Subject: Re: [sidr] time

From: Stephen Kent <[email-masked]>
Date: Sun, 1 May 2011 16:45:39 -0400

At 9:25 AM +0200 4/26/11, Jac Kloots wrote:
>Randy, Others,
>
>It doesn't seem to be a new problem to me. How is this time problem 
>evaluated in the current off-line cache software?
>
>Why think of another approach if the only difference is the device 
>doing the validation of certs and ROA's?
>
>Regards,
>
>Jac
>

I'm not sure about the context an y more, but I'll note that the BBN
RPKI relying party software has (will have?) a local clock tolerance
knob that allows each RP to decide how "stale" a signed object can
be before it is considered "too old."

I would anticipate an analogous router knob for dealing with time
issues in BGPSEC signed objects.

Steve

---

From: "Williams, Marcus (Contractor)" <[email-masked]>
Date: Wed, 18 May 2011 13:04:42 -0500

> >> If you're more than a few years off from the latest ROA issuance
> >> dates, then you're probably bogus.

Is anyone sure what implications there are to line timing and multiplexed interfaces if I'm "bogus"?   Are my otherwise unbogus circuits at risk?

Marcus Williams