Subject: [sidr] I-D Action: draft-ietf-sidr-rtr-keying-10.txt

From: [email-masked]
Date: Sun, 01 Nov 2015 17:43:02 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF.

        Title           : Router Keying for BGPsec
        Authors         : Randy Bush
                          Sean Turner
                          Keyur Patel
	Filename        : draft-ietf-sidr-rtr-keying-10.txt
	Pages           : 13
	Date            : 2015-11-01

Abstract:
   BGPsec-speaking routers are provisioned with private keys in order to
   sign BGPsec announcements.  The corresponding public keys are
   published in the global Resource Public Key Infrastructure, enabling
   verification of BGPsec messages.  This document describes two methods
   of generating the public-private key-pairs: router-driven and
   operator-driven.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidr-rtr-keying/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-sidr-rtr-keying-10

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-rtr-keying-10

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Randy Bush <[email-masked]>
Date: Mon, 02 Nov 2015 10:54:30 +0900

this should have answered all comments

in addition, a major change.  previous drafts naïvely assumed the router
could send a PKCS#10 to the relevant RPKI CA.  this ignored how the CA
would know the request was authentic.  oops!  now, the operator has to
mediate the conversation.  i am willing to take five minutes of floor
time to discuss/explain this.

randy

---

From: Tim Bruijnzeels <[email-masked]>
Date: Mon, 2 Nov 2015 18:37:25 +0900

Hi Randy,

Good point, and I have to admit that I don't have a clear picture of this yet (there is definitely a part on me there..). But in any case if we are to support signing router certificates in a hosted solution, then it's important that that improves.

So I would be very happy to hear about this.

Tim

> On 02 Nov 2015, at 10:54, Randy Bush <[email-masked]> wrote:
> 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr