Subject: Re: [lisp] Using Signed object to validate entries in Mapping Database: draft-lisp-rgaglian-ioa-00.txt

From: [email-masked] (Noel Chiappa)
Date: Wed, 25 Mar 2009 16:04:54 -0400 (EDT)

> From: Roque Gagliano <[email-masked]>

I looked briefly at the draft, but don't have any comment on it, because it's
mostly about the certificate formats and such, and crypto-stuff is not
something I have much expertise in. However, this caught my eye:

    > The way that RPKI works is by using a distributed repository where each
    > signed object (ie certificates, ioa, roas) mentions the location of its
    > repository. .. the RIR have a repository for the first two layers
    > of material (certificates to ISPs) but the ISP then can implement their
    > own CA and their own repository to host its signed objects (ie ioas).

    > The protocol propossed to fetch all these object from various
    > repositories is rsync and normally a relying party has a local cache
    > with all the material that has download.

One thing that I was very concerned about was latency. Having signed mappings
is not that useful if checking the signing requires another round-trip delay
(after the pontetial round-trip delay to get the mapping to begin with) to
get information needed to verify the signing. (Although I suppose one could
start using the mapping, while checking it in parallel with that.)

(The particular mechanism I came up with for CONS was intended to entirely
eliminate such a delay; with it, an ITR needs only a small number of keys,
which it can pre-load, to verify the signing on any mapping.)

It wasn't clear to me, looking quickly at the draft, how the whole thing
worked at a high level (e.g. 'ITR gets a mapping, it wants to check the
signing, and the following N things happen'), so I don't know if that is
an issue here.

    > There is a lap that by design we took as 24hs from time I update my
    > repository until every party has the latest copy.

Doed everything get flooded out to all the repositories (i.e. every key)?

The notion of tying things to the existing delegation at the RIRs is a
good one, though.

	Noel

---

From: Roque Gagliano <[email-masked]>
Date: Wed, 25 Mar 2009 13:44:31 -0700

Noel,

You may want to read the following draft to get an idea of how the  
SIDR architecture works.

Roque

http://www.ietf.org/internet-drafts/draft-ietf-sidr-arch-06.txt