Subject: [Sidrops] I-D Action: draft-ietf-sidrops-signed-tal-09.txt

From: [email-masked]
Date: Sun, 06 Mar 2022 18:02:25 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the SIDR Operations WG of the IETF.

        Title           : RPKI Signed Object for Trust Anchor Key
        Authors         : Carlos Martinez
                          George G. Michaelson
                          Tom Harrison
                          Tim Bruijnzeels
                          Rob Austein
	Filename        : draft-ietf-sidrops-signed-tal-09.txt
	Pages           : 18
	Date            : 2022-03-06

Abstract:
   A Trust Anchor Locator (TAL) is used by Relying Parties (RPs) in the
   Resource Public Key Infrastructure (RPKI) to locate and validate a
   Trust Anchor (TA) Certification Authority (CA) certificate used in
   RPKI validation.  This document defines an RPKI signed object for a
   Trust Anchor Key (TAK), that can be used by a TA to signal the
   location(s) of the accompanying CA certificate for the current key to
   RPs, as well as the successor key and the location(s) of its CA
   certificate.  This object helps to support planned key rolls without
   impacting RPKI validation.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-signed-tal/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-sidrops-signed-tal-09.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-signed-tal-09

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts

---

From: Russ Housley <[email-masked]>
Date: Mon, 7 Mar 2022 13:13:46 -0500

The revised ASN.1 does not compile.  There are two OPTIONAL TAKey values in a row (predecessor and successor).  If only one of them is present, the receiver canntt tell which one the sender wanted to include.

The following fixes the problem:

   TAK ::= SEQUENCE {	
      version     INTEGER DEFAULT 0,	
      current     TAKey,
      predecessor [0] TAKey OPTIONAL,
      successor   [1] TAKey OPTIONAL	
   }

Russ

> On Mar 6, 2022, at 9:02 PM, [email-masked] wrote:
> 
>