Subject: Re: [Sidr] V3 draft of SIDR Charter

From: Stephen Kent <[email-masked]>
Date: Thu, 1 Dec 2005 10:54:10 -0500

At 8:36 PM +1100 11/28/05, Geoff Huston wrote:
>At 07:41 PM 28/11/2005, william(at)elan.net wrote:
>
>>I still think you need to specify that work will include information
>>on how to publish certification objects. Either have this as separate
>>point below or addition to existing one.
>>
>>>  The SIDR working group is charged with the following tasks:
>>>
>>>  - Document an extensible interdomain routing security architecture
>>>
>>>  - Document the use of certification objects within this secure
>>>    routing architecture
>>
>>Possibly change to:
>>
>>   - Document use and publication of certification objects within
>>     secure interdomain routing architecture
>
>Now one way or another we are talking about certificate 
>repositories. What did you have in mind to specify here above and 
>beyond normal repository operation?
>
>thanks,
>
>  Geoff

Geoff,

We have various models for certificate (and CRL) distribution from 
PKI work and from security protocols like S/MIME, TLS/SSL, and IPsec. 
In the case of security protocols we have seen a tendency to tailor 
distribution models to the application environment, while the PKI 
work has offered generic repository models. For SIDR we need to 
examine the ways relying parties (those who want to make use of 
certs) will act, and I expect we will need to tailor a distribution 
model for this application context. Unlike most other applications 
that make use of a PKI, all RPs need access to all certs (and CRLs) 
on a regular basis, in order to validate the "certification objects" 
for all the participants. In the public Internet, one probably needs 
a distribution model that is uniform, rather than a list of optional 
approaches, to avoid burdening RPs with a need to support multiple 
ways of acquiring this data.

Steve

_______________________________________________
Sidr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sidr