote:
> to be one and only one RPKI.

nothing else makes any sense.

arin does not like that the cp has to be agreed by the entire community
affected by it?

randy

---

From: Andy Newton <[email-masked]>
Date: Tue, 18 Nov 2008 11:19:06 -0500

> nothing else makes any sense.

So, the IETF does not sanction the use of the RPKI specs for a set of
cooperative network providers who wish to establish their own trust anchors?
Or the use of the RPKI specs to a government or collective of governments
who wish to establish their own trust anchors?

> arin does not like that the cp has to be agreed by the entire community

To which entire community are you making a reference?  And how did you draw
your inference, given the definition of IETF participation?

-andy

---

From: Randy Bush <[email-masked]>
Date: Tue, 18 Nov 2008 11:07:21 -0600

> who wish to establish their own trust anchors?

sorry.  i was confusing.  i am talking about the rpki instance we as the
operational internet community use.  anyone is welcome to build their
own private universes, of course.  have fun.

> To which entire community are you making a reference?

the one moving your packets.

randy

---

From: Dmitry Burkov <[email-masked]>
Date: Wed, 19 Nov 2008 00:14:07 +0300

> own private universes, of course.  have fun.
we will get immediatelly - as I tried to explain you before on RIPE 
meeteng in Dubai - do you like it or not
or I mistaken?

Dima

---

From: Sandra Murphy <[email-masked]>
Date: Tue, 18 Nov 2008 16:14:17 -0500 (Eastern Standard Time)

> who wish to establish their own trust anchors?

I don't understand the change from talking about the CP to talking about 
trust anchors.  Could you explain what I'm missing?

> your inference, given the definition of IETF participation?

Incidentally, I thought I heard Russ Housley say at the mike that the cert 
format says what CP appliels and it points to this CP.  If I understand, 
using a different CP means changing the cert format.  Am I wrong?

I see the following, which I presume is what Russ was referring to:

3.9.8.  Certificate Policies

    This extension MUST reference the Resource Certificate Policy, using
    the OID Policy Identifier value of "1.3.6.1.5.5.7.14.2".  This field
    MUST be present and MUST contain only this value for Resource
    Certificates.

    No PolicyQualifiers are defined for use with this policy and thus
    none must be included in this extension.

    This extension MUST be present and it is critical.

---

From: "tom.petch" <[email-masked]>
Date: Wed, 26 Nov 2008 19:40:44 +0100

piggybacking, a question that has been bugging me , what is an RPKI?

Is it an 'object class' of which the one discussed within sidr is an object
instance?

or is it something invented by sidr/RPSEC/IETF etc and does not 
exist outside this?

I have been through the I-Ds and they all seem to take this knowledge
as a prerequisite but without any normative reference thereto.

Perhaps draft-ietf-sidr-arch could contain an explanation (and an expansion 
of  RPKI when first it appears:-).

Tom Petch