Subject: [sidr] about a router AS-related certificate

From: Sandra Murphy <[email-masked]>
Date: Fri, 14 Oct 2011 10:50:20 -0400 (Eastern Daylight Time)

The wg has just demonstrated a lack of support for adoption of a suggested 
cert profile for routers in draft-turner-sidr-bgpsec-pki-profiles.

Unfortunately, a router certificate is already mentioned in existing wg 
drafts.

The bgpsec-overview draft says:

    BGPSEC extends the RPKI by adding an additional type of certificate,
    referred to as a BGPSEC router certificate, that binds an AS number
    to a public signature verification key, the corresponding private key
    of which is held by one or more BGP speakers within this AS.

The bgpsec-ops drafts says:

    AS/Router Certificates

    A site/operator MAY use a single certificate/key in all their
    routers, one certificate/key per router, or any granularity in
    between.

    A large operator, concerned that a compromise of one router's key
    would make many routers vulnerable, MAY accept a more complex
    certificate/key distribution burden to reduce this exposure.

    On the other extreme, an edge site with one or two routers MAY use a
    single certificate/key.

Is there an alternative router certificate that the wg would like to 
adopt?

If the wg did not realize that the router certificate was needed to 
fulfill existing wg drafts, please speak up.

At any rate, the wg needs to indicate how to proceed here.

--Sandy, speaking as wg chair

---

From: Stephen Kent <[email-masked]>
Date: Mon, 17 Oct 2011 10:47:03 -0400

At 10:50 AM -0400 10/14/11, Sandra Murphy wrote:
>The wg has just demonstrated a lack of support for adoption of a 
>suggested cert profile for routers in 
>draft-turner-sidr-bgpsec-pki-profiles.
>
>Unfortunately, a router certificate is already mentioned in existing 
>wg drafts.

Sandy,

Since the WG is proceeding with the BGPSEC protocol and architecture,
there is a need for a cert profile for routers. It also makes sense to have
these certs be tied to the RPLI, since theses certs are linked to the
AS# of the net with which the router is associated.  So, I believe that
WG members (including me?) were not paying attention for this call 
for adoption.

Can we have a do over :-)?

Steve

---

From: Warren Kumari <[email-masked]>
Date: Mon, 17 Oct 2011 13:06:49 -0400

On Oct 17, 2011, at 10:47 AM, Stephen Kent wrote:

>> The wg has just demonstrated a lack of support for adoption of a suggested cert profile for routers in draft-turner-sidr-bgpsec-pki-profiles.
>> 
>> Unfortunately, a router certificate is already mentioned in existing wg drafts.
> 
> Sandy,
> 
> WG members (including me?) were not paying attention for this call for adoption.

I for one completely missed the CfA[0]…. and, had I not, would have supported adoption….

> Can we have a do over :-)?

Yah, please…

W
[0]: Sorry, I've been reading too many of the OAM discussions and figured I wasn't cool if I didn't unnecessarily abbreviate….

> Steve
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>