Subject: [sidr] FW: I-D Action: draft-huston-rpki-validation-00.txt

From: "Murphy, Sandra" <[email-masked]>
Date: Thu, 11 Jul 2013 10:20:22 +0000

I just saw this.  Looks interesting.

--Sandy, speaking as regular ol' member

________________________________________
From: [email-masked] [[email-masked]] on behalf of [email-masked] [[email-masked]]
Sent: Monday, July 08, 2013 4:12 PM
To: [email-masked]
Subject: I-D Action: draft-huston-rpki-validation-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : RPKI Validation Reconsidered
        Author(s)       : Geoff Huston
                          George Michaelson
        Filename        : draft-huston-rpki-validation-00.txt
        Pages           : 12
        Date            : 2013-07-08

Abstract:
   This document reviews the certificate validation procedure specified
   in RFC6487 and highlights aspects of operational management of
   certificates in the RPKI in response to the movement of resources
   across registries, and the associated actions of Certification
   Authorities to maintain certification of resources during this
   movement.  The document describes an alternative validation procedure
   that reduces the operational impact of certificate management during
   resource movement.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-huston-rpki-validation

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-huston-rpki-validation-00

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: David Mandelberg <[email-masked]>
Date: Tue, 16 Jul 2013 18:25:53 -0400

Hi,

I took a look at this draft, but haven't read it in depth yet. One 
potential issue I see is that it removes the possibility of an 
optimization technique that could significantly decrease the processing 
time needed for RPKI validation. It's currently possible to optimize 
validation for CA certs that don't inherit resources by validating each 
parent-child link independently of the parent's parent or the child's 
children. One benefit of this is that links can be verified in parallel 
on a multi-core machine. If the validation status of each link is stored 
in a database, then another benefit is that adding a new leaf node 
certificate only requires validating the leaf against its parent and 
checking the database for the validity of the parent. Also, if the 
resources of a TA change, the children and affected grandchildren need 
to be re-validated but the unaffected grandchildren don't need any 
additional processing. If I understand this document's proposal 
correctly, all of these optimizations would become invalid.

On 2013-07-11 06:20, Murphy, Sandra wrote:
> From: [email-masked] [[email-masked]]
> on behalf of [email-masked] [[email-masked]]
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/