From turners@ieca.com Wed Dec 1 03:45:00 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A62903A6C56 for ; Wed, 1 Dec 2010 03:45:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.423 X-Spam-Level: X-Spam-Status: No, score=-102.423 tagged_above=-999 required=5 tests=[AWL=0.175, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id whlmEwOqRKOn for ; Wed, 1 Dec 2010 03:44:59 -0800 (PST) Received: from nm8.bullet.mail.ac4.yahoo.com (nm8.bullet.mail.ac4.yahoo.com [98.139.52.205]) by core3.amsl.com (Postfix) with SMTP id 879E03A6B41 for ; Wed, 1 Dec 2010 03:44:59 -0800 (PST) Received: from [98.139.52.189] by nm8.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:46:10 -0000 Received: from [98.139.52.153] by tm2.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:46:10 -0000 Received: from [127.0.0.1] by omp1036.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:46:10 -0000 X-Yahoo-Newman-Id: 159428.60606.bm@omp1036.mail.ac4.yahoo.com Received: (qmail 27246 invoked from network); 1 Dec 2010 11:39:30 -0000 Received: from thunderfish.local (turners@96.241.12.197 with plain) by smtp114.biz.mail.re2.yahoo.com with SMTP; 01 Dec 2010 03:39:30 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: BwWP6AgVM1nxDsyyjoCAgVhd696pkwdJSbRS0ZazvdyFP3h QuGWgEBgoL_08muK_c.vzjUJZpmp.5CPdh9RpL.xugFRO1LvcnFZGbs5dxBE Enb1dcX0b0QBeK_iNtfY7vNPSNmDk1yKN.IvYBSATgOiHLRHma_besMjs8PU 5KGe.ksykS35FBd9Wse6u0c9gZzKVvrWVudYbMyyz4ZAUQvUh7j8gxtk0geE GgdK93.PfM4eeRv_Uy1UhIFRWm0B2DEWNYHbl9_gmWYHArc4pSjWqZd3lA5_ 9maCPskE4xBrN3oY___.U7lWPh6zEuJzU9eCvTlbdvyPHWbBWPVekDaOhaLK t2OrzIER1qULDRsr029QFgJkCsqtyARMVBAkz8nEIRIFBz8cL_.paRhlxsb3 MWPsKDNaW.3HCZSuyBmkv39wc1u45 X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF633F2.8090709@ieca.com> Date: Wed, 01 Dec 2010 06:39:30 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-roa-format-09 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 11:45:00 -0000 Sandy, I'd support moving this draft forward once an ASN.1 module is added in an appendix (like the manifest draft). spt On 11/17/10 11:55 PM, Sandra Murphy wrote: > > Matt Lepinski has requested a WG LC for draft "A Profile for Route > Origin Authorizations (ROAs)". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-roa-format. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair bonnet on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From turners@ieca.com Wed Dec 1 03:49:04 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 20BE53A6C56 for ; Wed, 1 Dec 2010 03:49:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.437 X-Spam-Level: X-Spam-Status: No, score=-102.437 tagged_above=-999 required=5 tests=[AWL=0.161, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PcD--de-3Gu2 for ; Wed, 1 Dec 2010 03:49:03 -0800 (PST) Received: from nm25-vm0.bullet.mail.ac4.yahoo.com (nm25-vm0.bullet.mail.ac4.yahoo.com [98.139.52.240]) by core3.amsl.com (Postfix) with SMTP id 4BBC73A6BC0 for ; Wed, 1 Dec 2010 03:49:03 -0800 (PST) Received: from [98.139.52.191] by nm25.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:50:13 -0000 Received: from [98.139.52.177] by tm4.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:50:13 -0000 Received: from [127.0.0.1] by omp1060.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:50:13 -0000 X-Yahoo-Newman-Id: 466264.10544.bm@omp1060.mail.ac4.yahoo.com Received: (qmail 39376 invoked from network); 1 Dec 2010 11:50:13 -0000 Received: from thunderfish.local (turners@96.241.12.197 with plain) by smtp114.biz.mail.re2.yahoo.com with SMTP; 01 Dec 2010 03:50:13 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: DrS3cqEVM1kfoqKSKotJBw_x__yXiOgP1ukGxKFDjrYKG4j OGSmrBvr5wZ9_3BDfhMvpJ2mSc2tloZ6Z8bAw0c5JwopBUjuThfJdmq2EA96 Nm9LUoIg._0FRnlEf9e31p8CInUW43BM3qLqjrMDdMkD_tNoyJpb0TmSfiKU 52l0FDxJQiDckgw73EWAhjWc_uGexB_ja3E94iumdxiHEwA9ziEbsfC5kPdT zelFV_v7E5wkDlbx_uHF799G5ePIZBjFoo8hxSI7F1fnIelqXF8vPQy8UazX na6E8AVw4qQfXA1vSGwzHnCGod4rXTYlGrcu3bB85p8CxafaSy8X_2Pj6kw1 14XxwlLZtrX8sLONL0mdusFAftAM22d82zqnsoEOYCgisVPgw4nL3yngN9jc eT1_bcrnP.TWrg.58J0cfIp_CXFodl7AGNu9m X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF63674.1040205@ieca.com> Date: Wed, 01 Dec 2010 06:50:12 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-res-certs-20 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 11:49:04 -0000 Sandy, I hate to hold this document up for this, but the example in Appendix B shows two AKI extensions in the CRL. Shouldn't there be only one (ala the highlander)?. spt On 11/17/10 11:56 PM, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft "A Profile for X.509 PKIX > Resource Certificates". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-res-certs. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair boater on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From turners@ieca.com Wed Dec 1 03:49:57 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8820D3A6BC0 for ; Wed, 1 Dec 2010 03:49:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.448 X-Spam-Level: X-Spam-Status: No, score=-102.448 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ib1sysjcUzEf for ; Wed, 1 Dec 2010 03:49:56 -0800 (PST) Received: from nm5-vm0.bullet.mail.ac4.yahoo.com (nm5-vm0.bullet.mail.ac4.yahoo.com [98.139.52.68]) by core3.amsl.com (Postfix) with SMTP id B554F3A6B3F for ; Wed, 1 Dec 2010 03:49:56 -0800 (PST) Received: from [98.139.52.188] by nm5.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:51:07 -0000 Received: from [98.139.52.147] by tm1.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:51:07 -0000 Received: from [127.0.0.1] by omp1030.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 11:51:07 -0000 X-Yahoo-Newman-Id: 433973.7623.bm@omp1030.mail.ac4.yahoo.com Received: (qmail 27618 invoked from network); 1 Dec 2010 11:51:07 -0000 Received: from thunderfish.local (turners@96.241.12.197 with plain) by smtp111.biz.mail.re2.yahoo.com with SMTP; 01 Dec 2010 03:51:07 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: MfewE0gVM1nzcJIarCcFzpcDqG_hJGMmGXUL8byJ.Ok9x5J uYL53FZNizkxeL.mDBdzcwPIvslPXltUaUYqgB1bT6dBlHLqY_P37vpryf85 MVdgUO30JsyWDSOnvvaSHzUhNmujMLDstDHu08qpBDYTfGH7IjtXqI7a7lTQ E_m2f3SRn.B.PoBksBlD331_X2qMy7HokahtHN_z4q46tlq.8eWbxHUcpm5P zvnvc_AgZf1hSkxTdROn8ziSOZ25hV7llx7wZBlUaSri2qQBt X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF636AA.40509@ieca.com> Date: Wed, 01 Dec 2010 06:51:06 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-rpki-algs-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 11:49:57 -0000 Sandy, I support progressing this document. spt On 11/17/10 11:58 PM, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft " A Profile for Algorithms > and Key Sizes for use in the Resource Public Key Infrastructure". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-rpki-algs/. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair homburg on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From turners@ieca.com Wed Dec 1 04:03:32 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 63A143A6C69 for ; Wed, 1 Dec 2010 04:03:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.458 X-Spam-Level: X-Spam-Status: No, score=-102.458 tagged_above=-999 required=5 tests=[AWL=0.140, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E9m9q5-jeBYF for ; Wed, 1 Dec 2010 04:03:31 -0800 (PST) Received: from nm9-vm0.bullet.mail.ac4.yahoo.com (nm9-vm0.bullet.mail.ac4.yahoo.com [98.139.53.192]) by core3.amsl.com (Postfix) with SMTP id 586303A6C67 for ; Wed, 1 Dec 2010 04:03:31 -0800 (PST) Received: from [98.139.52.195] by nm9.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 12:04:41 -0000 Received: from [98.139.52.130] by tm8.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 12:04:41 -0000 Received: from [127.0.0.1] by omp1013.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 12:04:41 -0000 X-Yahoo-Newman-Id: 965348.62360.bm@omp1013.mail.ac4.yahoo.com Received: (qmail 31663 invoked from network); 1 Dec 2010 11:58:01 -0000 Received: from thunderfish.local (turners@96.241.12.197 with plain) by smtp113.biz.mail.mud.yahoo.com with SMTP; 01 Dec 2010 03:58:00 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: 1A5Dcu4VM1mj4Sw9NFW386lXdFeLsGtqMfCvCIFsfwAXjsd qeHCnqUj2ybHMzzjtbvp2hTMpgHiYmLJk9Y2VkXjPgS_xeo_uXND11cDW6KN UaQ7UyLTD7AN.j_A2gYqg47AvcDBBO0B8QcXqXbkiwK6NAOEG72.qPG7W7V8 .GEJAV2H1UyioJTuqatucnxRzggJ.z9xQGc81hQRlPoBcOQpXvBAqqaXKRR6 BtzewubwY5gldyyVJSswIPTd76fssQQckrgR9gfEGMWvRQkxRLrhHzkWHp4k 7OY4OW6GtFcXJ_3T3ZdSNHd.yl1cNZS1lPU1Gvtr3iua7iw-- X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF63848.1010001@ieca.com> Date: Wed, 01 Dec 2010 06:58:00 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-rpki-manifests-09 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 12:03:32 -0000 Sandy, I support progressing this draft. spt On 11/17/10 11:59 PM, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft "Manifests for the > Resource Public Key Infrastructure". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-rpki-manifests. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair beret on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From turners@ieca.com Wed Dec 1 04:15:42 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E06B23A6C72 for ; Wed, 1 Dec 2010 04:15:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.467 X-Spam-Level: X-Spam-Status: No, score=-102.467 tagged_above=-999 required=5 tests=[AWL=0.131, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BkAy4LB-pbcW for ; Wed, 1 Dec 2010 04:15:41 -0800 (PST) Received: from nm25-vm0.bullet.mail.ac4.yahoo.com (nm25-vm0.bullet.mail.ac4.yahoo.com [98.139.52.240]) by core3.amsl.com (Postfix) with SMTP id E737C3A69ED for ; Wed, 1 Dec 2010 04:15:40 -0800 (PST) Received: from [98.139.52.193] by nm25.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 12:16:54 -0000 Received: from [98.139.52.151] by tm6.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 12:16:54 -0000 Received: from [127.0.0.1] by omp1034.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 12:16:54 -0000 X-Yahoo-Newman-Id: 327210.49433.bm@omp1034.mail.ac4.yahoo.com Received: (qmail 6143 invoked from network); 1 Dec 2010 12:16:54 -0000 Received: from thunderfish.local (turners@96.241.12.197 with plain) by smtp113.biz.mail.re2.yahoo.com with SMTP; 01 Dec 2010 04:16:54 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: IRUeYMAVM1lj1bM39Od0ZCjvmj6ZQQLGC9KszqC1rOJE9Xd j72m8zwSJOnS7ocdGTRShv5.r5118FTMNGlEg8hhaElBMcYkOqTS7n9F_w7G p3zAfyxIXMXQzo8fh6iW2A4kYRC0Azc0B_0m98KuJ9381pTBXS.O8VbUoBgk AUssqSMtuSaCYcpS1_gzjXJQX5Fk0SI3oei7YX4dKz5pX4r1qKm1Dxz3Ik4r l5G7.M3gB0NJPbvsStxQVDt9vIRWWfHoCOaoA8XCVD56LokEO X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF63CB5.6080601@ieca.com> Date: Wed, 01 Dec 2010 07:16:53 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-keyroll-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 12:15:42 -0000 Sandy, My only reservation with this document before I support progressing it is the following from section 4.2: When a key rollover occurs, the EE certificate for the RPKI signed object MUST be re-issued, under the key of the NEW CA. A CA MAY choose to treat this EE certificate the same way that it deals with CA certificates, i.e., to copy over all fields and extensions, and MAY change only the notBefore date and the serial number. If the CA adopts this approach, then the new EE certificate is inserted into the CMS wrapper, but the signed context remains the same. (If the signing time or binary signing time values in the CMS wrapper are non-null, they MAY be updated to reflect the current time.) I think a note/warning/pointer is needed to reiterate what's in Section 2.1.6.4.3/4 of [ID.ietf-sidr-signed-object] because normally changing the value of signed attribute would invalidate the signature on that object. [ID.ietf-sidr-signed-object] says: The presence or absence of the SigningTime/BinarySigningTime attribute MUST NOT affect the validity of the signed object. So maybe adding something like: As noted in Section 2.1.6.4.3 and 2.1.6.4.4 of [ID.ietf-sidr-signed-object], the presence or absence of the SigningTime and/or the BinarySigningTime attribute MUST NOT affect the validity of the signed object. would help us CMS weenies ;) spt On 11/17/10 11:56 PM, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft "CA Key Rollover in the RPKI". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-keyroll. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair derby on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From gih@apnic.net Wed Dec 1 05:40:53 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 61C4E3A6D4C for ; Wed, 1 Dec 2010 05:40:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.015 X-Spam-Level: X-Spam-Status: No, score=-98.015 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zs1NwWdRIRMZ for ; Wed, 1 Dec 2010 05:40:52 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id C49713A6D22 for ; Wed, 1 Dec 2010 05:40:51 -0800 (PST) Received: from [10.116.12.122] (unknown [78.41.129.5]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id 5F645B649D; Wed, 1 Dec 2010 23:37:52 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: Geoff Huston In-Reply-To: <4CF63674.1040205@ieca.com> Date: Thu, 2 Dec 2010 00:41:22 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: <8EE5B729-E228-4BB8-8057-BA2A16D1C41B@apnic.net> References: <4CF63674.1040205@ieca.com> To: Sean Turner X-Mailer: Apple Mail (2.1082) Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-res-certs-20 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 13:40:53 -0000 Appendix B shows a dump of a CRL using a ASN -> ascii tool, not the = asn.1 contents per se. that said, I'll remove the line: Authority Key Identifier: Key Identifier g(AKI): q66IrWSGuBE7jqx8PAUHAlHCqRw can we do this as part of the wrap up of the last call rather than a new = round? Geoff On 01/12/2010, at 10:50 PM, Sean Turner wrote: > Sandy, >=20 > I hate to hold this document up for this, but the example in Appendix = B shows two AKI extensions in the CRL. Shouldn't there be only one (ala = the highlander)?. >=20 > spt >=20 > On 11/17/10 11:56 PM, Sandra Murphy wrote: >>=20 >> Geoff Huston has requested a WG LC for draft "A Profile for X.509 = PKIX >> Resource Certificates". >>=20 >> The document and the draft version history are available at >> http://tools.ietf.org/wg/sidr/draft-ietf-sidr-res-certs. >>=20 >> The Last Call will end Wed, 1 Dec 2010 (AOE). >>=20 >> As usual, please address all comments to the WG mailing list, and >> please be clear in your comments to this last call if you are >> supporting the document's submission to the IESG or if you are >> opposed. If you are opposed, please indicate why. >>=20 >> --Sandy, speaking with wg chair boater on >>=20 >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >>=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr -- Geoff Huston Chief Scientist, APNIC +61 7 3858 3100 gih@apnic.net From gih@apnic.net Wed Dec 1 05:44:22 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D83DD28C134 for ; Wed, 1 Dec 2010 05:44:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.015 X-Spam-Level: X-Spam-Status: No, score=-98.015 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jpcQAwJkXuux for ; Wed, 1 Dec 2010 05:44:19 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id D21D528C24A for ; Wed, 1 Dec 2010 05:44:15 -0800 (PST) Received: from [10.116.12.122] (unknown [78.41.129.5]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id 06D55B649D; Wed, 1 Dec 2010 23:41:16 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: Geoff Huston In-Reply-To: <4CF63CB5.6080601@ieca.com> Date: Thu, 2 Dec 2010 00:45:20 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: <7A6E5E17-8E78-4079-A341-883725329F1B@apnic.net> References: <4CF63CB5.6080601@ieca.com> To: Sean Turner X-Mailer: Apple Mail (2.1082) Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-keyroll-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 13:44:22 -0000 this works for me Geoff On 01/12/2010, at 11:16 PM, Sean Turner wrote: > Sandy, >=20 > My only reservation with this document before I support progressing it = is the following from section 4.2: >=20 > When a key rollover occurs, the EE certificate for the RPKI signed > object MUST be re-issued, under the key of the NEW CA. A CA MAY > choose to treat this EE certificate the same way that it deals with > CA certificates, i.e., to copy over all fields and extensions, and > MAY change only the notBefore date and the serial number. If the CA > adopts this approach, then the new EE certificate is inserted into > the CMS wrapper, but the signed context remains the same. (If the > signing time or binary signing time values in the CMS wrapper are > non-null, they MAY be updated to reflect the current time.) >=20 > I think a note/warning/pointer is needed to reiterate what's in = Section 2.1.6.4.3/4 of [ID.ietf-sidr-signed-object] because normally = changing the value of signed attribute would invalidate the signature on = that object. [ID.ietf-sidr-signed-object] says: >=20 > The presence or absence of the SigningTime/BinarySigningTime attribute = MUST NOT affect the validity of the signed object. >=20 > So maybe adding something like: >=20 > As noted in Section 2.1.6.4.3 and 2.1.6.4.4 of = [ID.ietf-sidr-signed-object], the presence or absence of the SigningTime = and/or the BinarySigningTime attribute MUST NOT affect the validity of = the signed object. >=20 > would help us CMS weenies ;) >=20 > spt >=20 > On 11/17/10 11:56 PM, Sandra Murphy wrote: >>=20 >> Geoff Huston has requested a WG LC for draft "CA Key Rollover in the = RPKI". >>=20 >> The document and the draft version history are available at >> http://tools.ietf.org/wg/sidr/draft-ietf-sidr-keyroll. >>=20 >> The Last Call will end Wed, 1 Dec 2010 (AOE). >>=20 >> As usual, please address all comments to the WG mailing list, and >> please be clear in your comments to this last call if you are >> supporting the document's submission to the IESG or if you are >> opposed. If you are opposed, please indicate why. >>=20 >> --Sandy, speaking with wg chair derby on >>=20 >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >>=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr -- Geoff Huston Chief Scientist, APNIC +61 7 3858 3100 gih@apnic.net From turners@ieca.com Wed Dec 1 05:47:35 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8017D28C28E for ; Wed, 1 Dec 2010 05:47:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.475 X-Spam-Level: X-Spam-Status: No, score=-102.475 tagged_above=-999 required=5 tests=[AWL=0.123, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8bHOkDezJQXn for ; Wed, 1 Dec 2010 05:47:32 -0800 (PST) Received: from nm23.bullet.mail.ac4.yahoo.com (nm23.bullet.mail.ac4.yahoo.com [98.139.52.220]) by core3.amsl.com (Postfix) with SMTP id E82BD28C332 for ; Wed, 1 Dec 2010 05:47:31 -0800 (PST) Received: from [98.139.52.196] by nm23.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 13:48:41 -0000 Received: from [98.139.52.177] by tm9.bullet.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 13:48:41 -0000 Received: from [127.0.0.1] by omp1060.mail.ac4.yahoo.com with NNFMP; 01 Dec 2010 13:48:41 -0000 X-Yahoo-Newman-Id: 578268.81594.bm@omp1060.mail.ac4.yahoo.com Received: (qmail 90982 invoked from network); 1 Dec 2010 13:48:41 -0000 Received: from thunderfish.local (turners@96.241.12.197 with plain) by smtp113.biz.mail.mud.yahoo.com with SMTP; 01 Dec 2010 05:48:40 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: y0CvzvkVM1mzAOKYqPii8.bLHWU4Ks0V2DCf5fbk.C.gOtk CiWijM6zWmlHtHF5lWPAtLnLcYvCLl4a6r1H3RFG0pRkis_XeGYasA8wzCqU Jkt7tRb9rX8pDiyt_axHak7DLqEcI7lnitEhk.sk6jupUGYzxrU1_YtM0gak bnsv4mf33t8hf770hRS8xT3o.nrTPbw0yNlpPkThvtrBUXQrat6kSoH_nSMO QpFvcQ7kivrnFHqYBbBdvTAlr0hyWVc8UzZXz37CnjwxzHifHZUSjsXTkPHL Sa4Ty_0KgWeEV4M0L0H95IDzZmY02vpnMwjpNb8POzKYb63M- X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF65237.5030209@ieca.com> Date: Wed, 01 Dec 2010 08:48:39 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Geoff Huston References: <4CF63674.1040205@ieca.com> <8EE5B729-E228-4BB8-8057-BA2A16D1C41B@apnic.net> In-Reply-To: <8EE5B729-E228-4BB8-8057-BA2A16D1C41B@apnic.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] WGLC for draft-ietf-sidr-res-certs-20 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 13:47:35 -0000 Doing it as part of the wrap up is a-okay with me. spt On 12/1/10 8:41 AM, Geoff Huston wrote: > Appendix B shows a dump of a CRL using a ASN -> ascii tool, not the asn.1 contents per se. > > that said, I'll remove the line: > > Authority Key Identifier: Key Identifier g(AKI): > q66IrWSGuBE7jqx8PAUHAlHCqRw > > can we do this as part of the wrap up of the last call rather than a new round? > > Geoff > > > > > On 01/12/2010, at 10:50 PM, Sean Turner wrote: > >> Sandy, >> >> I hate to hold this document up for this, but the example in Appendix B shows two AKI extensions in the CRL. Shouldn't there be only one (ala the highlander)?. >> >> spt >> >> On 11/17/10 11:56 PM, Sandra Murphy wrote: >>> >>> Geoff Huston has requested a WG LC for draft "A Profile for X.509 PKIX >>> Resource Certificates". >>> >>> The document and the draft version history are available at >>> http://tools.ietf.org/wg/sidr/draft-ietf-sidr-res-certs. >>> >>> The Last Call will end Wed, 1 Dec 2010 (AOE). >>> >>> As usual, please address all comments to the WG mailing list, and >>> please be clear in your comments to this last call if you are >>> supporting the document's submission to the IESG or if you are >>> opposed. If you are opposed, please indicate why. >>> >>> --Sandy, speaking with wg chair boater on >>> >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > > -- > > Geoff Huston > Chief Scientist, APNIC > > +61 7 3858 3100 > gih@apnic.net > > > > > From Wesley.E.George@sprint.com Wed Dec 1 12:48:23 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A881528C123 for ; Wed, 1 Dec 2010 12:48:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.712 X-Spam-Level: X-Spam-Status: No, score=-3.712 tagged_above=-999 required=5 tests=[AWL=-0.113, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tLrKMkGkDemZ for ; Wed, 1 Dec 2010 12:47:58 -0800 (PST) Received: from VA3EHSOBE001.bigfish.com (va3ehsobe001.messaging.microsoft.com [216.32.180.11]) by core3.amsl.com (Postfix) with ESMTP id 1CB013A6D1B for ; Wed, 1 Dec 2010 12:47:57 -0800 (PST) Received: from mail120-va3-R.bigfish.com (10.7.14.249) by VA3EHSOBE001.bigfish.com (10.7.40.21) with Microsoft SMTP Server id 14.1.225.8; Wed, 1 Dec 2010 20:49:10 +0000 Received: from mail120-va3 (localhost.localdomain [127.0.0.1]) by mail120-va3-R.bigfish.com (Postfix) with ESMTP id 6F0E41448480 for ; Wed, 1 Dec 2010 20:49:10 +0000 (UTC) X-SpamScore: -48 X-BigFish: VS-48(zz936eK542N1418M1432N9371Pzz1202hzz8275dh1033ILz2fh2a8h691h668h34h61h) X-Spam-TCS-SCL: 0:0 X-Forefront-Antispam-Report: KIP:(null); UIP:(null); IPVD:NLI; H:plsasdm1.corp.sprint.com; RD:smtpls1.sprint.com; EFVD:NLI Received: from mail120-va3 (localhost.localdomain [127.0.0.1]) by mail120-va3 (MessageSwitch) id 1291236549800275_7476; Wed, 1 Dec 2010 20:49:09 +0000 (UTC) Received: from VA3EHSMHS026.bigfish.com (unknown [10.7.14.243]) by mail120-va3.bigfish.com (Postfix) with ESMTP id B694833804D for ; Wed, 1 Dec 2010 20:49:09 +0000 (UTC) Received: from plsasdm1.corp.sprint.com (144.230.168.25) by VA3EHSMHS026.bigfish.com (10.7.99.36) with Microsoft SMTP Server (TLS) id 14.1.225.8; Wed, 1 Dec 2010 20:49:07 +0000 Received: from PLSWEH01.ad.sprint.com (PLSWEH01.corp.sprint.com [144.226.242.129]) by plsasdm1.corp.sprint.com (Sentrion-MTA-4.0.5/Sentrion-MTA-4.0.5) with ESMTP id oB1Kn6xL005873 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Wed, 1 Dec 2010 14:49:06 -0600 Received: from PLSWM12A.ad.sprint.com ([fe80::dd81:e8a1:cd6b:78f]) by PLSWEH01.ad.sprint.com ([2002:90e2:f281::90e2:f281]) with mapi id 14.01.0255.000; Wed, 1 Dec 2010 14:49:06 -0600 From: "George, Wes E [NTK]" To: "sidr@ietf.org" Thread-Topic: [sidr] I-D ACTION:draft-ietf-sidr-origin-validation-signaling-00.txt Thread-Index: AQHLkNPt2PKQjEjVeU6tsdFDiGME/pOLwfEQ Date: Wed, 1 Dec 2010 20:49:05 +0000 Message-ID: <54E900DC635DAB4DB7A6D799B3C4CD8E0382B6@PLSWM12A.ad.sprint.com> References: <20101130211502.22708.23455.idtracker@localhost> In-Reply-To: <20101130211502.22708.23455.idtracker@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.153.203.33] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_047F_01CB916F.44DF18A0" MIME-Version: 1.0 X-OriginatorOrg: sprint.com Subject: Re: [sidr] I-D ACTION:draft-ietf-sidr-origin-validation-signaling-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 20:48:23 -0000 ------=_NextPart_000_047F_01CB916F.44DF18A0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I note that this is still listing the requested IANA extended community as non-transitive, but has removed the explicit prohibition to sending this community to an eBGP peer based on my prior feedback. Is that going to work, or does the community need to be redefined as transitive as well? Also, if we're going to allow it to be used in eBGP in even a limited fashion, I think that we do need some text that covers this transitive vs intransitive distinction in a bit more detail. For example, when I recommended that we not explicitly prohibit sending this community on an eBGP session, I also said that it should default to non-transitive for eBGP in order to prevent misconfigurations from causing validation info of questionable origin from moving between ASNs. In other words, it should be a configurable option, but we want to express that the preference is to have people do their own RPKI validation at their ASBR rather than relying on an upstream and to limit propagation of this information since it's of questionable accuracy and trust. We may also want to say that the receiving peer must be explicitly configured to accept the extended community, and by default it should drop any instance of the validation community on eBGP. Not sure if we need to explicitly state that peers that don't understand/support the community should silently ignore it, since I'm pretty sure that's default behavior. Updating the deleted text from the original document might give us something like this: Since the extended community is primarily intended to provide a method to carry prefix validation information within an ASN, it SHOULD be a non-transitive attribute, but there are some applications where it may be necessary for it to transit between ASNs. In order to limit the propagation of this information outside of the originating ASN, it MUST NOT be attached by default while advertising routes to EBGP peers, even if the session is configured to send other communities. It MAY be explicitly configured to be sent between eBGP peers. Additionally, if it is present in an UPDATE message received from an EBGP peer, by default the router MUST remove the origin validation state extended community before parsing rest of the message. The router MAY be explicitly configured to allow the origin validation state from an eBGP peer to be accepted, but this is not recommended unless there is an existing trust relationship between the ASNs (such as upstream ISP and customer). Any ASN that learns validation information from an eBGP peer via this community MUST NOT pass that community beyond routers in its own ASN. Background info if you're not sure where this discussion is coming from: http://www.ietf.org/mail-archive/web/sidr/current/msg01567.html Wes George > -----Original Message----- > From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of > Internet-Drafts@ietf.org > Sent: Tuesday, November 30, 2010 4:15 PM > To: i-d-announce@ietf.org > Cc: sidr@ietf.org > Subject: [sidr] I-D ACTION:draft-ietf-sidr-origin-validation-signaling- > 00.txt > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Secure Inter-Domain Routing Working > Group of the IETF. > > Title : BGP Prefix Origin Validation State Extended > Community > Author(s) : P. Mohapatra, K. Patel, J. Scudder, D. Ward, R. > Bush > Filename : draft-ietf-sidr-origin-validation-signaling-00.txt > Pages : 7 > Date : 2010-11-30 > > As part of the origination AS validation process, it can be desirable > to automatically consider the validation state of routes in the BGP > decision process. The purpose of this document is to provide a > specification for doing so. The document also defines a new BGP > opaque extended community to carry the validation state inside an > autonomous system to influence the decision process of the IBGP > speakers. > > > A URL for this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-ietf-sidr-origin-validation- > signaling-00.txt > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > Below is the data which will enable a MIME compliant mail reader > implementation to automatically retrieve the ASCII version of the > Internet-Draft. ------=_NextPart_000_047F_01CB916F.44DF18A0 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIXHjCCBPYw ggPeoAMCAQICChTCbVgAAAAAAAUwDQYJKoZIhvcNAQEFBQAwcTEbMBkGA1UECxMSQ29weXJpZ2h0 IChjKSAyMDA3MRYwFAYDVQQLEw1TcHJpbnQgTmV4dGVsMTowOAYDVQQDEzFTcHJpbnQgTmV4dGVs IEVudGVycHJpc2UgSW50ZXJtZWRpYXRlIDEgQXV0aG9yaXR5MB4XDTA3MDcxNzE5NDIxNloXDTE1 MDcxNzE5NTIxNloweDETMBEGCgmSJomT8ixkARkWA2NvbTEWMBQGCgmSJomT8ixkARkWBnNwcmlu dDESMBAGCgmSJomT8ixkARkWAmFkMTUwMwYDVQQDEyxTcHJpbnQgTmV4dGVsIEVudGVycHJpc2Ug SXNzdWluZyAxIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL95aoB4 LLMFIOaq8WTtWyNCb7m5xoKdM6oJKXsCx8k8GATPtiX7VPXKMjRNv+jMZXKF9U6RA4wjSKiKMOYg 48ioSpanTxp+7p6+00Nr/eEtjsY+21rDQbANaqFGfkRFv4m59jM53j+mEXIDybTttcQN/CdSvI0d XOD3KxQTPaG+h9uqZmkrdlk/rwvGbKhqmsl2BApItCDlUWt4rbv0GYQR4GP0w6c7e5prJBh89PEq y+NDtv14YqYl5zOBST4IoHX77uS9gZXqglhtpYKDfESgrgcMldsfKyjrOwiRlT7o8ez1iOyCULkp RcGLSe3wxZxx82bPEYjSWJf56V21FV0CAwEAAaOCAYcwggGDMA8GA1UdEwEB/wQFMAMBAf8wHQYD VR0OBBYEFAGPJVAshjSbwX6QH9mINbU/rwuJMAsGA1UdDwQEAwIBhjAQBgkrBgEEAYI3FQEEAwIB ADAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAfBgNVHSMEGDAWgBRRAcgiA5nZbiss2II5eNyr GXZEcTBuBgNVHR8EZzBlMGOgYaBfhjBodHRwOi8vY3JsLmNvcnAuc3ByaW50LmNvbS9QUEtJV0Iw MS9QUEtJV0IwMS5jcmyGK2h0dHA6Ly9jcmwuc3ByaW50LmNvbS9QUEtJV0IwMS9QUEtJV0IwMS5j cmwwgYUGCCsGAQUFBwEBBHkwdzA8BggrBgEFBQcwAoYwaHR0cDovL2NybC5jb3JwLnNwcmludC5j b20vUFBLSVdCMDEvUFBLSVdCMDEuY3J0MDcGCCsGAQUFBzAChitodHRwOi8vY3JsLnNwcmludC5j b20vUFBLSVdCMDEvUFBLSVdCMDEuY3J0MA0GCSqGSIb3DQEBBQUAA4IBAQCpeKWuin6cpun45r8E cmaxzwvYsNiZhC3iTS6sMIbUaSZZM7N0+UavCDZX04/9xlFUQNchlMezJDDlrM2EZyEZ2gDZDN65 22gWd8sJHyi5M8yruC42PHGePBdV8sY0EEB2dxuMsV+jQ1uBThyv1Oo8F38FjEuodYIlYuOWVxPY sDiWNAJ0K0wq+EzxHgxuYO3Afg6pc4TlmHH9ZkWhNC6Lb1MzQjlp+a0FUWAljzZe/QeYbZEINsHx swoQIO0/Uyg9ZUTK3K3mGWmWVdrPjYk3UJCfjOU3qLqIM5J17St7wd1o9Q9UDDJowUKgIZVXH6oY obBGb7rBuyi/SEG5pNHGMIIFkzCCA3ugAwIBAgIQRmQhybpKpLtIEeJdHD7ivzANBgkqhkiG9w0B AQUFADBcMRswGQYDVQQLExJDb3B5cmlnaHQgKGMpIDIwMDcxFjAUBgNVBAsTDVNwcmludCBOZXh0 ZWwxJTAjBgNVBAMTHFNwcmludCBOZXh0ZWwgUm9vdCBBdXRob3JpdHkwHhcNMDcwNTIyMTYyODI1 WhcNMjcwNTIyMTYzNTUyWjBcMRswGQYDVQQLExJDb3B5cmlnaHQgKGMpIDIwMDcxFjAUBgNVBAsT DVNwcmludCBOZXh0ZWwxJTAjBgNVBAMTHFNwcmludCBOZXh0ZWwgUm9vdCBBdXRob3JpdHkwggIi MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCXnrAnWxH9Pnu51vYiwtYe6Q6hcRrIZr84JcW+ 9ze9zfu5pE3+PcsMzk6q5roX7LnwU/omHSUlKCMpnu2D78I5+VsA+U3in/2T0qN3VEdo2jvO8WZH 7KPwVGqYsbJBPk1cNYiRSKG2CRxsdWTDFpn2ri5/rsfWd7U8ZrNPMlFG17kVKJpb5E3e4d4PP7E9 /snxYnG0PCgT8kTe6SVTLIR0nlWZ6J+MvqGiWu21yd5BNFNFzfTitSgDkGtQZ17HbjmXCBkv3ULr 7jM19TAt5ZFjVewmvJPIKZT9/9+7KT6QaQVe/Ao7Xc9tFKgaEBwMCxLRPLHsxEi4oCgr/0N7wyIe CoZropYeM3fxkFIRqa7hGSNQ0HLC51o/LpljxhrNjkoILnyL48mgevqdsER8jz7hlITqy3rHcyCM HLmlt0YlKEYTTr9REXNnoUXNBkvJQPJgyl44xdaUzm3n8ydPtO4Cl0grRouQ4CJ3fQ2Hfi90zYhc vs3hPI4YgccdUv9l2X++lRnazRME7FSGPd9RQh5eerR3bSWBukYo5KwgMGxyIU/hpraYHI38bbiA PZmmpZ8vFk6iP2zVXHTkH+PqatzYGNdSkHLYQG5NM3GZlrE3khygDpfBuNo/VFtzIXAqNfWPJq7y QM7AkGwbN5Y9uOalzh74O+Ej+nQUhVCuaZ46NQIDAQABo1EwTzALBgNVHQ8EBAMCAYYwDwYDVR0T AQH/BAUwAwEB/zAdBgNVHQ4EFgQU6o073JNr96Z42jmfdFu4WxRjgs0wEAYJKwYBBAGCNxUBBAMC AQAwDQYJKoZIhvcNAQEFBQADggIBAHIdGEzkUTJjPn1vyv/vL944OZ8hoVd6anmS1OMR+vRn9L5i fdfmos332+Y+TGGB74lLeMp6lsP1tRd9TgMhB2DvcShCoEpyX8lNdiVczo4cKkZ5zSbaQzlK8Cfr necuMFiFEk2Hi+T790l7DKSz4NbKfZGokZIx15grgrKlGK5ZQuTjfudKfguAXqFasFuxsLX4tcT1 2W2dcBjHdQxJy9LbwDJK39cgOuJlHj+VhwR07ZwS8by5JCm5JbOOrv40uyEWc1mnY6E8Jptq6iyf wpItMr1gAJ1bVkaKjHXfyEqb0OPgu5sbne9mSIJQlwxiiHYHIB4OJXY5bczKpb2OAyyb9jmF/jC6 LMBhl7SmM81ftBiD1HQctqirilaUTlKNtIaZN7dZBFltnQyqSZE6GtQ+xOgojNGyceE/MI9asIFJ jGVXYgUUX15Ri7OajEF+0E3DliTN2VZ2ECmdsuvGyz4AC+pWl8jZLPWUNsGfTgSR1S1+5iIRb6ia yAkpKanTWNTPOPbTGbcetg5oXuKaPywcr6znRysmh1e+spAviXR/o5wv5NyApPix5sxV4urovGJ5 cVu07fw8UPMI0/25cJ4P+owxoRMRMWuEO7K1AF0GuCPr84v0d+CZLb3FqoK3DNJBLTvqGPA8VnAZ ukt2co0Mcw8raOlCypTSGnYoWz0JMIIF2jCCA8KgAwIBAgIKYSGdxgAAAAAAAzANBgkqhkiG9w0B AQUFADBcMRswGQYDVQQLExJDb3B5cmlnaHQgKGMpIDIwMDcxFjAUBgNVBAsTDVNwcmludCBOZXh0 ZWwxJTAjBgNVBAMTHFNwcmludCBOZXh0ZWwgUm9vdCBBdXRob3JpdHkwHhcNMDcwNTIyMTk1MjQw WhcNMjAwNTIyMjAwMjQwWjBxMRswGQYDVQQLExJDb3B5cmlnaHQgKGMpIDIwMDcxFjAUBgNVBAsT DVNwcmludCBOZXh0ZWwxOjA4BgNVBAMTMVNwcmludCBOZXh0ZWwgRW50ZXJwcmlzZSBJbnRlcm1l ZGlhdGUgMSBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCp5IX+RYNn IeUe+BkJ5VfMppHbxZlrSzd831LTblSkdTXQyi8+5A1p1ZObUSzm5mIW352SxStOtGvfSRTKcLg4 HBiZyArS+pQ8QvnXxdY70kzqfrN4+urXrHCol1y9LuUxfSShM0ZsFkC3DEtFj4zC0wi9I71Cb+8V 0rhVx6iTFCHo/KrDJJm/7twjmN39ZxaXZJFV+ofLEd+7wZijHuVlsKy6597etMor3CkeuwcMdp+1 lm/YAWZqmUY98LKKxKIet59OSDJPXP7L2nBJfwkkt6z4ibWQU1j4OJ1cZE5e/STDOXOR9by9FMh9 kDIAKyG/tGaHsxfrMY5miX8MywPlAgMBAAGjggGHMIIBgzAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud DgQWBBRRAcgiA5nZbiss2II5eNyrGXZEcTALBgNVHQ8EBAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAw GQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwHwYDVR0jBBgwFoAU6o073JNr96Z42jmfdFu4WxRj gs0wbgYDVR0fBGcwZTBjoGGgX4YwaHR0cDovL2NybC5jb3JwLnNwcmludC5jb20vUFBLSVdBMDEv UFBLSVdBMDEuY3JshitodHRwOi8vY3JsLnNwcmludC5jb20vUFBLSVdBMDEvUFBLSVdBMDEuY3Js MIGFBggrBgEFBQcBAQR5MHcwPAYIKwYBBQUHMAKGMGh0dHA6Ly9jcmwuY29ycC5zcHJpbnQuY29t L1BQS0lXQTAxL1BQS0lXQTAxLmNydDA3BggrBgEFBQcwAoYraHR0cDovL2NybC5zcHJpbnQuY29t L1BQS0lXQTAxL1BQS0lXQTAxLmNydDANBgkqhkiG9w0BAQUFAAOCAgEAPnhPbwWBkx8lJuBkvFQZ +ndd5xT2WonpdzuqC1B7br4auN7RzovHVmC40RUrZfxf0mkNX9awG4naZaVjQzoMG0ijE8YEz/+X JxOadLsXiatSjljJWSuRp4w6cc9yH2Vc3wkCjSYYhawD6kBVV/j10CWLJVfQ5gLw2OXa/k8jSxoZ 7eyPinEM4bkJOJTNkwPW99MiKwua/qFWeoshPy0w1KlT6mgEQM65mZfIwZ16/AiWcAg1QKgr6YYY kzFu1M7cNEUhhohonAm/XPpsadSBIHKiQrW2rgWW56d5iDoUtoYXPaRZ7b/LaxqtuDrChaCYtYHA iD8LwynwNqNG1L541S/nfAoyQcSmYgx2mo2b23ZsYI6LIEDeAOFtlLOZN/cUeSYACO60y75j1aj1 j9mbfSTA9VfOyayfgVOadeNHdse6zM8pRQ4AJt1yC7mNPkmkON9k+16IqOMXgwa+M4derUwRy+tt QUOZe7iMtI7dgf8hsFteMSrXKkjNth0x2mEdGU8777WRCd4hFEKkGkJ2xTYGXDf8S6tmZM+OQ+Xt gBvxZWMnehlUiycJtDdNazacLowHaRND8C7L6zcFlyeAkCOHoYxcUK7hm5FMfYrr2KZDFcakrjIy AxYyTa/LlKv+spIBjxA+QOKJUYfrM8b+csCvy8vGhihP1EaxSv2J0xEwggarMIIFk6ADAgECAgo8 FVeJAAAAAZIPMA0GCSqGSIb3DQEBBQUAMHgxEzARBgoJkiaJk/IsZAEZFgNjb20xFjAUBgoJkiaJ k/IsZAEZFgZzcHJpbnQxEjAQBgoJkiaJk/IsZAEZFgJhZDE1MDMGA1UEAxMsU3ByaW50IE5leHRl bCBFbnRlcnByaXNlIElzc3VpbmcgMSBBdXRob3JpdHkwHhcNMDgwNTAxMTczNzE0WhcNMTEwNTAx MTczNzE0WjCBzzETMBEGCgmSJomT8ixkARkWA2NvbTEWMBQGCgmSJomT8ixkARkWBnNwcmludDES MBAGCgmSJomT8ixkARkWAmFkMRUwEwYDVQQLEwxEb21haW4gVXNlcnMxEDAOBgNVBAsTB01hbmFn ZWQxGzAZBgNVBAsTElN0YW5kYXJkLVRlY2huaWNhbDEbMBkGA1UEAxMSV2VzbGV5IEUgR2Vvcmdl IElWMSkwJwYJKoZIhvcNAQkBFhpXZXNsZXkuRS5HZW9yZ2VAc3ByaW50LmNvbTCBnzANBgkqhkiG 9w0BAQEFAAOBjQAwgYkCgYEArxfUh9TugEcsXY4OefFQTrGuaTRenLcZg0KCxZlTY7P9wMRCYd8p GJljwH1x4qn0Ejjyz+uX5UL8Biia13BSWRgiq7QYLKTZNKwEpBbeOf9lK/LrPsbFOgat/Zh/lPmx YzxeikU42X3KhyVSCmWdQhmWRu5kfUzsejaGWH9AyuUCAwEAAaOCA2EwggNdMAsGA1UdDwQEAwIF oDA2BgkqhkiG9w0BCQ8EKTAnMA0GCCqGSIb3DQMCAgE4MA0GCCqGSIb3DQMEAgE4MAcGBSsOAwIH MB0GA1UdDgQWBBTFSbrzJuajBSX9B63Y9r2TlgbU5DA8BgkrBgEEAYI3FQcELzAtBiUrBgEEAYI3 FQiBkugshNficv2LB4Xs/liCno8icYbjvkqEsfZAAgFkAgECMB8GA1UdIwQYMBaAFAGPJVAshjSb wX6QH9mINbU/rwuJMIIBXgYDVR0fBIIBVTCCAVEwggFNoIIBSaCCAUWGgeNsZGFwOi8vL0NOPVNw cmludCUyME5leHRlbCUyMEVudGVycHJpc2UlMjBJc3N1aW5nJTIwMSUyMEF1dGhvcml0eSxDTj1Q UEtJV0MwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049 Q29uZmlndXJhdGlvbixEQz1hZCxEQz1zcHJpbnQsREM9Y29tP2NlcnRpZmljYXRlUmV2b2NhdGlv bkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludIYraHR0cDovL2NybC5z cHJpbnQuY29tL1BQS0lXQzAxL1BQS0lXQzAxLmNybIYwaHR0cDovL2NybC5jb3JwLnNwcmludC5j b20vUFBLSVdDMDEvUFBLSVdDMDEuY3JsMIGFBggrBgEFBQcBAQR5MHcwNwYIKwYBBQUHMAKGK2h0 dHA6Ly9jcmwuc3ByaW50LmNvbS9QUEtJV0MwMS9QUEtJV0MwMS5jcnQwPAYIKwYBBQUHMAKGMGh0 dHA6Ly9jcmwuY29ycC5zcHJpbnQuY29tL1BQS0lXQzAxL1BQS0lXQzAxLmNydDApBgNVHSUEIjAg BggrBgEFBQcDAgYIKwYBBQUHAwQGCisGAQQBgjcKAwQwNQYJKwYBBAGCNxUKBCgwJjAKBggrBgEF BQcDAjAKBggrBgEFBQcDBDAMBgorBgEEAYI3CgMEMEwGA1UdEQRFMEOgJQYKKwYBBAGCNxQCA6AX DBV3ZWcwMjIxQGFkLnNwcmludC5jb22BGldlc2xleS5FLkdlb3JnZUBzcHJpbnQuY29tMA0GCSqG SIb3DQEBBQUAA4IBAQBYdUj2FTmOVS0X2fF+OYWXu9QoS6JWB8exD8kBPWVh28UilosoFwpVs2Ux K+V9NE1SC4QXDfwcjyMMV6WfXfy1foT6YAOcLt1z91ALCbTPlr1mazbAnOL6AzoTnq5V+TjvJvdN IYROS6PJC/YU5+w/NannnhC1zNFOtmxZZcrz50uRU8Q4mgITpxcnJXKUtKNaFTEhhtnP+hMVXYW0 eUyG7xjDTCyqsO5jcyI0IKJkNW1NXaKjHfmlAAiL5HVNl7cYL5uce6orHQQPMTSGRmTKCNjx7Yaz EHAorZUGmCTuihdhPDq+tOhGrIDE4XuiDxj+OVU6JXM5nsiKTjU968o4MYIDLTCCAykCAQEwgYYw eDETMBEGCgmSJomT8ixkARkWA2NvbTEWMBQGCgmSJomT8ixkARkWBnNwcmludDESMBAGCgmSJomT 8ixkARkWAmFkMTUwMwYDVQQDEyxTcHJpbnQgTmV4dGVsIEVudGVycHJpc2UgSXNzdWluZyAxIEF1 dGhvcml0eQIKPBVXiQAAAAGSDzAJBgUrDgMCGgUAoIIB/DAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN AQcBMBwGCSqGSIb3DQEJBTEPFw0xMDEyMDEyMDQ4NTlaMCMGCSqGSIb3DQEJBDEWBBRNTkRjCxYH jnstyli0JFOLQGkoqDBnBgkqhkiG9w0BCQ8xWjBYMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIA gDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDAHBgUrDgMCGjAKBggqhkiG 9w0CBTCBlwYJKwYBBAGCNxAEMYGJMIGGMHgxEzARBgoJkiaJk/IsZAEZFgNjb20xFjAUBgoJkiaJ k/IsZAEZFgZzcHJpbnQxEjAQBgoJkiaJk/IsZAEZFgJhZDE1MDMGA1UEAxMsU3ByaW50IE5leHRl bCBFbnRlcnByaXNlIElzc3VpbmcgMSBBdXRob3JpdHkCCjwVV4kAAAABkg8wgZkGCyqGSIb3DQEJ EAILMYGJoIGGMHgxEzARBgoJkiaJk/IsZAEZFgNjb20xFjAUBgoJkiaJk/IsZAEZFgZzcHJpbnQx EjAQBgoJkiaJk/IsZAEZFgJhZDE1MDMGA1UEAxMsU3ByaW50IE5leHRlbCBFbnRlcnByaXNlIElz c3VpbmcgMSBBdXRob3JpdHkCCjwVV4kAAAABkg8wDQYJKoZIhvcNAQEBBQAEgYCHmSZOIoLYEIt6 Ndgd+pIrlWcX0zdzHw3/s8LU1sNw/7rEXQdZdhy9ocXfj/SObd278dLfrg83bdjI+j6egKgXPYdV vdx8tCSa+XzgTB71qKmvyY5bro37qfcrBvH+L+JYP9qkvplP+lbdm1uukryZODvRNKpka7APg1J7 1XoIhgAAAAAAAA== ------=_NextPart_000_047F_01CB916F.44DF18A0-- From gih@apnic.net Thu Dec 2 10:38:51 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0078A3A69BD for ; Thu, 2 Dec 2010 10:38:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.048 X-Spam-Level: X-Spam-Status: No, score=-101.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rSYeUHCxmnCv for ; Thu, 2 Dec 2010 10:38:48 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id DEFD23A69B6 for ; Thu, 2 Dec 2010 10:38:45 -0800 (PST) Received: from [10.5.59.163] (unknown [212.99.116.82]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id 94DCCB66AE; Fri, 3 Dec 2010 04:39:58 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: Geoff Huston In-Reply-To: <7A6E5E17-8E78-4079-A341-883725329F1B@apnic.net> Date: Fri, 3 Dec 2010 05:39:52 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: <7940CE19-3BF1-4D4B-8BCB-3D5E884640A7@apnic.net> References: <4CF63CB5.6080601@ieca.com> <7A6E5E17-8E78-4079-A341-883725329F1B@apnic.net> To: "sidr@ietf.org wg" X-Mailer: Apple Mail (2.1082) Subject: Re: [sidr] WGLC for draft-ietf-sidr-keyroll-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 18:38:51 -0000 As this is the only issue raised with this document during the WGLC I = have edited the document as suggested, and submitted -05 of this = document to reflect the outcome of the WGLC review. thanks, Geoff On 02/12/2010, at 12:45 AM, Geoff Huston wrote: > this works for me >=20 > Geoff >=20 > On 01/12/2010, at 11:16 PM, Sean Turner wrote: >=20 >> Sandy, >>=20 >> My only reservation with this document before I support progressing = it is the following from section 4.2: >>=20 >> When a key rollover occurs, the EE certificate for the RPKI signed >> object MUST be re-issued, under the key of the NEW CA. A CA MAY >> choose to treat this EE certificate the same way that it deals with >> CA certificates, i.e., to copy over all fields and extensions, and >> MAY change only the notBefore date and the serial number. If the CA >> adopts this approach, then the new EE certificate is inserted into >> the CMS wrapper, but the signed context remains the same. (If the >> signing time or binary signing time values in the CMS wrapper are >> non-null, they MAY be updated to reflect the current time.) >>=20 >> I think a note/warning/pointer is needed to reiterate what's in = Section 2.1.6.4.3/4 of [ID.ietf-sidr-signed-object] because normally = changing the value of signed attribute would invalidate the signature on = that object. [ID.ietf-sidr-signed-object] says: >>=20 >> The presence or absence of the SigningTime/BinarySigningTime = attribute MUST NOT affect the validity of the signed object. >>=20 >> So maybe adding something like: >>=20 >> As noted in Section 2.1.6.4.3 and 2.1.6.4.4 of = [ID.ietf-sidr-signed-object], the presence or absence of the SigningTime = and/or the BinarySigningTime attribute MUST NOT affect the validity of = the signed object. >>=20 >> would help us CMS weenies ;) >>=20 >> spt >>=20 >> On 11/17/10 11:56 PM, Sandra Murphy wrote: >>>=20 >>> Geoff Huston has requested a WG LC for draft "CA Key Rollover in the = RPKI". >>>=20 >>> The document and the draft version history are available at >>> http://tools.ietf.org/wg/sidr/draft-ietf-sidr-keyroll. >>>=20 >>> The Last Call will end Wed, 1 Dec 2010 (AOE). >>>=20 >>> As usual, please address all comments to the WG mailing list, and >>> please be clear in your comments to this last call if you are >>> supporting the document's submission to the IESG or if you are >>> opposed. If you are opposed, please indicate why. >>>=20 >>> --Sandy, speaking with wg chair derby on >>>=20 >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>>=20 >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >=20 > -- >=20 > Geoff Huston > Chief Scientist, APNIC >=20 > +61 7 3858 3100 > gih@apnic.net >=20 >=20 >=20 >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr -- Geoff Huston Chief Scientist, APNIC +61 7 3858 3100 gih@apnic.net From gih@apnic.net Thu Dec 2 10:41:35 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 87F073A69B6 for ; Thu, 2 Dec 2010 10:41:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.048 X-Spam-Level: X-Spam-Status: No, score=-101.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NWHFWHK1zey5 for ; Thu, 2 Dec 2010 10:41:34 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id 122A13A69BF for ; Thu, 2 Dec 2010 10:41:34 -0800 (PST) Received: from [10.5.59.163] (unknown [212.99.116.82]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id 0113CB66AE for ; Fri, 3 Dec 2010 04:42:47 +1000 (EST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1082) From: Geoff Huston In-Reply-To: <8EE5B729-E228-4BB8-8057-BA2A16D1C41B@apnic.net> Date: Fri, 3 Dec 2010 05:42:44 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <4CF63674.1040205@ieca.com> <8EE5B729-E228-4BB8-8057-BA2A16D1C41B@apnic.net> To: "sidr@ietf.org wg" X-Mailer: Apple Mail (2.1082) Subject: Re: [sidr] WGLC for draft-ietf-sidr-res-certs-20 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 18:41:35 -0000 Version 21 of this draft has been submitted which addresses this. regards, Geoff On 02/12/2010, at 12:41 AM, Geoff Huston wrote: > Appendix B shows a dump of a CRL using a ASN -> ascii tool, not the = asn.1 contents per se. >=20 > that said, I'll remove the line: >=20 > Authority Key Identifier: Key Identifier g(AKI): > q66IrWSGuBE7jqx8PAUHAlHCqRw >=20 > can we do this as part of the wrap up of the last call rather than a = new round? >=20 > Geoff >=20 >=20 >=20 >=20 > On 01/12/2010, at 10:50 PM, Sean Turner wrote: >=20 >> Sandy, >>=20 >> I hate to hold this document up for this, but the example in Appendix = B shows two AKI extensions in the CRL. Shouldn't there be only one (ala = the highlander)?. >>=20 >> spt >>=20 >> On 11/17/10 11:56 PM, Sandra Murphy wrote: >>>=20 >>> Geoff Huston has requested a WG LC for draft "A Profile for X.509 = PKIX >>> Resource Certificates". >>>=20 >>> The document and the draft version history are available at >>> http://tools.ietf.org/wg/sidr/draft-ietf-sidr-res-certs. >>>=20 >>> The Last Call will end Wed, 1 Dec 2010 (AOE). >>>=20 >>> As usual, please address all comments to the WG mailing list, and >>> please be clear in your comments to this last call if you are >>> supporting the document's submission to the IESG or if you are >>> opposed. If you are opposed, please indicate why. >>>=20 >>> --Sandy, speaking with wg chair boater on >>>=20 >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>>=20 >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >=20 > -- >=20 > Geoff Huston > Chief Scientist, APNIC >=20 > +61 7 3858 3100 > gih@apnic.net >=20 >=20 >=20 >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr -- Geoff Huston Chief Scientist, APNIC +61 7 3858 3100 gih@apnic.net From Internet-Drafts@ietf.org Thu Dec 2 10:45:03 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C01893A69C6; Thu, 2 Dec 2010 10:45:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.443 X-Spam-Level: X-Spam-Status: No, score=-102.443 tagged_above=-999 required=5 tests=[AWL=0.156, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id voNK-sYm6CaS; Thu, 2 Dec 2010 10:45:01 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C2B623A69CB; Thu, 2 Dec 2010 10:45:01 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.09 Message-ID: <20101202184501.16016.3446.idtracker@localhost> Date: Thu, 02 Dec 2010 10:45:01 -0800 Cc: sidr@ietf.org Subject: [sidr] I-D Action:draft-ietf-sidr-keyroll-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 18:45:03 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : CA Key Rollover in the RPKI Author(s) : G. Huston, et al. Filename : draft-ietf-sidr-keyroll-05.txt Pages : 10 Date : 2010-12-02 This document describes an algorithm to allow an entity who undertakes the role of a Certification Authority in the Resource Public Key Infrastructure to perform a rollover of its key pair. This document also notes the requirements placed on Relying Parties who maintain a local cache of the objects that have been published in the distributed Resource Public Key Infrastructure repository publication structure. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sidr-keyroll-05.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-sidr-keyroll-05.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-02104429.I-D@ietf.org> --NextPart-- From Internet-Drafts@ietf.org Thu Dec 2 11:00:03 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 08D2E28C13E; Thu, 2 Dec 2010 11:00:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.444 X-Spam-Level: X-Spam-Status: No, score=-102.444 tagged_above=-999 required=5 tests=[AWL=0.155, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BgZgnAruSPJI; Thu, 2 Dec 2010 11:00:02 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 55F9428C112; Thu, 2 Dec 2010 11:00:02 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.09 Message-ID: <20101202190002.20459.56110.idtracker@localhost> Date: Thu, 02 Dec 2010 11:00:02 -0800 Cc: sidr@ietf.org Subject: [sidr] I-D Action:draft-ietf-sidr-res-certs-21.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 19:00:03 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : A Profile for X.509 PKIX Resource Certificates Author(s) : G. Huston, et al. Filename : draft-ietf-sidr-res-certs-21.txt Pages : 28 Date : 2010-12-02 This document defines a standard profile for X.509 certificates for the purposes of supporting validation of assertions of "right-of-use" of Resources (INRs). The certificates issued under this profile are used to convey the Issuer's authorisation of the Subject to be regarded as the current holder of a "right-of-use" of the INRs that are described in the certificate. This document contains the normative specification of Certificate and Certificate Revocation List (CRL) syntax in the Resource Public Key Infrastructure (RPKI). The document also specifies profiles for the format of certificate requests. The document also specifies the Relying Party RPKI certificate path validation procedure. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sidr-res-certs-21.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-sidr-res-certs-21.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-02104930.I-D@ietf.org> --NextPart-- From turners@ieca.com Thu Dec 2 12:53:55 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ACB7D3A69F5 for ; Thu, 2 Dec 2010 12:53:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.532 X-Spam-Level: X-Spam-Status: No, score=-102.532 tagged_above=-999 required=5 tests=[AWL=0.066, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MGuKPZKBTKOg for ; Thu, 2 Dec 2010 12:53:54 -0800 (PST) Received: from nm10.bullet.mail.sp2.yahoo.com (nm10.bullet.mail.sp2.yahoo.com [98.139.91.80]) by core3.amsl.com (Postfix) with SMTP id E5B603A69C7 for ; Thu, 2 Dec 2010 12:53:54 -0800 (PST) Received: from [98.139.91.69] by nm10.bullet.mail.sp2.yahoo.com with NNFMP; 02 Dec 2010 20:55:08 -0000 Received: from [98.139.91.52] by tm9.bullet.mail.sp2.yahoo.com with NNFMP; 02 Dec 2010 20:55:08 -0000 Received: from [127.0.0.1] by omp1052.mail.sp2.yahoo.com with NNFMP; 02 Dec 2010 20:55:08 -0000 X-Yahoo-Newman-Id: 470421.53582.bm@omp1052.mail.sp2.yahoo.com Received: (qmail 23087 invoked from network); 2 Dec 2010 20:55:08 -0000 Received: from thunderfish.local (turners@71.191.0.20 with plain) by smtp111.biz.mail.sp1.yahoo.com with SMTP; 02 Dec 2010 12:55:08 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: 48Ud6xwVM1lvmc6oRD3rDj0KAyA9Qy4g.9mKrblHjG_9IVu EGALBUjyNmTKVwDS8GbOclLpuGVXt3oeNx4rzPbAP6FcxAFoo7zrGSUR0MDT Aeb4ycgfy31u1ydHhLKWwatoFlJAxPuBxODpeY49gG6.uK9ukj6AXwgTWCj0 .rxQn7tnGb.IYe6mDsGm4AH2pa02a5PP.I0lDgJK4KjSp3Ro7gMFfyyrdht7 VmMR2ZuGpL65q9HSiEB_LHj4ZTXSgACb0Qulzf4nZ3KC.xWCG322tM8YyYrM b.hitJlVWeLkDVP6NOE3vLK22rShKgRdAOw-- X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF807AB.3070005@ieca.com> Date: Thu, 02 Dec 2010 15:55:07 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: <20101202184501.16016.3446.idtracker@localhost> In-Reply-To: <20101202184501.16016.3446.idtracker@localhost> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] I-D Action:draft-ietf-sidr-keyroll-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 20:53:55 -0000 I now fully support this draft progressing. spt On 12/2/10 1:45 PM, Internet-Drafts@ietf.org wrote: > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. > > > Title : CA Key Rollover in the RPKI > Author(s) : G. Huston, et al. > Filename : draft-ietf-sidr-keyroll-05.txt > Pages : 10 > Date : 2010-12-02 > > This document describes an algorithm to allow an entity who > undertakes the role of a Certification Authority in the Resource > Public Key Infrastructure to perform a rollover of its key pair. > This document also notes the requirements placed on Relying Parties > who maintain a local cache of the objects that have been published in > the distributed Resource Public Key Infrastructure repository > publication structure. > > A URL for this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-ietf-sidr-keyroll-05.txt > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > Below is the data which will enable a MIME compliant mail reader > implementation to automatically retrieve the ASCII version of the > Internet-Draft. > > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From turners@ieca.com Thu Dec 2 12:55:08 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2BA0328C0D6 for ; Thu, 2 Dec 2010 12:55:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.534 X-Spam-Level: X-Spam-Status: No, score=-102.534 tagged_above=-999 required=5 tests=[AWL=0.064, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E+awOR7caIaR for ; Thu, 2 Dec 2010 12:55:07 -0800 (PST) Received: from nm29.bullet.mail.sp2.yahoo.com (nm29.bullet.mail.sp2.yahoo.com [98.139.91.99]) by core3.amsl.com (Postfix) with SMTP id 651603A69E8 for ; Thu, 2 Dec 2010 12:55:07 -0800 (PST) Received: from [98.139.91.68] by nm29.bullet.mail.sp2.yahoo.com with NNFMP; 02 Dec 2010 20:56:21 -0000 Received: from [98.139.91.8] by tm8.bullet.mail.sp2.yahoo.com with NNFMP; 02 Dec 2010 20:56:21 -0000 Received: from [127.0.0.1] by omp1008.mail.sp2.yahoo.com with NNFMP; 02 Dec 2010 20:56:21 -0000 X-Yahoo-Newman-Id: 352419.57731.bm@omp1008.mail.sp2.yahoo.com Received: (qmail 13128 invoked from network); 2 Dec 2010 20:56:21 -0000 Received: from thunderfish.local (turners@71.191.0.20 with plain) by smtp112.biz.mail.sp1.yahoo.com with SMTP; 02 Dec 2010 12:56:20 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: Tds678QVM1kCudo1Lxq6Ij.Iiy0BoT.BtWu.4kyuLvm7iw9 1gjNdXRyHFDWQgkzkCyG88HSfrWiNExWUjvVWe4X5cIkxBumI2ZOY.sarhRc WWf8Jlw3Zma36k9KyIBiboWqYZ6JxwslBwJUhvR743Uy9kv39CS0r2RL2n6Z YuLLvLdtzNPaWp4ByGa9tmQHvQZv_61asYCmTyqgmBE199x6H4msfRmx1Rtc mTw43RrNgmKLDl0qsreSlgenqseWZZiNJ0lWTMycSvd3wg.xj2B5Zy7eku.k _O7jq5oH_IDW370NH3mI42BlRcDcBd9A3nQ-- X-Yahoo-Newman-Property: ymail-3 Message-ID: <4CF807F3.8030402@ieca.com> Date: Thu, 02 Dec 2010 15:56:19 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: <20101202190002.20459.56110.idtracker@localhost> In-Reply-To: <20101202190002.20459.56110.idtracker@localhost> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] I-D Action:draft-ietf-sidr-res-certs-21.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 20:55:08 -0000 I now fully support progressing this draft. spt On 12/2/10 2:00 PM, Internet-Drafts@ietf.org wrote: > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. > > > Title : A Profile for X.509 PKIX Resource Certificates > Author(s) : G. Huston, et al. > Filename : draft-ietf-sidr-res-certs-21.txt > Pages : 28 > Date : 2010-12-02 > > This document defines a standard profile for X.509 certificates for > the purposes of supporting validation of assertions of "right-of-use" > of Resources (INRs). The certificates issued under this profile are > used to convey the Issuer's authorisation of the Subject to be > regarded as the current holder of a "right-of-use" of the INRs that > are described in the certificate. This document contains the > normative specification of Certificate and Certificate Revocation > List (CRL) syntax in the Resource Public Key Infrastructure (RPKI). > The document also specifies profiles for the format of certificate > requests. The document also specifies the Relying Party RPKI > certificate path validation procedure. > > A URL for this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-ietf-sidr-res-certs-21.txt > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > Below is the data which will enable a MIME compliant mail reader > implementation to automatically retrieve the ASCII version of the > Internet-Draft. > > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From kotikalapudi.sriram@nist.gov Thu Dec 2 14:36:28 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A458E3A6778 for ; Thu, 2 Dec 2010 14:36:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VXDC2XtdMRuq for ; Thu, 2 Dec 2010 14:36:27 -0800 (PST) Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by core3.amsl.com (Postfix) with ESMTP id E54543A6765 for ; Thu, 2 Dec 2010 14:36:25 -0800 (PST) Received: from WSXGHUB2.xchange.nist.gov (wsxghub2.nist.gov [129.6.18.19]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id oB2MbX67021767; Thu, 2 Dec 2010 17:37:33 -0500 Received: from MBCLUSTER.xchange.nist.gov ([fe80::41df:f63f:c718:e08]) by WSXGHUB2.xchange.nist.gov ([129.6.18.19]) with mapi; Thu, 2 Dec 2010 17:37:07 -0500 From: "Sriram, Kotikalapudi" To: Sandra Murphy Date: Thu, 2 Dec 2010 17:37:32 -0500 Thread-Topic: Re: [sidr] upcoming wg calls Thread-Index: AcuScYJe7pbLbaYlRlamLH+UqMr9iw== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: kotikalapudi.sriram@nist.gov Cc: "sidr@ietf.org" Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 22:36:28 -0000 I support the last call of the following WG documents. draft-ietf-sidr-roa-format-10 draft-ietf-sidr-rpki-rtr-02 draft-ietf-sidr-keyroll-04 draft-ietf-sidr-res-certs-20 draft-ietf-sidr-repos-struct-06 draft-ietf-sidr-rescerts-provisioning-09 draft-ietf-sidr-rpki-algs-04 draft-ietf-sidr-rpki-manifests-09 draft-ietf-sidr-roa-validation-10 draft-ietf-sidr-signed-object-01 draft-ietf-sidr-ta-06 draft-ietf-sidr-arch-11 I support the adoption of the following items. draft-rgaglian-sidr-algorithm-agility-00 draft-ymbk-ghostbusters-01 draft-ymbk-rpki-origin-ops-00 This draft is not ready for last call: draft-ietf-sidr-pfx-validate Please see comments: http://www.ietf.org/mail-archive/web/sidr/current/msg02204.html I also request that it be an Informational RFC (rather than a standards track RFC) just as draft-ietf-sidr-roa-validation already is. Please see comment (my reasons explained): http://www.ietf.org/mail-archive/web/sidr/current/msg02203.html Sriram From randy@psg.com Thu Dec 2 14:46:36 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ACBAC3A69CA for ; Thu, 2 Dec 2010 14:46:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.933 X-Spam-Level: X-Spam-Status: No, score=-1.933 tagged_above=-999 required=5 tests=[AWL=0.666, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fHU0T7K9XHlP for ; Thu, 2 Dec 2010 14:46:35 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id BEC1C3A6804 for ; Thu, 2 Dec 2010 14:46:35 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1POHwK-000Hqu-8C; Thu, 02 Dec 2010 22:47:48 +0000 Date: Fri, 03 Dec 2010 07:47:46 +0900 Message-ID: From: Randy Bush To: "Sriram, Kotikalapudi" In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: "sidr@ietf.org" Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Dec 2010 22:46:36 -0000 > This draft is not ready for last call: draft-ietf-sidr-pfx-validate > Please see comments: > http://www.ietf.org/mail-archive/web/sidr/current/msg02204.html authors are looking at this > I also request that it be an Informational RFC (rather than a > standards track RFC) just as draft-ietf-sidr-roa-validation already > is. like hell. it specifies what running code MUST do in routers. randy From kotikalapudi.sriram@nist.gov Thu Dec 2 16:45:02 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A34B43A680C for ; Thu, 2 Dec 2010 16:45:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nWaVTmWpDzXp for ; Thu, 2 Dec 2010 16:45:01 -0800 (PST) Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by core3.amsl.com (Postfix) with ESMTP id 5F2E53A6A1F for ; Thu, 2 Dec 2010 16:45:00 -0800 (PST) Received: from WSXGHUB2.xchange.nist.gov (wsxghub2.nist.gov [129.6.18.19]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id oB30kBC0011117; Thu, 2 Dec 2010 19:46:11 -0500 Received: from MBCLUSTER.xchange.nist.gov ([fe80::41df:f63f:c718:e08]) by WSXGHUB2.xchange.nist.gov ([129.6.18.19]) with mapi; Thu, 2 Dec 2010 19:45:40 -0500 From: "Sriram, Kotikalapudi" To: Randy Bush Date: Thu, 2 Dec 2010 19:46:06 -0500 Thread-Topic: [sidr] WGLC for draft-ietf-sidr-pfx-validate-00 Thread-Index: AcuScuO/u/U0l/41Rx2lhfQfv9eS/wADYHFQ Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: kotikalapudi.sriram@nist.gov Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-00 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 00:45:02 -0000 Changed the subject title to refer to the document WGLC. Please see comments inline. Thanks. Sriram > -----Original Message----- > From: Randy Bush [mailto:randy@psg.com] > Sent: Thursday, December 02, 2010 5:48 PM > > > I also request that it be an Informational RFC (rather than a > > standards track RFC) just as draft-ietf-sidr-roa-validation already > > is. > > like hell. it specifies what running code MUST do in routers. Mapping the updates to Valid, Invalid, etc. based on ROA objects is an intermediate step to a final step of making a decision about path selection. Both steps are internal to the router. If an ISP has leeway in the final step, then why should anything prevent it from having some leeway in the first step as well (primarily during partial deployment)? I am wondering what is lost if this is an Informational RFC? > > randy From randy@psg.com Thu Dec 2 16:59:20 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2330D3A6403 for ; Thu, 2 Dec 2010 16:59:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.044 X-Spam-Level: X-Spam-Status: No, score=-2.044 tagged_above=-999 required=5 tests=[AWL=0.555, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h0K99A9mzpUP for ; Thu, 2 Dec 2010 16:59:19 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id 376E23A683F for ; Thu, 2 Dec 2010 16:59:19 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1POK0m-000Inx-Ln; Fri, 03 Dec 2010 01:00:32 +0000 Date: Fri, 03 Dec 2010 10:00:31 +0900 Message-ID: From: Randy Bush To: "Sriram, Kotikalapudi" In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-00 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 00:59:20 -0000 > Mapping the updates to Valid, Invalid, etc. based on ROA objects is > an intermediate step to a final step of making a decision about path selection. > Both steps are internal to the router. If an ISP has leeway in the final step, > then why should anything prevent it from having some leeway in the first step as well > (primarily during partial deployment)? when we move bgp best path decision to informational 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 nope. didn't work. sigh randy From Sandra.Murphy@cobham.com Thu Dec 2 18:31:08 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 643AE28C180 for ; Thu, 2 Dec 2010 18:31:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.427 X-Spam-Level: X-Spam-Status: No, score=-102.427 tagged_above=-999 required=5 tests=[AWL=0.172, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lA+kmpQEqpz8 for ; Thu, 2 Dec 2010 18:31:03 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 083BA28C14A for ; Thu, 2 Dec 2010 18:28:47 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oB32TOo9030821; Thu, 2 Dec 2010 20:29:24 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oB32TOfg020309; Thu, 2 Dec 2010 20:29:24 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.92]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 2 Dec 2010 21:29:24 -0500 Date: Thu, 2 Dec 2010 21:29:23 -0500 (Eastern Standard Time) From: Sandra Murphy To: Andrew Chi In-Reply-To: <4CF42DA0.7030102@bbn.com> Message-ID: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 03 Dec 2010 02:29:24.0156 (UTC) FILETIME=[E647A7C0:01CB9291] Cc: sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 02:31:09 -0000 Andrew suggests that the new naming schemes should be added to the repos-struct draft. Tim's message implies that the naming scheme would be added to the roa-format draft (by extension, to whatever draft creates a new repository structure element, like the ghostbusters draft). I'd like wg consideration as to which would be best, both now and going forward. --Sandy On Mon, 29 Nov 2010, Andrew Chi wrote: > On 11/18/2010 4:39 AM, Tim Bruijnzeels wrote: >>> Call for WGLC, I support: >>> >>> draft-ietf-sidr-roa-format >> >> One very minor nit: I think it would be desirable to have a normative >> naming scheme similar to the one used for manifests as defined in the >> repos-struct document; using the extension .roa. >> > > We'll also need to add a ghostbusters extension to repos-struct. I agree > with Tim, and also agree it's minor. > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From tim@ripe.net Fri Dec 3 01:13:36 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 25B383A6AB9 for ; Fri, 3 Dec 2010 01:13:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1qqrzsApQMQP for ; Fri, 3 Dec 2010 01:13:35 -0800 (PST) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:610:240:11::c100:1342]) by core3.amsl.com (Postfix) with ESMTP id 9C02D3A680E for ; Fri, 3 Dec 2010 01:13:34 -0800 (PST) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1PORj5-00062W-Ce; Fri, 03 Dec 2010 10:14:48 +0100 Received: from timbru.vpn.ripe.net ([193.0.21.62] helo=guest82.guestnet.ripe.net) by dodo.ripe.net with esmtp (Exim 4.63) (envelope-from ) id 1PORj5-0007Tl-2H; Fri, 03 Dec 2010 10:14:47 +0100 Message-ID: <4CF8B506.9010305@ripe.net> Date: Fri, 03 Dec 2010 10:14:46 +0100 From: Tim Bruijnzeels User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Sandra Murphy References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> In-Reply-To: X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719bed93db3f476917d21a7232a62df94d5 X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719bed93db3f476917d21a7232a62df94d5 Cc: sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 09:13:36 -0000 Hi, On 12/3/10 3:29 AM, Sandra Murphy wrote: > Andrew suggests that the new naming schemes should be added to the > repos-struct draft. > > Tim's message implies that the naming scheme would be added to the > roa-format draft (by extension, to whatever draft creates a new > repository structure element, like the ghostbusters draft). > > I'd like wg consideration as to which would be best, both now and going > forward. option 1: add to repos-struct Currently the repos-struct draft reserves the following extensions in section 2.2: .cer certificates .crl CRLs .mft Manifests And it goes on to say that signed objects must not use these extensions. I am afraid that it's not possible to add a complete list of reserved signed object extensions to the repos-struct draft. Simply because new object types may be added later. I am afraid we won't be able to update this document all the time -- once it's standard. option 2: add to roa-format (and other signed object docs) That's why I suggested adding it to the ROA format document. The problem with this is of course that then reservations for extensions to be used in the repository are made in different locations. option 3: extract to separate doc Is it possible/better to maintain a simple separate list that maps extensions to various object types? And can this be updated more easily whenever a new signed object makes it to RFC? Current list could look a little like: .cer Certificates as described in RFC sidr-res-certs .crl CRL as specified in RFC sidr-res-certs section 5 (refers to 5280) .mft Manifest as described in RFC sidr-rpki-manifest .roa ROA as described in RFC sidr-roa-format The repos-struct document could refer to it. This option has my preference as it keeps all this stuff centralised. If updating the repos-struct document itself is possible then that option (1) has my preference. But.. as I said before. I really do not want to cause more delays. If none of the 3 options above are feasible (and nothing else is suggested) I would rather have some trial-and-error code in validators to handle everything apart from .cer, .crl and .mft than block last call on either repos-struct or roa-format.. Cheers Tim > > --Sandy > > On Mon, 29 Nov 2010, Andrew Chi wrote: > >> On 11/18/2010 4:39 AM, Tim Bruijnzeels wrote: >>>> Call for WGLC, I support: >>>> >>>> draft-ietf-sidr-roa-format >>> >>> One very minor nit: I think it would be desirable to have a normative >>> naming scheme similar to the one used for manifests as defined in the >>> repos-struct document; using the extension .roa. >>> >> >> We'll also need to add a ghostbusters extension to repos-struct. I >> agree with Tim, and also agree it's minor. >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> From randy@psg.com Fri Dec 3 01:16:15 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8D45028C1A1 for ; Fri, 3 Dec 2010 01:16:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.123 X-Spam-Level: X-Spam-Status: No, score=-2.123 tagged_above=-999 required=5 tests=[AWL=0.476, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CLblucVmR1vq for ; Fri, 3 Dec 2010 01:16:14 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id B27A53A6ABE for ; Fri, 3 Dec 2010 01:16:14 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1PORli-000Jwz-4l; Fri, 03 Dec 2010 09:17:30 +0000 Date: Fri, 03 Dec 2010 18:17:29 +0900 Message-ID: From: Randy Bush To: Tim Bruijnzeels In-Reply-To: <4CF8B506.9010305@ripe.net> References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> <4CF8B506.9010305@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 09:16:15 -0000 let's be old fashioned > option 1: add to repos-struct creates iana registry > option 2: add to roa-format (and other signed object docs) each doc adding requests an entry in registry randy From andrei@ripe.net Fri Dec 3 04:39:29 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3836428C0DE for ; Fri, 3 Dec 2010 04:39:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.743 X-Spam-Level: X-Spam-Status: No, score=-102.743 tagged_above=-999 required=5 tests=[AWL=-0.144, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id noAcz7WZ4tnR for ; Fri, 3 Dec 2010 04:39:28 -0800 (PST) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:610:240:11::c100:1342]) by core3.amsl.com (Postfix) with ESMTP id D244A28C0D9 for ; Fri, 3 Dec 2010 04:39:27 -0800 (PST) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1POUwM-0006uU-7h; Fri, 03 Dec 2010 13:40:43 +0100 Received: from andrei.vpn.ripe.net ([193.0.21.36] helo=Andrei-Robachevskys-MacBook-Air.local) by ayeaye.ripe.net with esmtp (Exim 4.63) (envelope-from ) id 1POUwL-0001p7-Qn; Fri, 03 Dec 2010 13:40:41 +0100 Message-ID: <4CF8E549.3000900@ripe.net> Date: Fri, 03 Dec 2010 13:40:41 +0100 From: Andrei Robachevsky User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6 MIME-Version: 1.0 To: Karen Seo , "sidr@ietf.org wg" References: <4CE532A9.1000500@ripe.net> In-Reply-To: <4CE532A9.1000500@ripe.net> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-RIPE-Signature: 4330a47f43bd7e517cd9d6f2bba43afb5f1c7c78eca1779b20ed8cda2606b03e X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 4330a47f43bd7e517cd9d6f2bba43afb5f1c7c78eca1779b20ed8cda2606b03e Subject: Re: [sidr] Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 12:39:29 -0000 I believe these changes have not been incorporated in the I-D yet. Could this be done and a WGLC requested please? Thanks, Andrei Andrei Robachevsky wrote on 18/11/10 3:05 PM: > This change works for me, I support the request for the WGLC for this > document. > > Andrei > > Karen Seo wrote on 16/11/10 4:31 PM: >> Sandy, Chris -- If there are no complaints by the end of this week about >> the proposed change below, we will have addressed all known comments and >> request that you declare WGLC done on the Certificate Policy. >> >> All -- Based on input from Geoff Huston and Randy Bush, we propose to >> change the 2nd paragraph of the Overview as follows. >> >> From: >> "The structure of the RPKI is modeled on the existing organizational >> structure that is already responsible for IP address and AS number >> resource allocation. In this allocation hierarchy, IANA allocates >> resources to five Regional Internet Registries (RIRs), each of which >> manages address and AS number allocation within a defined >> geopolitical region. The RIRs in turn allocate resources to Internet >> Service Providers, to subscribers with so-called provider- >> independent ("portable") allocations, and in some regions, to >> National Internet Registries (NIRs). (The term LIR is used in some >> regions to refer to what other regions define as an ISP. Throughout >> the rest of this document we will use the term ISP to simplify >> references to these entities.)" >> >> To: >> "The structure of the RPKI is congruent with the number resource >> allocation framework of the Internet. The IANA allocates number >> resources for special purposes [RFC5736], to Regional Internet >> Registries (RIRs), and to others. The RIRs, in turn, manage the >> allocation of number resources to end users, Internet Service >> Providers, and others." >> >> Thank you, >> Karen >> >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> > From andrei@ripe.net Fri Dec 3 05:40:28 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F276C28C11D for ; Fri, 3 Dec 2010 05:40:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.738 X-Spam-Level: X-Spam-Status: No, score=-102.738 tagged_above=-999 required=5 tests=[AWL=-0.139, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RGWnyf9IZhZf for ; Fri, 3 Dec 2010 05:39:58 -0800 (PST) Received: from postlady.ripe.net (postlady.ipv6.ripe.net [IPv6:2001:610:240:11::c100:1341]) by core3.amsl.com (Postfix) with ESMTP id 0470528C0F9 for ; Fri, 3 Dec 2010 05:39:55 -0800 (PST) Received: from ayeaye.ripe.net ([193.0.23.5]) by postlady.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1POVsQ-0002xp-Ui for sidr@ietf.org; Fri, 03 Dec 2010 14:40:44 +0100 Received: from andrei.vpn.ripe.net ([193.0.21.36] helo=Andrei-Robachevskys-MacBook-Air.local) by ayeaye.ripe.net with esmtp (Exim 4.63) (envelope-from ) id 1POVsQ-0006NT-IQ; Fri, 03 Dec 2010 14:40:42 +0100 Message-ID: <4CF8F35A.2000502@ripe.net> Date: Fri, 03 Dec 2010 14:40:42 +0100 From: Andrei Robachevsky User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6 MIME-Version: 1.0 To: "sidr@ietf.org wg" References: <4CE532A9.1000500@ripe.net> <4CF8E549.3000900@ripe.net> In-Reply-To: <4CF8E549.3000900@ripe.net> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-RIPE-Signature: 4330a47f43bd7e517cd9d6f2bba43afbad9149718a1305c859cc21e44d85cf21 X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 4330a47f43bd7e517cd9d6f2bba43afbad9149718a1305c859cc21e44d85cf21 Subject: Re: [sidr] Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 13:40:28 -0000 Andrei Robachevsky wrote on 3/12/10 1:40 PM: > I believe these changes have not been incorporated in the I-D yet. Could > this be done and a WGLC requested please? > s/requested/completed/ > Thanks, > > Andrei > > Andrei Robachevsky wrote on 18/11/10 3:05 PM: >> This change works for me, I support the request for the WGLC for this >> document. >> >> Andrei >> >> Karen Seo wrote on 16/11/10 4:31 PM: >>> Sandy, Chris -- If there are no complaints by the end of this week about >>> the proposed change below, we will have addressed all known comments and >>> request that you declare WGLC done on the Certificate Policy. >>> >>> All -- Based on input from Geoff Huston and Randy Bush, we propose to >>> change the 2nd paragraph of the Overview as follows. >>> >>> From: >>> "The structure of the RPKI is modeled on the existing organizational >>> structure that is already responsible for IP address and AS number >>> resource allocation. In this allocation hierarchy, IANA allocates >>> resources to five Regional Internet Registries (RIRs), each of which >>> manages address and AS number allocation within a defined >>> geopolitical region. The RIRs in turn allocate resources to Internet >>> Service Providers, to subscribers with so-called provider- >>> independent ("portable") allocations, and in some regions, to >>> National Internet Registries (NIRs). (The term LIR is used in some >>> regions to refer to what other regions define as an ISP. Throughout >>> the rest of this document we will use the term ISP to simplify >>> references to these entities.)" >>> >>> To: >>> "The structure of the RPKI is congruent with the number resource >>> allocation framework of the Internet. The IANA allocates number >>> resources for special purposes [RFC5736], to Regional Internet >>> Registries (RIRs), and to others. The RIRs, in turn, manage the >>> allocation of number resources to end users, Internet Service >>> Providers, and others." >>> >>> Thank you, >>> Karen >>> >>> >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>> >> > From kseo@bbn.com Fri Dec 3 09:01:56 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 041D328C134 for ; Fri, 3 Dec 2010 09:01:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.367 X-Spam-Level: X-Spam-Status: No, score=-2.367 tagged_above=-999 required=5 tests=[AWL=0.233, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MDW3Jz3Uj78u for ; Fri, 3 Dec 2010 09:01:54 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by core3.amsl.com (Postfix) with ESMTP id D95F828C104 for ; Fri, 3 Dec 2010 09:01:53 -0800 (PST) Received: from dhcp89-089-198.bbn.com ([128.89.89.198]:49524 helo=[128.89.89.89]) by smtp.bbn.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1POZ2N-00033b-ES for sidr@ietf.org; Fri, 03 Dec 2010 12:03:11 -0500 Mime-Version: 1.0 Message-Id: Date: Fri, 3 Dec 2010 12:03:08 -0500 To: "sidr@ietf.org wg" From: Karen Seo Content-Type: text/plain; charset="us-ascii" ; format="flowed" Subject: [sidr] Fwd: Re: Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 17:01:56 -0000 >Date: Fri, 3 Dec 2010 12:02:42 -0500 >To: Andrei Robachevsky , Sandra Murphy >, Chris Morrow >From: Karen Seo >Subject: Re: [sidr] Certificate Policy -- last change >Cc: kseo >Bcc: >X-Attachments: > >Andrei -- Yes, I was planning to submit another draft that >incorporated this and any other changes that were requested during >the WGLC. > >Sandy, Chris -- Is the WGLC completed for this draft? > >Thank you, >Karen > >>I believe these changes have not been incorporated in the I-D yet. Could >>this be done and a WGLC requested please? >> >>Thanks, >> >>Andrei >> >>Andrei Robachevsky wrote on 18/11/10 3:05 PM: >>> This change works for me, I support the request for the WGLC for this >>> document. >>> >>> Andrei >>> >>> Karen Seo wrote on 16/11/10 4:31 PM: >>>> Sandy, Chris -- If there are no complaints by the end of this week about >>>> the proposed change below, we will have addressed all known comments and >>>> request that you declare WGLC done on the Certificate Policy. >>>> >>>> All -- Based on input from Geoff Huston and Randy Bush, we propose to >>>> change the 2nd paragraph of the Overview as follows. >>>> >>>> From: >>>> "The structure of the RPKI is modeled on the existing organizational >>>> structure that is already responsible for IP address and AS number >>>> resource allocation. In this allocation hierarchy, IANA allocates >>>> resources to five Regional Internet Registries (RIRs), each of which >>>> manages address and AS number allocation within a defined >>>> geopolitical region. The RIRs in turn allocate resources to Internet >>>> Service Providers, to subscribers with so-called provider- >>>> independent ("portable") allocations, and in some regions, to >>>> National Internet Registries (NIRs). (The term LIR is used in some >>>> regions to refer to what other regions define as an ISP. Throughout >>>> the rest of this document we will use the term ISP to simplify >>>> references to these entities.)" >>>> >>>> To: >>>> "The structure of the RPKI is congruent with the number resource >>>> allocation framework of the Internet. The IANA allocates number >>>> resources for special purposes [RFC5736], to Regional Internet >>>> Registries (RIRs), and to others. The RIRs, in turn, manage the >>>> allocation of number resources to end users, Internet Service >>>> Providers, and others." >>>> >>>> Thank you, >>>> Karen >>>> >>>> >>>> _______________________________________________ >>>> sidr mailing list >>>> sidr@ietf.org >>>> https://www.ietf.org/mailman/listinfo/sidr >>>> >>> From christopher.morrow@gmail.com Fri Dec 3 10:12:27 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EC9DF3A6973 for ; Fri, 3 Dec 2010 10:12:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uQWB86XcPckF for ; Fri, 3 Dec 2010 10:12:27 -0800 (PST) Received: from mail-ew0-f53.google.com (mail-ew0-f53.google.com [209.85.215.53]) by core3.amsl.com (Postfix) with ESMTP id B48593A6975 for ; Fri, 3 Dec 2010 10:12:26 -0800 (PST) Received: by ewy6 with SMTP id 6so19765485ewy.40 for ; Fri, 03 Dec 2010 10:13:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:sender:received :in-reply-to:references:date:x-google-sender-auth:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=Z43mvr75KlkQtIjnbCM7fWB+TyhNm8TJQFcMFUP8EP8=; b=UYzXZw8hk9YKNB7gV07aec5B5ukhvelUZAT6fu/pZQh/aMKgdG/no1h2zgliB4qdS4 8ECIr/54Q3GHK51hCakoWJKB0rCUzESw0EMhtwcbFI7lBjaFZxFKQGxJvY64k40tMyoj m2YdXVBE5Ly1OSemJPKgK/m1E7o/47aV46BxQ= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; b=uKaC3lZ/+WC852nm2RmJqYS765qofEcXZT0q5pvrNJFqlArO3XiZOFO5dx4M48CehX jk3Qi+obYguwzX6pQQM2DC9fahG/LWyT1UD+AK8Z/be1icw5Fu5bsiVcP4BOU44Qw1xa o8Cj9VBCqSuWurukPSW4naH97hq7UAULD5Bfo= MIME-Version: 1.0 Received: by 10.213.17.66 with SMTP id r2mr1127223eba.9.1291400023720; Fri, 03 Dec 2010 10:13:43 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.213.108.136 with HTTP; Fri, 3 Dec 2010 10:13:43 -0800 (PST) In-Reply-To: References: Date: Fri, 3 Dec 2010 13:13:43 -0500 X-Google-Sender-Auth: gxeQiP6X9EAVKtwSOWY0nWoUDXI Message-ID: From: Christopher Morrow To: Karen Seo Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: "sidr@ietf.org wg" Subject: Re: [sidr] Fwd: Re: Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 18:12:28 -0000 On Fri, Dec 3, 2010 at 12:03 PM, Karen Seo wrote: >> Date: Fri, 3 Dec 2010 12:02:42 -0500 >> To: Andrei Robachevsky , Sandra Murphy >> , Chris Morrow >> From: Karen Seo >> Subject: Re: [sidr] Certificate Policy -- last change >> Cc: kseo >> Bcc: >> X-Attachments: >> >> Andrei -- Yes, I was planning to submit another draft that incorporated >> this and any other changes that were requested during the WGLC. ah, cool. >> >> Sandy, Chris -- Is the WGLC completed for this draft? I don't believe I've seen one for the sidr-cp doc... we should do that, if all of the above is completed, spin a new draft ver then we can WGLC it? >> >> Thank you, >> Karen >> >>> I believe these changes have not been incorporated in the I-D yet. Coul= d >>> this be done and a WGLC requested please? >>> >>> Thanks, >>> >>> Andrei >>> >>> Andrei Robachevsky wrote on 18/11/10 3:05 PM: >>>> >>>> =A0This change works for me, I support the request for the WGLC for th= is >>>> =A0document. >>>> >>>> =A0Andrei >>>> >>>> =A0Karen Seo wrote on 16/11/10 4:31 PM: >>>>> >>>>> =A0Sandy, Chris -- If there are no complaints by the end of this week >>>>> about >>>>> =A0the proposed change below, we will have addressed all known commen= ts >>>>> and >>>>> =A0request that you declare WGLC done on the Certificate Policy. >>>>> >>>>> =A0All -- Based on input from Geoff Huston and Randy Bush, we propose= to >>>>> =A0change the 2nd paragraph of the Overview as follows. >>>>> >>>>> =A0From: >>>>> =A0 "The structure of the RPKI is modeled on the existing organizatio= nal >>>>> =A0 =A0structure that is already responsible for IP address and AS nu= mber >>>>> =A0 =A0resource allocation. In this allocation hierarchy, IANA alloca= tes >>>>> =A0 =A0resources to five Regional Internet Registries (RIRs), each of= which >>>>> =A0 =A0manages address and AS number allocation within a defined >>>>> =A0 =A0geopolitical region. The RIRs in turn allocate resources to In= ternet >>>>> =A0 =A0Service Providers, to subscribers with so-called provider- >>>>> =A0 =A0independent ("portable") allocations, and in some regions, to >>>>> =A0 =A0National Internet Registries (NIRs). (The term LIR is used in = some >>>>> =A0 =A0regions to refer to what other regions define as an ISP. Throu= ghout >>>>> =A0 =A0the rest of this document we will use the term ISP to simplify >>>>> =A0 =A0references to these entities.)" >>>>> >>>>> =A0To: >>>>> =A0 "The structure of the RPKI is congruent with the number resource >>>>> =A0 =A0allocation framework of the Internet. The IANA allocates numbe= r >>>>> =A0 =A0resources for special purposes [RFC5736], to Regional Internet >>>>> =A0 =A0Registries (RIRs), and to others. =A0The RIRs, in turn, manage= the >>>>> =A0 =A0allocation of number resources to end users, Internet Service >>>>> =A0 =A0Providers, and others." >>>>> >>>>> =A0Thank you, >>>>> =A0Karen >>>>> >>>>> >>>>> =A0_______________________________________________ >>>>> =A0sidr mailing list >>>>> =A0sidr@ietf.org >>>>> =A0https://www.ietf.org/mailman/listinfo/sidr >>>>> >>>> > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From christopher.morrow@gmail.com Fri Dec 3 10:12:57 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE85D28C126 for ; Fri, 3 Dec 2010 10:12:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tYH2wvMaLaRp for ; Fri, 3 Dec 2010 10:12:56 -0800 (PST) Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by core3.amsl.com (Postfix) with ESMTP id 63EB628C10D for ; Fri, 3 Dec 2010 10:12:56 -0800 (PST) Received: by eyd10 with SMTP id 10so5427503eyd.31 for ; Fri, 03 Dec 2010 10:14:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:sender:received :in-reply-to:references:date:x-google-sender-auth:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=gbDQdTLHPxYwisxr4Ro76RUdk2JDEW97CvxBMBNCSHo=; b=Qte8F+O/S/ysoIls/eg+YmeuXFfaYAha6z8OqHkdZFBuQ9d7sBLlsG93Oft523ou5m Y92lIlDiCk9oIi/88lHGKq0fVubMDOyCzSUuQHfUeQpl6pCfBf1vRSmXp4t/ZEzlk61u iRCiEcvPr5x1SLSyGCo3mb4VPNB28JQ0dsQSg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; b=bdDVYAVTX6gWNPJex8ju5773QVeuzZ0Yl2dYYmvK8INSSz92Oqun4R/o0FgBe6+7hc GGXHs8592ozXjuOsNIU5Ctox2UIchsFjEx1NC4sTzYfikQypD3VF/WAMqLLQtzD+0lD+ YPBCJY+cAOH5dXKsss9hqeQGIInsjfVyAp7qg= MIME-Version: 1.0 Received: by 10.213.23.10 with SMTP id p10mr445578ebb.48.1291400052143; Fri, 03 Dec 2010 10:14:12 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.213.108.136 with HTTP; Fri, 3 Dec 2010 10:14:12 -0800 (PST) In-Reply-To: References: Date: Fri, 3 Dec 2010 13:14:12 -0500 X-Google-Sender-Auth: qfCAFOYNmviQreRhuF2GanQ14Uw Message-ID: From: Christopher Morrow To: Karen Seo Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: "sidr@ietf.org wg" Subject: Re: [sidr] Fwd: Re: Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 18:12:57 -0000 On Fri, Dec 3, 2010 at 1:13 PM, Christopher Morrow wrote: > On Fri, Dec 3, 2010 at 12:03 PM, Karen Seo wrote: >>> Date: Fri, 3 Dec 2010 12:02:42 -0500 >>> To: Andrei Robachevsky , Sandra Murphy >>> , Chris Morrow >>> From: Karen Seo >>> Subject: Re: [sidr] Certificate Policy -- last change >>> Cc: kseo >>> Bcc: >>> X-Attachments: >>> >>> Andrei -- Yes, I was planning to submit another draft that incorporated >>> this and any other changes that were requested during the WGLC. > > ah, cool. > >>> >>> Sandy, Chris -- Is the WGLC completed for this draft? > > I don't believe I've seen one for the sidr-cp doc... we should do > that, if all of the above is completed, spin a new draft ver then we > can WGLC it? oops, forgot: -Chris >>> >>> Thank you, >>> Karen >>> >>>> I believe these changes have not been incorporated in the I-D yet. Cou= ld >>>> this be done and a WGLC requested please? >>>> >>>> Thanks, >>>> >>>> Andrei >>>> >>>> Andrei Robachevsky wrote on 18/11/10 3:05 PM: >>>>> >>>>> =A0This change works for me, I support the request for the WGLC for t= his >>>>> =A0document. >>>>> >>>>> =A0Andrei >>>>> >>>>> =A0Karen Seo wrote on 16/11/10 4:31 PM: >>>>>> >>>>>> =A0Sandy, Chris -- If there are no complaints by the end of this wee= k >>>>>> about >>>>>> =A0the proposed change below, we will have addressed all known comme= nts >>>>>> and >>>>>> =A0request that you declare WGLC done on the Certificate Policy. >>>>>> >>>>>> =A0All -- Based on input from Geoff Huston and Randy Bush, we propos= e to >>>>>> =A0change the 2nd paragraph of the Overview as follows. >>>>>> >>>>>> =A0From: >>>>>> =A0 "The structure of the RPKI is modeled on the existing organizati= onal >>>>>> =A0 =A0structure that is already responsible for IP address and AS n= umber >>>>>> =A0 =A0resource allocation. In this allocation hierarchy, IANA alloc= ates >>>>>> =A0 =A0resources to five Regional Internet Registries (RIRs), each o= f which >>>>>> =A0 =A0manages address and AS number allocation within a defined >>>>>> =A0 =A0geopolitical region. The RIRs in turn allocate resources to I= nternet >>>>>> =A0 =A0Service Providers, to subscribers with so-called provider- >>>>>> =A0 =A0independent ("portable") allocations, and in some regions, to >>>>>> =A0 =A0National Internet Registries (NIRs). (The term LIR is used in= some >>>>>> =A0 =A0regions to refer to what other regions define as an ISP. Thro= ughout >>>>>> =A0 =A0the rest of this document we will use the term ISP to simplif= y >>>>>> =A0 =A0references to these entities.)" >>>>>> >>>>>> =A0To: >>>>>> =A0 "The structure of the RPKI is congruent with the number resource >>>>>> =A0 =A0allocation framework of the Internet. The IANA allocates numb= er >>>>>> =A0 =A0resources for special purposes [RFC5736], to Regional Interne= t >>>>>> =A0 =A0Registries (RIRs), and to others. =A0The RIRs, in turn, manag= e the >>>>>> =A0 =A0allocation of number resources to end users, Internet Service >>>>>> =A0 =A0Providers, and others." >>>>>> >>>>>> =A0Thank you, >>>>>> =A0Karen >>>>>> >>>>>> >>>>>> =A0_______________________________________________ >>>>>> =A0sidr mailing list >>>>>> =A0sidr@ietf.org >>>>>> =A0https://www.ietf.org/mailman/listinfo/sidr >>>>>> >>>>> >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> > From christopher.morrow@gmail.com Fri Dec 3 11:44:07 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 31C4428C117 for ; Fri, 3 Dec 2010 11:44:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rCRJ2SIIcEtW for ; Fri, 3 Dec 2010 11:44:06 -0800 (PST) Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by core3.amsl.com (Postfix) with ESMTP id 90BD528C126 for ; Fri, 3 Dec 2010 11:44:05 -0800 (PST) Received: by eyd10 with SMTP id 10so5512839eyd.31 for ; Fri, 03 Dec 2010 11:45:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:sender:received :in-reply-to:references:date:x-google-sender-auth:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=C8fs7BsDK38fX5Ekitf21Ve77A64RyKfSy+8iHzAVLU=; b=Gn4kdvbO7BwrxU7AjJn0ui5icPxhWxwB/TzdEkKwVTN/C2rfsh4hZ6/X/A6hFEu6+n f7lmKJvGnuYBbsfm31j7/e7p0pMZgEhW7HaOfHYMnh7y6qyQsJzi80imkiPGz+Dw1zdi Gm5k7EZ9aktrj3hrLc/hrabW9Bd9Z9kCVSi1A= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; b=eZOxap0zwzt/VASDymDYdqIFOpGW0zPmrD+9OeAFVFLMmQW1PpuX+B2dyuVTW8HRVw tJS3mj172OwpvAgY8Fz43M+Wxh415rOa+DZkp03Vh17LL6PWHNNtHRyCiZIpEuxw/btn 7S8ssRo8PJk0mhNtYx8vzP7hJva/PVH2g0+N8= MIME-Version: 1.0 Received: by 10.213.26.79 with SMTP id d15mr1292474ebc.35.1291405522794; Fri, 03 Dec 2010 11:45:22 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.213.108.136 with HTTP; Fri, 3 Dec 2010 11:45:22 -0800 (PST) In-Reply-To: References: Date: Fri, 3 Dec 2010 14:45:22 -0500 X-Google-Sender-Auth: MzDPP5cSvXyhyH-E3H1TC3yN-Vw Message-ID: From: Christopher Morrow To: Karen Seo Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: "sidr@ietf.org wg" Subject: Re: [sidr] Fwd: Re: Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 19:44:07 -0000 On Fri, Dec 3, 2010 at 1:14 PM, Christopher Morrow wrote: > On Fri, Dec 3, 2010 at 1:13 PM, Christopher Morrow > wrote: >> On Fri, Dec 3, 2010 at 12:03 PM, Karen Seo wrote: >>>> Date: Fri, 3 Dec 2010 12:02:42 -0500 >>>> To: Andrei Robachevsky , Sandra Murphy >>>> , Chris Morrow >>>> From: Karen Seo >>>> Subject: Re: [sidr] Certificate Policy -- last change >>>> Cc: kseo >>>> Bcc: >>>> X-Attachments: >>>> >>>> Andrei -- Yes, I was planning to submit another draft that incorporate= d >>>> this and any other changes that were requested during the WGLC. >> >> ah, cool. >> >>>> >>>> Sandy, Chris -- Is the WGLC completed for this draft? >> >> I don't believe I've seen one for the sidr-cp doc... we should do oy, not my day for email :) but, there IS one WGLC for this doc, 2.5 months or so. -chris >> that, if all of the above is completed, spin a new draft ver then we >> can WGLC it? > > oops, forgot: > -Chris > > >>>> >>>> Thank you, >>>> Karen >>>> >>>>> I believe these changes have not been incorporated in the I-D yet. Co= uld >>>>> this be done and a WGLC requested please? >>>>> >>>>> Thanks, >>>>> >>>>> Andrei >>>>> >>>>> Andrei Robachevsky wrote on 18/11/10 3:05 PM: >>>>>> >>>>>> =A0This change works for me, I support the request for the WGLC for = this >>>>>> =A0document. >>>>>> >>>>>> =A0Andrei >>>>>> >>>>>> =A0Karen Seo wrote on 16/11/10 4:31 PM: >>>>>>> >>>>>>> =A0Sandy, Chris -- If there are no complaints by the end of this we= ek >>>>>>> about >>>>>>> =A0the proposed change below, we will have addressed all known comm= ents >>>>>>> and >>>>>>> =A0request that you declare WGLC done on the Certificate Policy. >>>>>>> >>>>>>> =A0All -- Based on input from Geoff Huston and Randy Bush, we propo= se to >>>>>>> =A0change the 2nd paragraph of the Overview as follows. >>>>>>> >>>>>>> =A0From: >>>>>>> =A0 "The structure of the RPKI is modeled on the existing organizat= ional >>>>>>> =A0 =A0structure that is already responsible for IP address and AS = number >>>>>>> =A0 =A0resource allocation. In this allocation hierarchy, IANA allo= cates >>>>>>> =A0 =A0resources to five Regional Internet Registries (RIRs), each = of which >>>>>>> =A0 =A0manages address and AS number allocation within a defined >>>>>>> =A0 =A0geopolitical region. The RIRs in turn allocate resources to = Internet >>>>>>> =A0 =A0Service Providers, to subscribers with so-called provider- >>>>>>> =A0 =A0independent ("portable") allocations, and in some regions, t= o >>>>>>> =A0 =A0National Internet Registries (NIRs). (The term LIR is used i= n some >>>>>>> =A0 =A0regions to refer to what other regions define as an ISP. Thr= oughout >>>>>>> =A0 =A0the rest of this document we will use the term ISP to simpli= fy >>>>>>> =A0 =A0references to these entities.)" >>>>>>> >>>>>>> =A0To: >>>>>>> =A0 "The structure of the RPKI is congruent with the number resourc= e >>>>>>> =A0 =A0allocation framework of the Internet. The IANA allocates num= ber >>>>>>> =A0 =A0resources for special purposes [RFC5736], to Regional Intern= et >>>>>>> =A0 =A0Registries (RIRs), and to others. =A0The RIRs, in turn, mana= ge the >>>>>>> =A0 =A0allocation of number resources to end users, Internet Servic= e >>>>>>> =A0 =A0Providers, and others." >>>>>>> >>>>>>> =A0Thank you, >>>>>>> =A0Karen >>>>>>> >>>>>>> >>>>>>> =A0_______________________________________________ >>>>>>> =A0sidr mailing list >>>>>>> =A0sidr@ietf.org >>>>>>> =A0https://www.ietf.org/mailman/listinfo/sidr >>>>>>> >>>>>> >>> >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>> >> > From kent@bbn.com Fri Dec 3 12:52:11 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD0C13A69A5 for ; Fri, 3 Dec 2010 12:52:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.353 X-Spam-Level: X-Spam-Status: No, score=-102.353 tagged_above=-999 required=5 tests=[AWL=0.246, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 92WlOKQuItZC for ; Fri, 3 Dec 2010 12:52:11 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by core3.amsl.com (Postfix) with ESMTP id EA9AE3A68B1 for ; Fri, 3 Dec 2010 12:52:10 -0800 (PST) Received: from dommiel.bbn.com ([192.1.122.15]:37371 helo=[192.168.1.12]) by smtp.bbn.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1POcdC-000FOn-T3; Fri, 03 Dec 2010 15:53:27 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> Date: Fri, 3 Dec 2010 15:39:56 -0500 To: Sandra Murphy From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 20:52:11 -0000 At 9:29 PM -0500 12/2/10, Sandra Murphy wrote: >Andrew suggests that the new naming schemes should be added to the >repos-struct draft. > >Tim's message implies that the naming scheme would be added to the >roa-format draft (by extension, to whatever draft creates a new >repository structure element, like the ghostbusters draft). > >I'd like wg consideration as to which would be best, both now and >going forward. > >--Sandy > I support adding .roa; I didn't realize it was not there already. I think we can wait for GB, because it is a new doc, not yet final (it was just adopted by the WG). We will need to have each new RPKI signed object specify it's file extension for the future, so why now start with the GB doc, when it is approved. Steve From kent@bbn.com Fri Dec 3 12:52:15 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 53B7728C166 for ; Fri, 3 Dec 2010 12:52:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.367 X-Spam-Level: X-Spam-Status: No, score=-102.367 tagged_above=-999 required=5 tests=[AWL=0.232, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C3o3qtBDO8Cg for ; Fri, 3 Dec 2010 12:52:14 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by core3.amsl.com (Postfix) with ESMTP id 8BE7928C15F for ; Fri, 3 Dec 2010 12:52:14 -0800 (PST) Received: from dommiel.bbn.com ([192.1.122.15]:37371 helo=[192.168.1.12]) by smtp.bbn.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1POcdD-000FOn-It; Fri, 03 Dec 2010 15:53:27 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: <4CF8E549.3000900@ripe.net> References: <4CE532A9.1000500@ripe.net> <4CF8E549.3000900@ripe.net> Date: Fri, 3 Dec 2010 15:45:30 -0500 To: Andrei Robachevsky From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: "sidr@ietf.org wg" Subject: Re: [sidr] Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 20:52:15 -0000 At 1:40 PM +0100 12/3/10, Andrei Robachevsky wrote: >I believe these changes have not been incorporated in the I-D yet. Could >this be done and a WGLC requested please? > >Thanks, > >Andrei > Andrei, Karen sent the revised text to the list a while ago, showing what it replaced. Our plan is to publish the revised CP after WGLC has been declared over (finally!), not to publish a new version of the CP I-D and request a new WGLC. In my 15 years of experience as WG chair, this is how we have tended to manage changes of this sort, as it avoids needless WGLC cycling. Steve From randy@psg.com Fri Dec 3 14:00:02 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7806C3A63D3 for ; Fri, 3 Dec 2010 14:00:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.183 X-Spam-Level: X-Spam-Status: No, score=-2.183 tagged_above=-999 required=5 tests=[AWL=0.416, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ibMF4nj9rw6X for ; Fri, 3 Dec 2010 14:00:01 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id 810113A63CB for ; Fri, 3 Dec 2010 14:00:01 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1POdgn-000LkI-SI; Fri, 03 Dec 2010 22:01:14 +0000 Date: Sat, 04 Dec 2010 07:01:12 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: References: <4CE532A9.1000500@ripe.net> <4CF8E549.3000900@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: "sidr@ietf.org wg" Subject: Re: [sidr] Certificate Policy -- last change X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 22:00:02 -0000 >> I believe these changes have not been incorporated in the I-D yet. Could >> this be done and a WGLC requested please? > Karen sent the revised text to the list a while ago, showing what it > replaced. Our plan is to publish the revised CP after WGLC has been > declared over (finally!), not to publish a new version of the CP I-D > and request a new WGLC. In my 15 years of experience as WG chair, > this is how we have tended to manage changes of this sort, as it > avoids needless WGLC cycling. i am with andrei. having the final version in front of us for the wglc is good and prudent, and does not require restarting last call. randy From randy@psg.com Fri Dec 3 14:02:51 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 60C5C3A63D3 for ; Fri, 3 Dec 2010 14:02:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.229 X-Spam-Level: X-Spam-Status: No, score=-2.229 tagged_above=-999 required=5 tests=[AWL=0.370, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1qToGVq1ms7 for ; Fri, 3 Dec 2010 14:02:50 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id 672043A63CB for ; Fri, 3 Dec 2010 14:02:50 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1POdja-000Llv-9U; Fri, 03 Dec 2010 22:04:06 +0000 Date: Sat, 04 Dec 2010 07:04:05 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: Sandra Murphy , sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Dec 2010 22:02:51 -0000 >> Andrew suggests that the new naming schemes should be added to the >> repos-struct draft. >> >> Tim's message implies that the naming scheme would be added to the >> roa-format draft (by extension, to whatever draft creates a new >> repository structure element, like the ghostbusters draft). >> >> I'd like wg consideration as to which would be best, both now and >> going forward. > > I support adding .roa; I didn't realize it was not there already. > > I think we can wait for GB, because it is a new doc, not yet final > (it was just adopted by the WG). We will need to have each new RPKI > signed object specify it's file extension for the future, so why now > start with the GB doc, when it is approved. lemme repeat. keeping track of a changing list of identifiers is (part of) the iana function and is why we have iana consideration sections in documents. probably repo structure should create the registry with certs and manifests and crls, and roa, ghostbusters, ... should add to it. randy From Internet-Drafts@ietf.org Fri Dec 3 18:45:16 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D96B13A6A00; Fri, 3 Dec 2010 18:45:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.434 X-Spam-Level: X-Spam-Status: No, score=-102.434 tagged_above=-999 required=5 tests=[AWL=0.165, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bi3cnqQSt5Qp; Fri, 3 Dec 2010 18:45:15 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 18DA73A681D; Fri, 3 Dec 2010 18:45:02 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.09 Message-ID: <20101204024502.9799.41498.idtracker@localhost> Date: Fri, 03 Dec 2010 18:45:02 -0800 Cc: sidr@ietf.org Subject: [sidr] I-D Action:draft-ietf-sidr-cp-16.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Dec 2010 02:45:17 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : Certificate Policy (CP) for the Resource PKI (RPKI Author(s) : S. Kent, et al. Filename : draft-ietf-sidr-cp-16.txt Pages : 42 Date : 2010-12-03 This document describes the certificate policy for a Public Key Infrastructure (PKI) used to support attestations about Internet resource holdings. Each organization that distributes IP addresses or Autonomous System (AS) numbers to an organization will, in parallel, issue a certificate reflecting this distribution. These certificates will enable verification that the resources indicated in the certificate have been distributed to the holder of the associated private key and that this organization is the current, unique holder of these resources. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sidr-cp-16.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-sidr-cp-16.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-03183250.I-D@ietf.org> --NextPart-- From pmohapat@cisco.com Sat Dec 4 17:50:22 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D0D113A69BC for ; Sat, 4 Dec 2010 17:50:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BDoJ0KDBHxCr for ; Sat, 4 Dec 2010 17:50:21 -0800 (PST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id CB9643A683D for ; Sat, 4 Dec 2010 17:50:21 -0800 (PST) Authentication-Results: sj-iport-6.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AvsEAGV++kyrR7H+/2dsb2JhbACjMHGkCJoXhUkEhF2GEQ X-IronPort-AV: E=Sophos;i="4.59,300,1288569600"; d="scan'208";a="630930598" Received: from sj-core-2.cisco.com ([171.71.177.254]) by sj-iport-6.cisco.com with ESMTP; 05 Dec 2010 01:51:42 +0000 Received: from sjc-vpn5-150.cisco.com (sjc-vpn5-150.cisco.com [10.21.88.150]) by sj-core-2.cisco.com (8.13.8/8.14.3) with ESMTP id oB51pXsS012936; Sun, 5 Dec 2010 01:51:34 GMT Mime-Version: 1.0 (Apple Message framework v1081) Content-Type: text/plain; charset=us-ascii From: Pradosh Mohapatra In-Reply-To: <54E900DC635DAB4DB7A6D799B3C4CD8E0382B6@PLSWM12A.ad.sprint.com> Date: Sun, 5 Dec 2010 07:21:34 +0530 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20101130211502.22708.23455.idtracker@localhost> <54E900DC635DAB4DB7A6D799B3C4CD8E0382B6@PLSWM12A.ad.sprint.com> To: "George, Wes E [NTK]" X-Mailer: Apple Mail (2.1081) Cc: "sidr@ietf.org" Subject: Re: [sidr] I-D ACTION:draft-ietf-sidr-origin-validation-signaling-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Dec 2010 01:50:22 -0000 Hi Wes, > I note that this is still listing the requested IANA extended = community as > non-transitive, but has removed the explicit prohibition to sending = this > community to an eBGP peer based on my prior feedback. Is that going to = work, > or does the community need to be redefined as transitive as well? >=20 > Also, if we're going to allow it to be used in eBGP in even a limited > fashion, I think that we do need some text that covers this transitive = vs > intransitive distinction in a bit more detail. For example, when I > recommended that we not explicitly prohibit sending this community on = an > eBGP session, I also said that it should default to non-transitive for = eBGP > in order to prevent misconfigurations from causing validation info of > questionable origin from moving between ASNs. In other words, it = should be a > configurable option, but we want to express that the preference is to = have > people do their own RPKI validation at their ASBR rather than relying = on an > upstream and to limit propagation of this information since it's of > questionable accuracy and trust. We may also want to say that the = receiving > peer must be explicitly configured to accept the extended community, = and by > default it should drop any instance of the validation community on = eBGP. Not > sure if we need to explicitly state that peers that don't = understand/support > the community should silently ignore it, since I'm pretty sure that's > default behavior. Yes, making the extended community non-transitive, but allowing it to be exchanged across ebgp sessions helps this. >=20 > Updating the deleted text from the original document might give us = something > like this: > Since the extended community is primarily intended to provide a method = to > carry prefix validation information within an ASN, it SHOULD be a > non-transitive attribute, but there are some applications where it may = be > necessary for it to transit between ASNs. In order to limit the = propagation > of this information outside of the originating ASN, it MUST NOT be = attached > by default while advertising routes to EBGP peers, even if the session = is > configured to send other communities. It MAY be explicitly configured = to be > sent between eBGP peers. Additionally, if it is present in an UPDATE = message > received from an EBGP peer, by default the router MUST remove the = origin > validation state extended community before parsing rest of the = message. The > router MAY be explicitly configured to allow the origin validation = state > from an eBGP peer to be accepted, but this is not recommended unless = there > is an existing trust relationship between the ASNs (such as upstream = ISP and > customer). Any ASN that learns validation information from an eBGP = peer via > this community MUST NOT pass that community beyond routers in its own = ASN. Thanks! I am fine with adding this text. Will wait for a few if others = want to chime in... - Pradosh= From sra@hactrn.net Mon Dec 6 15:03:26 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D75CF28C0EA for ; Mon, 6 Dec 2010 15:03:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J+qg6G1wELCr for ; Mon, 6 Dec 2010 15:03:26 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id B75B93A68CD for ; Mon, 6 Dec 2010 15:03:25 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id 00B4028441 for ; Mon, 6 Dec 2010 23:04:47 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 9AC0222808 for ; Mon, 6 Dec 2010 18:04:47 -0500 (EST) Date: Mon, 06 Dec 2010 18:04:47 -0500 From: Rob Austein To: sidr@ietf.org User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101206230447.9AC0222808@thrintun.hactrn.net> Subject: [sidr] WGLC and WG adoption X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Dec 2010 23:03:26 -0000 adopt: draft-ymbk-ghostbusters-01 draft-ymbk-rpki-origin-ops-00 ship: draft-ietf-sidr-rpki-manifests-09 [*] draft-ietf-sidr-rpki-algs-04 draft-ietf-sidr-rescerts-provisioning-09 [*] draft-ietf-sidr-repos-struct-06 draft-ietf-sidr-res-certs-21 draft-ietf-sidr-rpki-rtr-04 draft-ietf-sidr-roa-format-09 draft-ietf-sidr-ta-06 fix needed: draft-ietf-sidr-keyroll-05 [*] draft-ietf-sidr-signed-object-01 [*] details on docs marked with [*] will follow under separate cover, trying to keep this message short. From sra@hactrn.net Mon Dec 6 15:05:42 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EFB2128C0FB for ; Mon, 6 Dec 2010 15:05:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yodg9klXqBZZ for ; Mon, 6 Dec 2010 15:05:42 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id E4D8328C0FA for ; Mon, 6 Dec 2010 15:05:41 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id 8A1C528441 for ; Mon, 6 Dec 2010 23:07:05 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 0CCA122808 for ; Mon, 6 Dec 2010 18:07:05 -0500 (EST) Date: Mon, 06 Dec 2010 18:07:05 -0500 From: Rob Austein To: sidr@ietf.org User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101206230705.0CCA122808@thrintun.hactrn.net> Subject: [sidr] draft-ietf-sidr-rpki-manifests-09 nit X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Dec 2010 23:05:43 -0000 The conditional at the start of step 2 of the manifest generation procedure in section 5.1 is not quite right. Currently it says: If using a "one-time-use" EE certificate, or if a key pair was generated in step 1, issue a EE certificate for this key pair. It should say something like: If using a "one-time-use" EE certificate, or if a key pair was generated in step 1, or if using a "sequential-use" EE certificate which will expire before the intended nextUpdate time of this manifest, issue a EE certificate for this key pair. This is implicit in the text of this step, but since we're being painfully explicit about everything else here, we should be explicit about this too for consistency. From sra@hactrn.net Mon Dec 6 15:06:52 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 873B728C0F7 for ; Mon, 6 Dec 2010 15:06:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a3JEmL4zM5Mr for ; Mon, 6 Dec 2010 15:06:51 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id 9BA0F28C0CF for ; Mon, 6 Dec 2010 15:06:51 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id 541CA28441 for ; Mon, 6 Dec 2010 23:08:15 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 13A4F22808 for ; Mon, 6 Dec 2010 18:08:15 -0500 (EST) Date: Mon, 06 Dec 2010 18:08:15 -0500 From: Rob Austein To: sidr@ietf.org User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101206230815.13A4F22808@thrintun.hactrn.net> Subject: [sidr] draft-ietf-sidr-rescerts-provisioning-09 nit X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Dec 2010 23:06:52 -0000 The checklist in section 3.2 requires a Request-Not-Performed error response for failures in step 8...but there is no step 8. From sra@hactrn.net Mon Dec 6 15:16:23 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 12F8E28C0E5 for ; Mon, 6 Dec 2010 15:16:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q3+kiMuZ17QX for ; Mon, 6 Dec 2010 15:16:22 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id 0AF9828C0CF for ; Mon, 6 Dec 2010 15:16:22 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id 8A79428441 for ; Mon, 6 Dec 2010 23:17:45 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 1C77E22808 for ; Mon, 6 Dec 2010 18:17:45 -0500 (EST) Date: Mon, 06 Dec 2010 18:17:45 -0500 From: Rob Austein To: sidr@ietf.org User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101206231745.1C77E22808@thrintun.hactrn.net> Subject: [sidr] draft-ietf-sidr-signed-object-01 issue X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Dec 2010 23:16:23 -0000 This one should be an easy fix, but it's not just a nit. This draft over-specifies the eContent field. Specifically: section 2.1.3.2 requires that the outermost level of the eContent must be an ASN.1 SEQUENCE the first field of which must be a version number. This is a layer violation. There is no need for the signed-object draft to specify this, and there are cases where this is a bad idea. Case in point would be the proposed ghostbusters record. The real payload is a vCard. The ASN.1 wrapper adds nothing but the mandatory ASN.1 version number, to no real purpose. Without the ASN.1 wrapper, one could use an off-the-shelf CMS tool to extract the eContent, then feed that into an off-the-shelf vCard parser. With the wrapper, one has to write custom code just to extract the vCard from the wrapper. This is silly. Version numbers are fine in cases where they make sense, but imposing then everywhere does not. If there ever turns out to be a real need to make an incompatible change to something like the ghostbusters record, we could always allocate a new eContentType OID, it's not like OIDs are a scarce resource. Requested change: remove all specification of the eContent payload from this template, leave that for the object-specific documents that reference it. This will also require removing a few of comments scattered here and there in the draft which appear to assume that the content will always be ASN.1. From sra@hactrn.net Mon Dec 6 15:39:50 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A614C3A68D5 for ; Mon, 6 Dec 2010 15:39:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RTxnwcHEdBew for ; Mon, 6 Dec 2010 15:39:49 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id 650D93A68B1 for ; Mon, 6 Dec 2010 15:39:43 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id A506C28441 for ; Mon, 6 Dec 2010 23:41:04 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 5174022808 for ; Mon, 6 Dec 2010 18:41:04 -0500 (EST) Date: Mon, 06 Dec 2010 18:41:04 -0500 From: Rob Austein To: sidr@ietf.org User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101206234104.5174022808@thrintun.hactrn.net> Subject: [sidr] draft-ietf-sidr-keyroll-05 "staging period" is in the wrong place X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Dec 2010 23:39:50 -0000 I attempted to raise this issue at IETF 78 (sic), but it's still in the draft. Sorry for not having been more annoying about this. :) The case for why we need the "staging period" is pretty much non-existent. There's an assertion that we need it, and a vague comment in section 2 suggesting that somebody somewhere has a worked example of a validator that will break without this, but I see no strong case made anywhere in the document. If somebody has such a validator, and wants to 'fess up to it and explain why this is not just a case of the validator being broken, go for it, but as following the proposed process would require some not completely trivial changes to running code in the case of at least one implementation (mine), I think we need more justification than what I see in the doc now. Consider what would happen if, instead of following the process mandated by this document, a CA simply started issuing new certificates and reissuing old ones as fast as it reasonably could under the "NEW CA", until it had managed to overwrite everything issued by the "OLD CA". What terrible thing happens as a result of this? I have running code that has operated this way for several years in test environments, and if there have been any failures as a result of this, they've been subtle enough to escape notice. So I don't see the need for the staging period here at all, but if there is a need, the doc needs to be a lot clearer about it, so that even I can understand it. The other thing that I find interesting here is that there is *no* delay mandated in the case where I think there might really need to be one: how long to wait after reissuing and publishing all of the CA's products under NEW CA before asking CA's parent to revoke OLD CA. This interval seems much more likely to matter, because the place where we're most likely to be screwed by caching somewhere out there is old subordinate certificates issued by OLD CA, not OLD CA itself. Given these (linked) issues, I don't think this doc is ready yet. From sra@hactrn.net Mon Dec 6 19:52:38 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0AAFB3A68FC for ; Mon, 6 Dec 2010 19:52:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M4bncO9osMSf for ; Mon, 6 Dec 2010 19:52:37 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id A98C83A68FB for ; Mon, 6 Dec 2010 19:52:34 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id 8743B28441 for ; Tue, 7 Dec 2010 03:53:56 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 3365222808 for ; Mon, 6 Dec 2010 22:53:56 -0500 (EST) Date: Mon, 06 Dec 2010 22:53:56 -0500 From: Rob Austein To: sidr@ietf.org In-Reply-To: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101207035356.3365222808@thrintun.hactrn.net> Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Dec 2010 03:52:38 -0000 At Sat, 04 Dec 2010 07:04:05 +0900, Randy Bush wrote: > > lemme repeat. keeping track of a changing list of identifiers is (part > of) the iana function and is why we have iana consideration sections in > documents. > > probably repo structure should create the registry with certs and > manifests and crls, and roa, ghostbusters, ... should add to it. +1 From tim@ripe.net Tue Dec 7 02:18:02 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 96FC23A695E for ; Tue, 7 Dec 2010 02:18:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Odz-1ZnwYo9 for ; Tue, 7 Dec 2010 02:18:01 -0800 (PST) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:610:240:11::c100:1342]) by core3.amsl.com (Postfix) with ESMTP id DC2A33A6955 for ; Tue, 7 Dec 2010 02:18:00 -0800 (PST) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1PPudm-0006X0-V9; Tue, 07 Dec 2010 11:19:25 +0100 Received: from timbru.vpn.ripe.net ([193.0.21.62] helo=guest82.guestnet.ripe.net) by dodo.ripe.net with esmtp (Exim 4.63) (envelope-from ) id 1PPudm-0008TX-Rz; Tue, 07 Dec 2010 11:19:22 +0100 Message-ID: <4CFE0A2A.1090802@ripe.net> Date: Tue, 07 Dec 2010 11:19:22 +0100 From: Tim Bruijnzeels User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: Rob Austein References: <20101206234104.5174022808@thrintun.hactrn.net> In-Reply-To: <20101206234104.5174022808@thrintun.hactrn.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719fefd05742ba647edec3fe6abe644bf71 X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719fefd05742ba647edec3fe6abe644bf71 Cc: sidr@ietf.org Subject: Re: [sidr] draft-ietf-sidr-keyroll-05 "staging period" is in the wrong place X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Dec 2010 10:18:02 -0000 On 12/7/10 12:41 AM, Rob Austein wrote: > I attempted to raise this issue at IETF 78 (sic), but it's still in > the draft. Sorry for not having been more annoying about this. :) > > The case for why we need the "staging period" is pretty much > non-existent. There's an assertion that we need it, and a vague > comment in section 2 suggesting that somebody somewhere has a worked > example of a validator that will break without this, but I see no > strong case made anywhere in the document. If somebody has such a > validator, and wants to 'fess up to it and explain why this is not > just a case of the validator being broken, go for it, but as following > the proposed process would require some not completely trivial changes > to running code in the case of at least one implementation (mine), I > think we need more justification than what I see in the doc now. > > Consider what would happen if, instead of following the process > mandated by this document, a CA simply started issuing new > certificates and reissuing old ones as fast as it reasonably could > under the "NEW CA", until it had managed to overwrite everything > issued by the "OLD CA". What terrible thing happens as a result of > this? I have running code that has operated this way for several > years in test environments, and if there have been any failures as a > result of this, they've been subtle enough to escape notice. > > So I don't see the need for the staging period here at all, but if > there is a need, the doc needs to be a lot clearer about it, so that > even I can understand it. If I remember correctly I think Roque and Steve mentioned that CA certificates on any level may be used by RPs as a Trust Anchor -- even if you did not plan to make yourself available as a TA (i.e. publishing your cert info as per TA draft). The staging period was introduced to give RPs down the chain from you at least some opportunity to notice the change and start using the new cert in place of the old one.. But as I said, if I remember correctly.. maybe Roque or Steve can comment on this? > > The other thing that I find interesting here is that there is *no* > delay mandated in the case where I think there might really need to be > one: how long to wait after reissuing and publishing all of the CA's > products under NEW CA before asking CA's parent to revoke OLD CA. > This interval seems much more likely to matter, because the place > where we're most likely to be screwed by caching somewhere out there > is old subordinate certificates issued by OLD CA, not OLD CA itself. > First of all just for reference: our current implementation of the key roll does not automatically revoke the old key (yet). We keep the old CA cert, manifest and CRL around. It no longer publishes anything else, but we are thus able to revoke previously issued stuff that may still be alive out-of-band. Revocation is, for us, still a manual step that may be done eg when we suspect a problem with the key. We planned to change this when the key roll draft is final. Having said that.. I don't really object to having a staging period here, but it may not help. Out of band / cached subordinate validation may still fail because the subordinate no longer appears on the new manifest for OLD CA; it's published by new CA. Case 1: top-down validation and caching The assumption here is that when the new CA certificate is fetched the RP will also fetch the CRL, manifest and all issued certificates and objects for this new CA cert. This would mean that your cached certificates issued by OLD CA would be replaced. So I guess the big question is: is this a safe assumption to make? Or maybe even: should there be a normative statement somewhere that RPs SHOULD do this? Or maybe even.. non-normative, just operational: should RP tools that use caching be smart in this case? And before rejecting a cached subordinate because its parent is revoked try to re-fetch? Case 2: bottom-up (use signed objects out of band) If we need to support the case for out-of-band use of subordinate certificates and objects for as long as possible. And RPs do not care about manifest validation in this case.. then it might be good to keep the OLD CA around until everything issued under it is either expired or revoked; unless there is an overriding reason to revoke OLD CA like key loss or compromise. But is there really a use case for this? My impression was that there wasn't and everything is top-down oriented. And that's why I didn't resist having the revoke step. If there *is* a use case for out-of-band support for as long as possible then the model that we have currently implemented may be useful. Regards Tim > Given these (linked) issues, I don't think this doc is ready yet. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From Sandra.Murphy@cobham.com Tue Dec 7 04:50:21 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0C8AC3A6975 for ; Tue, 7 Dec 2010 04:50:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wg5IkEoh3Zi0 for ; Tue, 7 Dec 2010 04:50:19 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 69E733A6982 for ; Tue, 7 Dec 2010 04:50:18 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oB7Cphal017223; Tue, 7 Dec 2010 06:51:43 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oB7Cpgah005856; Tue, 7 Dec 2010 06:51:43 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([209.117.33.69]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Tue, 7 Dec 2010 07:51:42 -0500 Date: Tue, 7 Dec 2010 07:51:42 -0500 (Eastern Standard Time) From: Sandra Murphy To: "Sriram, Kotikalapudi" In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 07 Dec 2010 12:51:42.0777 (UTC) FILETIME=[7F7C1290:01CB960D] Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-00 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Dec 2010 12:50:21 -0000 Sandy, speaking as Joan Q private citizen, wg member only, in civilian mufti: With all due respect Sriram, I disagree. On Thu, 2 Dec 2010, Sriram, Kotikalapudi wrote: > Changed the subject title to refer to the document WGLC. > Please see comments inline. Thanks. > > Sriram >> -----Original Message----- >> From: Randy Bush [mailto:randy@psg.com] >> Sent: Thursday, December 02, 2010 5:48 PM >> >>> I also request that it be an Informational RFC (rather than a >>> standards track RFC) just as draft-ietf-sidr-roa-validation already >>> is. >> >> like hell. it specifies what running code MUST do in routers. > > Mapping the updates to Valid, Invalid, etc. based on ROA objects is > an intermediate step to a final step of making a decision about path selection. > Both steps are internal to the router. There needs to be a common standard understanding of what the ROA means, in order for the signers to know what it means to produce a ROA. > If an ISP has leeway in the final step, > then why should anything prevent it from having some leeway in the first step as well > (primarily during partial deployment)? If the router has one degree of freedom in its action, is anything gained by having two? > I am wondering what is lost if this is an Informational RFC? Recognize that there is precedent for this - RFC 4271 standardizes the router's *internal* best path decision process. I expect that the reasoning is the same - the decision process is standard so that those who are constructing BGP packets are operating with a standard understanding of what those packets mean. --Sandy, with no particular ceremonial vestments or badges of rank donned. > >> >> randy > From Sandra.Murphy@cobham.com Tue Dec 7 05:30:56 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 217323A67B1 for ; Tue, 7 Dec 2010 05:30:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id alvOpqlEZWrV for ; Tue, 7 Dec 2010 05:30:55 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 365223A67A2 for ; Tue, 7 Dec 2010 05:30:55 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oB7DWKPi017602 for ; Tue, 7 Dec 2010 07:32:20 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oB7DWKCo006988 for ; Tue, 7 Dec 2010 07:32:20 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([209.117.33.69]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Tue, 7 Dec 2010 08:32:19 -0500 Date: Tue, 7 Dec 2010 08:32:19 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org Message-ID: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 07 Dec 2010 13:32:20.0105 (UTC) FILETIME=[2C3ECF90:01CB9613] Subject: [sidr] IETF79 minutes X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Dec 2010 13:30:56 -0000 Below are the minutes that I just uploaded to the meeting proceedings site. Many thanks to Matt Lepinski and Karen O'Donaghue for being the minute takers. The proceeding URL for sidr is: http://www.ietf.org/proceedings/79/minutes/sidr.txt. If you have any modifications or additions, please post them to the list. Updates to IETF79 minutes are due by Jan 5, 2011. --Sandy, with wg chair toque on. From kent@bbn.com Tue Dec 7 17:25:15 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F6173A68D7 for ; Tue, 7 Dec 2010 17:25:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.845 X-Spam-Level: X-Spam-Status: No, score=-101.845 tagged_above=-999 required=5 tests=[AWL=-0.315, BAYES_00=-2.599, DATE_IN_PAST_06_12=1.069, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A4FzY5MWaWQz for ; Tue, 7 Dec 2010 17:24:52 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by core3.amsl.com (Postfix) with ESMTP id 776793A6956 for ; Tue, 7 Dec 2010 17:24:52 -0800 (PST) Received: from dommiel.bbn.com ([192.1.122.15]:38301 helo=[10.84.131.208]) by smtp.bbn.com with esmtp (Exim 4.71 (FreeBSD)) (envelope-from ) id 1PQ8nR-000Oc2-0h; Tue, 07 Dec 2010 20:26:17 -0500 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> Date: Tue, 7 Dec 2010 13:42:39 -0500 To: Randy Bush From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: Sandra Murphy , sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Dec 2010 01:25:16 -0000 At 7:04 AM +0900 12/4/10, Randy Bush wrote: > >... > >lemme repeat. keeping track of a changing list of identifiers is (part >of) the iana function and is why we have iana consideration sections in >documents. > >probably repo structure should create the registry with certs and >manifests and crls, and roa, ghostbusters, ... should add to it. > >randy I am persuaded by your argument for an IANA registry. Steve From Sandra.Murphy@cobham.com Wed Dec 8 09:21:18 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 302363A6971 for ; Wed, 8 Dec 2010 09:21:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.448 X-Spam-Level: X-Spam-Status: No, score=-102.448 tagged_above=-999 required=5 tests=[AWL=0.151, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ipoqSuyL8D+g for ; Wed, 8 Dec 2010 09:21:16 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 2E9DC3A695E for ; Wed, 8 Dec 2010 09:21:15 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oB8HMhXJ004410 for ; Wed, 8 Dec 2010 11:22:43 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oB8HMhfS028150 for ; Wed, 8 Dec 2010 11:22:43 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.107]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Wed, 8 Dec 2010 12:22:42 -0500 Date: Wed, 8 Dec 2010 12:22:42 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 08 Dec 2010 17:22:42.0884 (UTC) FILETIME=[85AD4040:01CB96FC] Subject: Re: [sidr] IETF79 minutes X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Dec 2010 17:21:18 -0000 OK, so now the minutes are below. They were on the web site when I said they were, so I was half right. --Sandy On Tue, 7 Dec 2010, Sandra Murphy wrote: > Below are the minutes that I just uploaded to the meeting proceedings site. > Many thanks to Matt Lepinski and Karen O'Donaghue for being the minute > takers. > > The proceeding URL for sidr is: > http://www.ietf.org/proceedings/79/minutes/sidr.txt. > > If you have any modifications or additions, please post them to the list. > Updates to IETF79 minutes are due by Jan 5, 2011. > > --Sandy, with wg chair toque on. > --------- SIDR --------- Minutes: Matt Lepinski and Karen O'Donogue Sandy: There has been so much traffic on ROA Validation, I am not yet comfortable saying that the working group has reached consensus on ROA Validation draft RPKI-RTR Protocol by Randy Bush -- Newest version removed the fields Color and Source -- This draft has running code (both client and server) -- This draft is ready to move forward to WGLC Certificate Profile by Karen Seo -- Karen Seo: ... Presents slide on Overview Paragraph 2 -- Geoff : IANA currently runs a special purpose IPv4 registry, and thus has the ability to allocate -- Randy : It is not our prerogative to state policy for IANA -- Terry M: Currently IANA is interested in this text, please send the revised text to IANA for review -- Andre: Make the text in this section as simple as possible -- Geoff: The current text implies exclusivity that doesn't exist (IANA does not allocate only to the RIRs) ... But I think that Andre's version is too short, I want more words [Note: Randy and Geoff agree on what's wrong with the text this is unprecedented] -- Tim (SEC AD): We should not let one paragraph keep this document from moving forward out of the working group. We need to make this shortly -- Sandy: What about 6to4, how does that work in our architecture? -- Randy: This is just anycast ... if it needs to be validated, whoever owns the space (IANA) should issue a ROA to everyone who wants to originate it -- Russ: Or we can just define an "Any" ROA -- Randy: We do not want to go with wildcard ROAs Many Documents Updated by Geoff -- Keyroll is ready for WGLC -- Res-Cert is ready for WGLC -- Repos-Struct is ready for WGLC -- Russ H: I think that CMS Signing Time is the right answer, ... but you need some text in the security considerations that indicates what happens if someone gets their clock screwed up and signs something way in the future -- Provisioning Protocol is ready for WGLC -- Geoff presents about ROA-Validation -- Geoff: The simplest text that conforms to the current BGP spec is that if the aggregator field is present, then it is the origin (This is the text in the -07 version) -- Randy: Can we not speak to AS-SETs and then they'll go away? -- Sandy Chair: No -- Sandy Chair: I don't care what the answer is on AS-SETs but there needs to be an answer -- Rutiger V: Can we just say that if there is an AS-SET, then we don't evaluate -- Dave W: I believe there may be implementations of Pordosh's draft (which draft) which addresses this AS-SET issue -- Sandy Chair: If you come across such an implementation, can you ask them to provide their implementation experience to the list -- Rob A: We need text that says ROAs don't apply to AS-SETs Can Sandy Murphy as an individual put forward a statement that says "to hell with AS-SETs and ROAs", and then we can all agree with her and the chairs will be happy and we're done -- John S: I think Warren's draft will progress through IDR and will cease to be watered and down and will have the effect of making sure we no longer need to have these conversations I think there are about 6 routes in the wild that exhibit this particular pathology I think that Geoff has misinterpreted the BGP appendix on proxy aggregation, but it doesn't matter because we've spent way too much time on this already -- No one in the room objects to saying that "UNKNOWN" is always the result if there is an AS-SET in the path -- RPKI-Algs is ready for WGLC -- RPKI-Manifests is ready for WGLC Publication Protocol by Sam W -- This was adopted as a working group item There appear to be no significant updates to the technical content of the document -- Please read the document and provide feedback (document has not received sufficient review yet) Local Trust Anchor by Steve K -- Has not yet been published as a working group document, but there is working group concensus to accept the document -- No significant changes since Stockholm -- Sandy Chair: How does this work with Net-10 space, and leaks of Net-10 announcements -- Steve K: The RPKI will help people ignore leaks of Net-10 announcements ... both with this draft or without this draft, things just work Algorithm Transition by Steve K -- Rob A: Our test bed experience indicates that negotiating the parent child relation is challenging ... I'm not sure what the best trade-offs is, I'll have to think about it and get back to the list -- Randy: agrees with Geoff [shockingly] that this just works when you have a top-down algorithm transition ... The problem that Rob was worried about was the establishment/exchange of business PKI certificates for the up/down protocol -- Rob A: One thing where thing where we might want to extend the provisioning protocol is ... -- Andre: My can't you have a mixed validation path A-B-A-B-A Answer: Until we get near the end of the transition we can't assume that all relying parties understand B ... therefore until you reach this point (Phase 4 in the document) there must be an A-only chain for all resources -- Randy: Note that the time for this is measured in years -- Steve K: This is complicated stuff, we the authors will do another simplifying spin, but after that we will need reviewers -- Sandy Chair: I think that this document needs to have text about validating routes -- Steve K: I think that once we define validation of certificates, then validation of BGP routes just works -- The chairs will ask on the list for working group adoption -- Geoff: The current draft version is deeply flawed and should be revised before we accept it -- Randy: Drafts don't need to be perfect before the working group decides to work From foahmed@cisco.com Thu Dec 9 22:04:19 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E96D13A6C55 for ; Thu, 9 Dec 2010 22:04:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.489 X-Spam-Level: X-Spam-Status: No, score=-9.489 tagged_above=-999 required=5 tests=[AWL=1.111, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CtgnOiIXqKPh for ; Thu, 9 Dec 2010 22:04:18 -0800 (PST) Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by core3.amsl.com (Postfix) with ESMTP id 987753A6C53 for ; Thu, 9 Dec 2010 22:04:18 -0800 (PST) Authentication-Results: sj-iport-5.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AvsEAFJSAU2rR7Hu/2dsb2JhbACkAHikLZsihUoEhGSJLw X-IronPort-AV: E=Sophos;i="4.59,323,1288569600"; d="scan'208";a="300261169" Received: from sj-core-5.cisco.com ([171.71.177.238]) by sj-iport-5.cisco.com with ESMTP; 10 Dec 2010 06:05:49 +0000 Received: from xbh-sjc-211.amer.cisco.com (xbh-sjc-211.cisco.com [171.70.151.144]) by sj-core-5.cisco.com (8.13.8/8.14.3) with ESMTP id oBA65nLV001365; Fri, 10 Dec 2010 06:05:49 GMT Received: from xmb-sjc-239.amer.cisco.com ([128.107.191.105]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 9 Dec 2010 22:05:49 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Date: Thu, 9 Dec 2010 22:05:47 -0800 Message-ID: <8A7BEFB8FCD25A43BB73B1D879B82F7703660F12@xmb-sjc-239.amer.cisco.com> In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [sidr] IETF79 minutes Thread-Index: AcuW/IrGtLTknPutTVK0qsdksotPDABMxF6Q References: From: "Forhad Ahmed (foahmed)" To: "Sandra Murphy" , X-OriginalArrivalTime: 10 Dec 2010 06:05:49.0361 (UTC) FILETIME=[4AF4F210:01CB9830] Subject: Re: [sidr] IETF79 minutes X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Dec 2010 06:04:20 -0000 Is there a text of this latest draft? =20 Interested in knowing what the PDU formats will be if the 2 fields are removed... > RPKI-RTR Protocol by Randy Bush > -- Newest version removed the fields Color and Source > -- This draft has running code (both client and server) > -- This draft is ready to move forward to WGLC -Forhad -----Original Message----- From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of Sandra Murphy Sent: Wednesday, December 08, 2010 9:23 AM To: sidr@ietf.org Subject: Re: [sidr] IETF79 minutes OK, so now the minutes are below. They were on the web site when I said they were, so I was half right. --Sandy On Tue, 7 Dec 2010, Sandra Murphy wrote: > Below are the minutes that I just uploaded to the meeting proceedings site.=20 > Many thanks to Matt Lepinski and Karen O'Donaghue for being the minute > takers. > > The proceeding URL for sidr is:=20 > http://www.ietf.org/proceedings/79/minutes/sidr.txt. > > If you have any modifications or additions, please post them to the list.=20 > Updates to IETF79 minutes are due by Jan 5, 2011. > > --Sandy, with wg chair toque on. > --------- SIDR --------- Minutes: Matt Lepinski and Karen O'Donogue Sandy: There has been so much traffic on ROA Validation, I am not yet comfortable saying that the working group has reached consensus on ROA Validation draft RPKI-RTR Protocol by Randy Bush -- Newest version removed the fields Color and Source -- This draft has running code (both client and server) -- This draft is ready to move forward to WGLC Certificate Profile by Karen Seo -- Karen Seo: ... Presents slide on Overview Paragraph 2 -- Geoff : IANA currently runs a special purpose IPv4 registry, and thus has the ability to allocate -- Randy : It is not our prerogative to state policy for IANA -- Terry M: Currently IANA is interested in this text, please send the revised text to IANA for review -- Andre: Make the text in this section as simple as possible -- Geoff: The current text implies exclusivity that doesn't exist (IANA does not allocate only to the RIRs) ... But I think that Andre's version is too short, I want more words [Note: Randy and Geoff agree on what's wrong with the text this is unprecedented] -- Tim (SEC AD): We should not let one paragraph keep this document from moving forward out of the working group. We need to make this shortly -- Sandy: What about 6to4, how does that work in our architecture? -- Randy: This is just anycast ... if it needs to be validated, whoever owns the space (IANA) should issue a ROA to everyone who wants to originate it -- Russ: Or we can just define an "Any" ROA -- Randy: We do not want to go with wildcard ROAs Many Documents Updated by Geoff -- Keyroll is ready for WGLC -- Res-Cert is ready for WGLC -- Repos-Struct is ready for WGLC -- Russ H: I think that CMS Signing Time is the right answer, ... but you need some text in the security considerations that indicates what happens if someone gets their clock screwed up and signs something way in the future -- Provisioning Protocol is ready for WGLC -- Geoff presents about ROA-Validation -- Geoff: The simplest text that conforms to the current BGP spec is that if the aggregator field is present, then it is the origin (This is the text in the -07 version) -- Randy: Can we not speak to AS-SETs and then they'll go away? -- Sandy Chair: No -- Sandy Chair: I don't care what the answer is on AS-SETs but there needs to be an answer -- Rutiger V: Can we just say that if there is an AS-SET, then we don't evaluate -- Dave W: I believe there may be implementations of Pordosh's draft (which draft) which addresses this AS-SET issue -- Sandy Chair: If you come across such an implementation, can you ask them to provide their implementation experience to the list -- Rob A: We need text that says ROAs don't apply to AS-SETs Can Sandy Murphy as an individual put forward a statement that says "to hell with AS-SETs and ROAs", and then we can all agree with her and the chairs will be happy and we're done -- John S: I think Warren's draft will progress through IDR and will cease to be watered and down and will have the effect of making sure we no longer need to have these conversations I think there are about 6 routes in the wild that exhibit this particular pathology I think that Geoff has misinterpreted the BGP appendix on proxy aggregation, but it doesn't matter because we've spent way too much time on this already -- No one in the room objects to saying that "UNKNOWN" is always the result if there is an AS-SET in the path -- RPKI-Algs is ready for WGLC -- RPKI-Manifests is ready for WGLC Publication Protocol by Sam W -- This was adopted as a working group item There appear to be no significant updates to the technical content of the document -- Please read the document and provide feedback (document has not received sufficient review yet) Local Trust Anchor by Steve K -- Has not yet been published as a working group document, but there is working group concensus to accept the document -- No significant changes since Stockholm -- Sandy Chair: How does this work with Net-10 space, and leaks of Net-10 announcements -- Steve K: The RPKI will help people ignore leaks of Net-10 announcements ... both with this draft or without this draft, things just work Algorithm Transition by Steve K -- Rob A: Our test bed experience indicates that negotiating the parent child relation is challenging ... I'm not sure what the best trade-offs is, I'll have to think about it and get back to the list -- Randy: agrees with Geoff [shockingly] that this just works when you have a top-down algorithm transition ... The problem that Rob was worried about was the establishment/exchange of business PKI certificates for the up/down protocol -- Rob A: One thing where thing where we might want to extend the provisioning protocol is ... -- Andre: My can't you have a mixed validation path A-B-A-B-A Answer: Until we get near the end of the transition we can't assume that all relying parties understand B ... therefore until you reach this point (Phase 4 in the document) there must be an A-only chain for all resources -- Randy: Note that the time for this is measured in years -- Steve K: This is complicated stuff, we the authors will do another simplifying spin, but after that we will need reviewers -- Sandy Chair: I think that this document needs to have text about validating routes -- Steve K: I think that once we define validation of certificates, then validation of BGP routes just works -- The chairs will ask on the list for working group adoption -- Geoff: The current draft version is deeply flawed and should be revised before we accept it -- Randy: Drafts don't need to be perfect before the working group decides to work _______________________________________________ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr From randy@psg.com Thu Dec 9 23:32:06 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C43403A6C6F for ; Thu, 9 Dec 2010 23:32:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.367 X-Spam-Level: X-Spam-Status: No, score=-2.367 tagged_above=-999 required=5 tests=[AWL=0.232, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RyU3vA+PACci for ; Thu, 9 Dec 2010 23:31:58 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id 28DC13A6C67 for ; Thu, 9 Dec 2010 23:31:57 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1PQxTe-000L3S-C3; Fri, 10 Dec 2010 07:33:14 +0000 Date: Thu, 09 Dec 2010 23:33:14 -0800 Message-ID: From: Randy Bush To: Forhad Ahmed In-Reply-To: <8A7BEFB8FCD25A43BB73B1D879B82F7703660F12@xmb-sjc-239.amer.cisco.com> References: <8A7BEFB8FCD25A43BB73B1D879B82F7703660F12@xmb-sjc-239.amer.cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] IETF79 minutes X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Dec 2010 07:32:06 -0000 > Interested in knowing what the PDU formats will be if the 2 fields are > removed... >> RPKI-RTR Protocol by Randy Bush >> -- Newest version removed the fields Color and Source >> -- This draft has running code (both client and server) >> -- This draft is ready to move forward to WGLC the pdus are described in draft-ietf-sidr-rpki-rtr-04.txt randy From sra@hactrn.net Sun Dec 12 10:35:19 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 42EE73A6DF1 for ; Sun, 12 Dec 2010 10:35:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p7RmKYA5MFW1 for ; Sun, 12 Dec 2010 10:35:18 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id 0D6503A6DEE for ; Sun, 12 Dec 2010 10:35:18 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id ACF2528441 for ; Sun, 12 Dec 2010 18:36:50 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 68A6E22808 for ; Sun, 12 Dec 2010 13:36:50 -0500 (EST) Date: Sun, 12 Dec 2010 13:36:50 -0500 From: Rob Austein To: sidr@ietf.org In-Reply-To: <4CFE0A2A.1090802@ripe.net> References: <20101206234104.5174022808@thrintun.hactrn.net> <4CFE0A2A.1090802@ripe.net> User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101212183650.68A6E22808@thrintun.hactrn.net> Subject: Re: [sidr] draft-ietf-sidr-keyroll-05 "staging period" is in the wrong place X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Dec 2010 18:35:19 -0000 At Tue, 07 Dec 2010 11:19:22 +0100, Tim Bruijnzeels wrote: > > If I remember correctly I think Roque and Steve mentioned that CA > certificates on any level may be used by RPs as a Trust Anchor -- even > if you did not plan to make yourself available as a TA (i.e. publishing > your cert info as per TA draft). The staging period was introduced to > give RPs down the chain from you at least some opportunity to notice the > change and start using the new cert in place of the old one.. I am far from certain that I buy this argument (and yes, I understand that you're trying to recount it from memory, not necessarily advocating it). Every RPKI operator in the world must be *required* to publish keys using new certs for 24 hours just in case some stranger somewhere happens to be constructing trust anchors using their certs? To be clear: I do not object to *allowing* prepublication of certs using new keys, there are scenarios where it makes a lot of sense (eg, having a new key out there all ready to use so one can roll quickly in the event of a key compromise). It's putting this in as a hard *requirement* imposed on every RPKI operator that bothers me. > But as I said, if I remember correctly.. maybe Roque or Steve can > comment on this? And, even if the WG buys this argument, it would need to go in the draft. As for why I think there may be a need for some kind of staging (or, at least, a need for the absence of a hard requirement for immediate revocation of OLD CA after reissuing all subordinates under NEW CA): think about network partitions. In particular, think about network partitions that leave the publication point holding the CRL covering OLD CA itself reachable while leaving the publication point for OLD CA's and NEW CA's subordinates unreachable. RP wants to continue using cached copies of subordinates issued by OLD CA, since RP can't reach the new subordinates issued by NEW CA -- but OLD CA has been revoked. Oops. Thud. From gih@apnic.net Sun Dec 12 21:46:03 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B8AC28B797 for ; Sun, 12 Dec 2010 21:46:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.935 X-Spam-Level: X-Spam-Status: No, score=-98.935 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_IP_ADDR=1.119, RDNS_NONE=0.1, RELAY_IS_203=0.994, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sTV7rB8PQ7JJ for ; Sun, 12 Dec 2010 21:46:02 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id D3C4728B56A for ; Sun, 12 Dec 2010 21:45:59 -0800 (PST) Received: from [203.119.0.41] (unknown [203.119.0.41]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id F218CB649C; Mon, 13 Dec 2010 15:47:34 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: Geoff Huston In-Reply-To: <20101212183650.68A6E22808@thrintun.hactrn.net> Date: Mon, 13 Dec 2010 16:47:33 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: <01FBD312-B1D4-472B-9491-EF1127C579F1@apnic.net> References: <20101206234104.5174022808@thrintun.hactrn.net> <4CFE0A2A.1090802@ripe.net> <20101212183650.68A6E22808@thrintun.hactrn.net> To: Rob Austein X-Mailer: Apple Mail (2.1082) Cc: sidr@ietf.org Subject: Re: [sidr] draft-ietf-sidr-keyroll-05 "staging period" is in the wrong place X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Dec 2010 05:46:03 -0000 On 13/12/2010, at 5:36 AM, Rob Austein wrote: > At Tue, 07 Dec 2010 11:19:22 +0100, Tim Bruijnzeels wrote: >>=20 >> If I remember correctly I think Roque and Steve mentioned that CA=20 >> certificates on any level may be used by RPs as a Trust Anchor -- = even=20 >> if you did not plan to make yourself available as a TA (i.e. = publishing=20 >> your cert info as per TA draft). The staging period was introduced to=20= >> give RPs down the chain from you at least some opportunity to notice = the=20 >> change and start using the new cert in place of the old one.. >=20 > I am far from certain that I buy this argument (and yes, I understand > that you're trying to recount it from memory, not necessarily > advocating it). Every RPKI operator in the world must be *required* > to publish keys using new certs for 24 hours just in case some > stranger somewhere happens to be constructing trust anchors using > their certs? In my opinion is that the answer to your question is yes, and no. Yes, in this document every RPKI _CA_ operator in the world is = *required* to publish keys using new certs for a "staging period" (>=3D = 24 hours) before using this CA to publish this CA's subordinate = products. No, this is not directly related to trust anchors. >=20 > To be clear: I do not object to *allowing* prepublication of certs > using new keys, there are scenarios where it makes a lot of sense (eg, > having a new key out there all ready to use so one can roll quickly in > the event of a key compromise). It's putting this in as a hard > *requirement* imposed on every RPKI operator that bothers me. On the other hand, as I understand it, the staging period is intended to = catch relying parties that fall out of sync with the distributed = repository publication process, and manage to gather a new CA cert, but = not collect the new subordinate set of products (maybe they are using = some form of local repository cache synchronisation that uses some = custom synchronization algorithm). This anomalous situation will of = course be suboptimal for the RP given that the set of subordinate = products is no longer able to the validated using the NEW CA. The = staging period specified in the draft for the NEW CA is intended to = minimize the deterimental impacts of this lack of synchronisation = between producer and consumer. As I recall, no specific algorithm is = specified as mandatory for an RP to use in terms of the manner by which = the local repository cache is synchronized against the distributed = repository publication system, with a logical inference that no = particular RP repository synchronization behaviour can be assumed to be = used uniformly by all RPs. >=20 >> But as I said, if I remember correctly.. maybe Roque or Steve can=20 >> comment on this? >=20 > And, even if the WG buys this argument, it would need to go in the > draft. >=20 The draft considers keyroll for CAs. To the extent that a TA is a CA, = this document covers TAs only by virtue of that level of indirection. To = the extent that the TA may have some additional requirements regarding = use of keys, this document does not encompass that. Maybe the TA draft = is the appropriate place to consider what particular requirements one = may want to place on a TA key rollover, bearing in mind that the TA's = key fingerprint may have already been widely circulated using more = persistent media. > As for why I think there may be a need for some kind of staging (or, > at least, a need for the absence of a hard requirement for immediate > revocation of OLD CA after reissuing all subordinates under NEW CA): > think about network partitions. In particular, think about network > partitions that leave the publication point holding the CRL covering > OLD CA itself reachable while leaving the publication point for OLD > CA's and NEW CA's subordinates unreachable. RP wants to continue > using cached copies of subordinates issued by OLD CA, since RP can't > reach the new subordinates issued by NEW CA -- but OLD CA has been > revoked. Oops. Thud. One of many oops thud opportunities in a distributed repository scheme = where there is rollover and update of individual components of the = distributed system. The algorithm described in this document assumes a = repository overwrite procedure of NEW over OLD for the subordinate = products, hence the desire to avoid a THUD opportunity by requiring that = the immediate superior CA publish the NEW CA certificate well in advance = of publishing the subordinate products of the CA. The old CA could be kept around, as distinct from the draft's advice to = generate a revocation request "without and intervening delay" between = publication of the subordinate products of the NEW CA and this = revocation request, but what is the appropriate delay to make as a = minimum *requirement*? What about a CA that encounters key compromise? = If they have been prudent and already published a NEW CA, then rollover = from OLD to NEW CA can be effectively performed immediately. But if this = draft then *requires* the compromised old key to continue to exist for a = period prior to revocation, then how does this continued existence of a = CA with a compromised key add to the overall robustness of the system? I suspect that there are a number of trade-offs in this environment, and = the algorithm described in the draft represents one such set of trade = offs. There are others, as you have pointed out in your note, but I am = personally not convinced at this point that the alternative approach you = describe here offers a net gain to both CAs and RPs. regards, Geoff From Internet-Drafts@ietf.org Thu Dec 16 01:00:02 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 21B8B3A7091; Thu, 16 Dec 2010 01:00:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.526 X-Spam-Level: X-Spam-Status: No, score=-102.526 tagged_above=-999 required=5 tests=[AWL=0.073, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C3YHmibqqRD7; Thu, 16 Dec 2010 01:00:01 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7EE2C3A6FF2; Thu, 16 Dec 2010 01:00:01 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.10 Message-ID: <20101216090001.23826.29042.idtracker@localhost> Date: Thu, 16 Dec 2010 01:00:01 -0800 Cc: sidr@ietf.org Subject: [sidr] I-D Action:draft-ietf-sidr-rpki-rtr-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 09:00:02 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : The RPKI/Router Protocol Author(s) : R. Bush, R. Austein Filename : draft-ietf-sidr-rpki-rtr-05.txt Pages : 20 Date : 2010-12-16 In order to formally validate the origin ASes of BGP announcements, routers need a simple but reliable mechanism to receive RPKI [I-D.ietf-sidr-arch] or analogous prefix origin data from a trusted cache. This document describes a protocol to deliver validated prefix origin data to routers over ssh. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sidr-rpki-rtr-05.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-sidr-rpki-rtr-05.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-16005700.I-D@ietf.org> --NextPart-- From randy@psg.com Thu Dec 16 01:04:36 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 153163A70A5 for ; Thu, 16 Dec 2010 01:04:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.389 X-Spam-Level: X-Spam-Status: No, score=-2.389 tagged_above=-999 required=5 tests=[AWL=0.210, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XEoAmuP83R84 for ; Thu, 16 Dec 2010 01:04:35 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id 4AB593A6FF2 for ; Thu, 16 Dec 2010 01:04:35 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1PT9n0-000LWE-CE for sidr@ietf.org; Thu, 16 Dec 2010 09:06:18 +0000 Date: Thu, 16 Dec 2010 18:06:17 +0900 Message-ID: From: Randy Bush To: sidr wg list In-Reply-To: <20101216090001.23826.29042.idtracker@localhost> References: <20101216090001.23826.29042.idtracker@localhost> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Subject: Re: [sidr] I-D Action:draft-ietf-sidr-rpki-rtr-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 09:04:36 -0000 > Title : The RPKI/Router Protocol > Author(s) : R. Bush, R. Austein > Filename : draft-ietf-sidr-rpki-rtr-05.txt > Pages : 20 > Date : 2010-12-16 the changes have to do with allowing a router to recover a failed session with a cache. if the router has current, fresh, data from the cash and the session dies, it may start a new session with a Serial Query as opposed to a Reset. the cache will send a nonce which allows the router to be sure that Serial Numbers are comensurate. randy From sebastian.spies@nist.gov Thu Dec 16 08:57:52 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 45B273A696E for ; Thu, 16 Dec 2010 08:57:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CEqgRBbYFA2K for ; Thu, 16 Dec 2010 08:57:51 -0800 (PST) Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by core3.amsl.com (Postfix) with ESMTP id 683253A6925 for ; Thu, 16 Dec 2010 08:57:51 -0800 (PST) Received: from WSXGHUB2.xchange.nist.gov (WSXGHUB2.xchange.nist.gov [129.6.18.19]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id oBGGxRHF013541 for ; Thu, 16 Dec 2010 11:59:28 -0500 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB2.xchange.nist.gov ([129.6.18.19]) with mapi; Thu, 16 Dec 2010 11:59:20 -0500 From: "Spies, Sebastian Martin" To: "sidr@ietf.org" Date: Thu, 16 Dec 2010 11:59:26 -0500 Thread-Topic: draft-ietf-sidr-rpki-rtr-06 Thread-Index: AcudQpiNalHWOKq8Qbe15pOO8aa98w== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: sebastian.spies@nist.gov Cc: "Borchert, Oliver" Subject: [sidr] draft-ietf-sidr-rpki-rtr-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 16:57:52 -0000 I have a question about the interpretation of the history, the cache should keep. Does the draft explicitely or implicitely say, that there is a minimum time, the cache have to keep its prefix entries. Sebastian ---- Sebastian Spies Guest Researcher 892.04 Advanced Network Technologies Division National Institute of Standards and Technology phone: 301-975-3259 From Sandra.Murphy@cobham.com Thu Dec 16 15:52:19 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E26123A6A28 for ; Thu, 16 Dec 2010 15:52:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.478 X-Spam-Level: X-Spam-Status: No, score=-102.478 tagged_above=-999 required=5 tests=[AWL=0.121, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DCIMSHGtTuFt for ; Thu, 16 Dec 2010 15:52:19 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id B1FC13A6A2C for ; Thu, 16 Dec 2010 15:52:18 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNs3Lx018112 for ; Thu, 16 Dec 2010 17:54:04 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNs33g020363 for ; Thu, 16 Dec 2010 17:54:04 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:54:03 -0500 Date: Thu, 16 Dec 2010 18:54:03 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:54:03.0694 (UTC) FILETIME=[84A284E0:01CB9D7C] Subject: Re: [sidr] WG LC for draft-ietf-sidr-cp-10.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:52:20 -0000 The WG LC ended and discussion (eventually) concluded. I am satisfied that the wg has achieved consensus and all comments have been resolved. I will send this draft forward with a request for publication. --Sandy, speaking as wg chair On Wed, 25 Aug 2010, Sandra Murphy wrote: > The authors of "Certificate Policy (CP) for the Resource PKI (RPKI)" have > requested a working group last call on this draft. The draft is available at > http://tools.ietf.org/html/draft-ietf-sidr-cp-10. > > The authors indicate that the following changes have been made: > > 1. Added 147 RFC 2119 words > > 2. Changed "2.1. Repositories" to require conformance to > the spec "A Profile for Resource Certificate Repository Structure" > > 3. Changed "3.2.4. Non-verified subscriber information" > > From: No non-verified subscriber data is included in certificates > issued under this certificate policy except for SIA/AIA > extensions. > To: No non-verified subscriber data is included in certificates > issued under this certificate policy except for SIA > extensions. > > 4. Changed Section "4.7. Certificate re-key" to require conformance > to the spec for "CA Key Rollover in the RPKI" > > This document has been through last call once before, which ordinarily would > mean that this review would verify that previous last call comments had been > adequately dealt with. However, the number of changes made since the last > wglc indicate a full review would be wise, particularly the 2119 language. > > Please review the document and send comments to the list, and indicate > whether you believe that this document is ready to leave the wg. > > The wglc will end on 10 Sept. > > --Sandy, speaking as wg chair > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:53:01 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7DACD3A6A28 for ; Thu, 16 Dec 2010 15:53:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.489 X-Spam-Level: X-Spam-Status: No, score=-102.489 tagged_above=-999 required=5 tests=[AWL=0.110, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QjKU3Clp9L0y for ; Thu, 16 Dec 2010 15:53:00 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 43D153A6A1F for ; Thu, 16 Dec 2010 15:53:00 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNsjA1018120 for ; Thu, 16 Dec 2010 17:54:45 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNsjIG020381 for ; Thu, 16 Dec 2010 17:54:45 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:54:45 -0500 Date: Thu, 16 Dec 2010 18:54:45 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:54:45.0631 (UTC) FILETIME=[9DA198F0:01CB9D7C] Subject: Re: [sidr] WG LC for draft-ietf-sidr-ta-05 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:53:01 -0000 The WGLC period has concluded. I am satisfied that the working group consensus is that the draft is worthy of publication. I will send this draft forward with a request for publication. --Sandy, speaking with wg chair skullcap on On Fri, 5 Nov 2010, Sandra Murphy wrote: > On 14 September, Chris Morrow, with wg fedora on, said of > draft-ietf-sidr-ta-04: > >> Unless there are complaints about this, please get a last rev in >> before Bejing so it can start LC just before the meeting. > > The authors have submitted a new version > (http://tools.ietf.org/html/draft-ietf-sidr-ta-05) and have requested a > working group last call. > > The chairs ask the working group to consider this draft and decide whether it > is worthy of publication. > > Given that next week is IETF week, the last call will end 26 November. > > --Sandy, wg chair skullcap on > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:53:36 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 199DB3A6A20 for ; Thu, 16 Dec 2010 15:53:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.498 X-Spam-Level: X-Spam-Status: No, score=-102.498 tagged_above=-999 required=5 tests=[AWL=0.101, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1CIbCgJyehja for ; Thu, 16 Dec 2010 15:53:35 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 401FE3A6A12 for ; Thu, 16 Dec 2010 15:53:35 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNtKId018134 for ; Thu, 16 Dec 2010 17:55:20 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNtKkC020437 for ; Thu, 16 Dec 2010 17:55:20 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:55:20 -0500 Date: Thu, 16 Dec 2010 18:55:20 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:55:20.0647 (UTC) FILETIME=[B2809D70:01CB9D7C] Subject: Re: [sidr] WG LC for draft-ietf-sidr-arch-11 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:53:36 -0000 The WGLC has concluded. I am satisfied that the working group consensus is that the draft is worthy of publication. I will send this draft forward with a request for publication. --Sandy, speaking with wg chair turban on On Fri, 5 Nov 2010, Sandra Murphy wrote: > The authors of draft-ietf-sidr-arch > (http://tools.ietf.org/html/draft-ietf-sidr-arch-11) have requested a working > group last call. > > The chairs ask the working group to consider this draft and decide whether it > is worthy of publication. > > This draft was in last call about a year ago and some changes have been made > in the time since. Given that the IETF is next week, the WG LC will end on > 26 November. > > --Sandy, wg chair turban on > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:54:21 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B48453A6A38 for ; Thu, 16 Dec 2010 15:54:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.506 X-Spam-Level: X-Spam-Status: No, score=-102.506 tagged_above=-999 required=5 tests=[AWL=0.093, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U1ur-pN4h9TN for ; Thu, 16 Dec 2010 15:54:21 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id BD74E3A6A1F for ; Thu, 16 Dec 2010 15:54:20 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNu6VH018142 for ; Thu, 16 Dec 2010 17:56:06 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNu6bg020458 for ; Thu, 16 Dec 2010 17:56:06 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:56:06 -0500 Date: Thu, 16 Dec 2010 18:56:05 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:56:06.0131 (UTC) FILETIME=[CD9CEC30:01CB9D7C] Subject: Re: [sidr] WGLC for draft-ietf-sidr-rescerts-provisioning-09 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:54:21 -0000 The WGLC period has ended. I am satisfied that the working group consensus is that the draft is worthy of publication. I will send this draft forward with a request for publication. One nit was noted that the authors should keep in mind for the final processing. http://www.ietf.org/mail-archive/web/sidr/current/msg02253.html --Sandy, speaking with wg chair bowler on On Wed, 17 Nov 2010, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft "A Protocol for > Provisioning Resource Certificates". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-rescerts-provisioning. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair bowler on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:55:28 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7176E3A6A2C for ; Thu, 16 Dec 2010 15:55:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.513 X-Spam-Level: X-Spam-Status: No, score=-102.513 tagged_above=-999 required=5 tests=[AWL=0.086, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w6cX6cZMAXoc for ; Thu, 16 Dec 2010 15:55:25 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 26D043A6A28 for ; Thu, 16 Dec 2010 15:55:25 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNvAuD018152 for ; Thu, 16 Dec 2010 17:57:10 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNvAW3020481 for ; Thu, 16 Dec 2010 17:57:10 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:57:10 -0500 Date: Thu, 16 Dec 2010 18:57:09 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:57:10.0537 (UTC) FILETIME=[F4007F90:01CB9D7C] Subject: Re: [sidr] WGLC for draft-ietf-sidr-rpki-rtr-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:55:28 -0000 The WGLC period has ended. I am satisfied that comments have been addressed and that working group consensus is that the revised draft is worthy of publication. I will send this draft forward with a request for publication. --Sandy, speaking with wg chair cloche on On Wed, 17 Nov 2010, Sandra Murphy wrote: > > Randy Bush has requested a WG LC for draft "The RPKI/Router Protocol". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-rpki-rtr. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair cloche on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:56:25 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 57FF63A6A12 for ; Thu, 16 Dec 2010 15:56:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.519 X-Spam-Level: X-Spam-Status: No, score=-102.519 tagged_above=-999 required=5 tests=[AWL=0.080, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RmhBS10s0J2J for ; Thu, 16 Dec 2010 15:56:24 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 6D7D83A6A1F for ; Thu, 16 Dec 2010 15:56:24 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNwAa9018164 for ; Thu, 16 Dec 2010 17:58:10 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNw9GD020508 for ; Thu, 16 Dec 2010 17:58:10 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:58:09 -0500 Date: Thu, 16 Dec 2010 18:58:09 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:58:09.0833 (UTC) FILETIME=[17585990:01CB9D7D] Subject: Re: [sidr] WGLC for draft-ietf-sidr-res-certs-20 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:56:25 -0000 The WGLC period has ended. I am satisfied that comments have been addressed and that working group consensus is that the revised draft is worthy of publication. I will send this draft forward with a request for publication. --Sandy, speaking with wg chair boater on On Wed, 17 Nov 2010, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft "A Profile for X.509 PKIX > Resource Certificates". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-res-certs. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair boater on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:57:00 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 64E663A6A29 for ; Thu, 16 Dec 2010 15:57:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.524 X-Spam-Level: X-Spam-Status: No, score=-102.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GQYsM9W90HWu for ; Thu, 16 Dec 2010 15:56:59 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 8D51F3A6A12 for ; Thu, 16 Dec 2010 15:56:59 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNwjmv018180 for ; Thu, 16 Dec 2010 17:58:45 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNwjoC020545 for ; Thu, 16 Dec 2010 17:58:45 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:58:44 -0500 Date: Thu, 16 Dec 2010 18:58:44 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:58:44.0974 (UTC) FILETIME=[2C4A70E0:01CB9D7D] Subject: Re: [sidr] WGLC for draft-ietf-sidr-rpki-algs-04 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:57:00 -0000 The WGLC period has ended. I am satisfied that the working group consensus is that the draft is worthy of publication. I will send this draft forward with a request for publication. --Sandy, speaking with wg chair homburg on On Wed, 17 Nov 2010, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft " A Profile for Algorithms > and Key Sizes for use in the Resource Public Key Infrastructure". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-rpki-algs/. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair homburg on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:57:27 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 707403A6A1F for ; Thu, 16 Dec 2010 15:57:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.528 X-Spam-Level: X-Spam-Status: No, score=-102.528 tagged_above=-999 required=5 tests=[AWL=0.071, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zyPHg8UC68bs for ; Thu, 16 Dec 2010 15:57:26 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 97E4B3A6A12 for ; Thu, 16 Dec 2010 15:57:26 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNxCNO018188 for ; Thu, 16 Dec 2010 17:59:12 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNxC39020565 for ; Thu, 16 Dec 2010 17:59:12 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:59:11 -0500 Date: Thu, 16 Dec 2010 18:59:11 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:59:12.0005 (UTC) FILETIME=[3C670B50:01CB9D7D] Subject: Re: [sidr] WGLC for draft-ietf-sidr-rpki-manifests-09 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:57:27 -0000 The WGLC period has ended. I am satisfied that the working group consensus is that the draft is worthy of publication. I will send this draft forward with a request for publication. One nit was noted that the authors should keep in mind for the final processing. http://www.ietf.org/mail-archive/web/sidr/current/msg02252.html --Sandy, speaking with wg chair beret on On Wed, 17 Nov 2010, Sandra Murphy wrote: > > Geoff Huston has requested a WG LC for draft "Manifests for the > Resource Public Key Infrastructure". > > The document and the draft version history are available at > http://tools.ietf.org/wg/sidr/draft-ietf-sidr-rpki-manifests. > > The Last Call will end Wed, 1 Dec 2010 (AOE). > > As usual, please address all comments to the WG mailing list, and > please be clear in your comments to this last call if you are > supporting the document's submission to the IESG or if you are > opposed. If you are opposed, please indicate why. > > --Sandy, speaking with wg chair beret on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:58:12 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30E483A6A1F for ; Thu, 16 Dec 2010 15:58:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.532 X-Spam-Level: X-Spam-Status: No, score=-102.532 tagged_above=-999 required=5 tests=[AWL=0.067, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LuNrwjd4Swpk for ; Thu, 16 Dec 2010 15:58:11 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 55C7F3A6A29 for ; Thu, 16 Dec 2010 15:58:11 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBGNxuNA018192 for ; Thu, 16 Dec 2010 17:59:56 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBGNxuIW020580 for ; Thu, 16 Dec 2010 17:59:56 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 18:59:56 -0500 Date: Thu, 16 Dec 2010 18:59:56 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 16 Dec 2010 23:59:56.0692 (UTC) FILETIME=[5709BD40:01CB9D7D] Subject: Re: [sidr] WG Adoption for draft-rgaglian-sidr-algorithm-agility-00 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:58:12 -0000 The call for adoption has ended. I am satisfied that there is consensus to adopt this document as a working group work item. The authors are invited to submit the draft with the standard working group format (draft-ietf-sidr-xxx) name. --Sandy, speaking with wg chair helmet on On Wed, 17 Nov 2010, Sandra Murphy wrote: > > Steve Kent has requested that the working group adopt the draft > draft-rgaglian-sidr-algorithm-agility-00.txt, Algorithm Agility > Procedure for RPKI, as a work item. > > It is available at > http://tools.ietf.org/html/draft-rgaglian-sidr-algorithm-agility-00. > > Recall that active support for adoption is necessary for the wg chairs > to judge acceptance as a working group work item, so silence works > against adoption. The wg chairs also want to know who would be > willing to work on the draft. > > Please respond to the list, giving your recommendation for or against > adoption of the draft as a wg work item as well as your intention to > work on the draft if adopted. The call for adoption will end in two > weeks on Wed 1 Dec 2010 AOE. > > --Sandy, speaking with wg chair helmet on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:58:46 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 056AF3A6A12 for ; Thu, 16 Dec 2010 15:58:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.535 X-Spam-Level: X-Spam-Status: No, score=-102.535 tagged_above=-999 required=5 tests=[AWL=0.064, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eRqDyXV0XQlE for ; Thu, 16 Dec 2010 15:58:45 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 040CA3A6A13 for ; Thu, 16 Dec 2010 15:58:44 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBH00UWg018215 for ; Thu, 16 Dec 2010 18:00:30 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBH00U3h020605 for ; Thu, 16 Dec 2010 18:00:30 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 19:00:30 -0500 Date: Thu, 16 Dec 2010 19:00:29 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 17 Dec 2010 00:00:30.0364 (UTC) FILETIME=[6B1BADC0:01CB9D7D] Subject: Re: [sidr] WG Adoption for draft-ymbk-ghostbusters-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:58:46 -0000 The call for adoption has ended. I am satisfied that there is consensus to adopt this document as a working group work item. The authors are invited to submit the draft with the standard working group format (draft-ietf-sidr-xxx) name. Note that the message of 29 Nov: http://www.ietf.org/mail-archive/web/sidr/current/msg02211.html may apply to this work. --Sandy, speaking with wg chair coronet on On Thu, 18 Nov 2010, Sandra Murphy wrote: > > Randy Bush has requested that the working group adopt the draft > draft-ymbk-ghostbusters-01, "The RPKI Ghostbusters Record", as a work > item. > > It is available at > http://tools.ietf.org/html/draft-ymbk-ghostbusters-01. > > Recall that active support for adoption is necessary for the wg chairs > to judge acceptance as a working group work item, so silence works > against adoption. The wg chairs also want to know who would be > willing to work on the draft. > > Please respond to the list, giving your recommendation for or against > adoption of the draft as a wg work item as well as your intention to > work on the draft if adopted. The call for adoption will end in two > weeks on Wed 1 Dec 2010 AOE. > > --Sandy, speaking with wg chair coronet on > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@cobham.com Thu Dec 16 15:59:19 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A845B3A6A12 for ; Thu, 16 Dec 2010 15:59:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.539 X-Spam-Level: X-Spam-Status: No, score=-102.539 tagged_above=-999 required=5 tests=[AWL=0.060, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fe6MczlOtLZd for ; Thu, 16 Dec 2010 15:59:18 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id BA1903A6A2A for ; Thu, 16 Dec 2010 15:59:18 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBH0144Y018229 for ; Thu, 16 Dec 2010 18:01:04 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBH014Zr020638 for ; Thu, 16 Dec 2010 18:01:04 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 19:01:04 -0500 Date: Thu, 16 Dec 2010 19:01:03 -0500 (Eastern Standard Time) From: Sandra Murphy To: sidr@ietf.org In-Reply-To: Message-ID: References: X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 17 Dec 2010 00:01:04.0113 (UTC) FILETIME=[7F395E10:01CB9D7D] Subject: Re: [sidr] WG Adoption for draft-ymbk-rpki-origin-ops-00 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Dec 2010 23:59:19 -0000 The call for adoption has ended. I am satisfied that there is consensus to adopt this document as a working group work item. The authors are invited to submit the draft with the standard working group format (draft-ietf-sidr-xxx) name. --Sandy, speaking with wg chair wimple on On Thu, 18 Nov 2010, Sandra Murphy wrote: > > Randy Bush has requested that the working group adopt the draft > draft-ymbk-rpki-origin-ops-00, "RPKI-Based Origin Validation > Operations", as a work item. > > It is available at > http://tools.ietf.org/html/draft-ymbk-rpki-origin-ops-00. > > Recall that active support for adoption is necessary for the wg chairs > to judge acceptance as a working group work item, so silence works > against adoption. The wg chairs also want to know who would be > willing to work on the draft. > > Please respond to the list, giving your recommendation for or against > adoption of the draft as a wg work item as well as your intention to > work on the draft if adopted. The call for adoption will end in two > weeks on Wed 1 Dec 2010 AOE. > > --Sandy, speaking with wg chair wimple on > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From randy@psg.com Thu Dec 16 16:08:24 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3B0253A6A29 for ; Thu, 16 Dec 2010 16:08:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.398 X-Spam-Level: X-Spam-Status: No, score=-2.398 tagged_above=-999 required=5 tests=[AWL=0.201, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SNHLZGnzNgZW for ; Thu, 16 Dec 2010 16:08:23 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by core3.amsl.com (Postfix) with ESMTP id 48C103A6A1F for ; Thu, 16 Dec 2010 16:08:23 -0800 (PST) Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from ) id 1PTNte-0001Mp-Dy; Fri, 17 Dec 2010 00:10:06 +0000 Date: Fri, 17 Dec 2010 09:10:05 +0900 Message-ID: From: Randy Bush To: "Spies, Sebastian Martin" In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: "Borchert, Oliver" , "sidr@ietf.org" Subject: Re: [sidr] draft-ietf-sidr-rpki-rtr-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Dec 2010 00:08:24 -0000 > I have a question about the interpretation of the history, the cache > should keep. Does the draft explicitely or implicitely say, that there > is a minimum time, the cache have to keep its prefix entries. from 5.1 To limit the length of time a cache must keep the data necessary to generate incremental updates, a router MUST send either a Serial Query or a Reset Query no less frequently than once an hour. This also acts as a keep alive at the application layer. As the cache MAY not keep updates for more than one hour, the router MUST have a polling interval of no greater than half an hour From ggm@apnic.net Thu Dec 16 16:26:57 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E06103A6A25 for ; Thu, 16 Dec 2010 16:26:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QdElNpnP0Mkg for ; Thu, 16 Dec 2010 16:26:57 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id 60EF43A6A21 for ; Thu, 16 Dec 2010 16:26:56 -0800 (PST) Received: from [IPv6:2001:dc0:a000:4:21f:5bff:fef4:b044] (unknown [IPv6:2001:dc0:a000:4:21f:5bff:fef4:b044]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id 41167B66DB; Fri, 17 Dec 2010 10:28:40 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: George Michaelson In-Reply-To: Date: Fri, 17 Dec 2010 10:28:38 +1000 Content-Transfer-Encoding: quoted-printable Message-Id: <27ED66B0-305E-414D-9AEE-3E7C93C96863@apnic.net> References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> To: Randy Bush X-Mailer: Apple Mail (2.1082) Cc: Sandra Murphy , sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Dec 2010 00:26:58 -0000 On 04/12/2010, at 8:04 AM, Randy Bush wrote: >>> Andrew suggests that the new naming schemes should be added to the=20= >>> repos-struct draft. >>>=20 >>> Tim's message implies that the naming scheme would be added to the=20= >>> roa-format draft (by extension, to whatever draft creates a new=20 >>> repository structure element, like the ghostbusters draft). >>>=20 >>> I'd like wg consideration as to which would be best, both now and=20 >>> going forward. >>=20 >> I support adding .roa; I didn't realize it was not there already. >>=20 >> I think we can wait for GB, because it is a new doc, not yet final=20 >> (it was just adopted by the WG). We will need to have each new RPKI=20= >> signed object specify it's file extension for the future, so why now=20= >> start with the GB doc, when it is approved. >=20 > lemme repeat. keeping track of a changing list of identifiers is = (part > of) the iana function and is why we have iana consideration sections = in > documents. >=20 > probably repo structure should create the registry with certs and > manifests and crls, and roa, ghostbusters, ... should add to it. >=20 I hesitate to block anything here, but I observe that preserving 8.3 = filename semantics is hugely anachronistic and leaves a bad taste in my = mouth. We worked very hard to get rid of this insanity in UNIX = filesystems/services space, and you can compile any named file you like = from C to object to running binary in any legal nameform that the = filesystem will accept.=20 Its not proscriptive. /etc/magic is the registry, such as it is. If there is a need for a registry, so be it. But can we acknowledge that = this is a retrograde decision?=20 .cgi is not in a registry .html is not in a registry the MIME encodings are in a registry. an OID might be analogous. Cannot = the CMS carry an OID, and is an OID not an extensible prefix for = creation of identity?=20 -G From Sandra.Murphy@cobham.com Thu Dec 16 17:33:31 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B08573A6A56 for ; Thu, 16 Dec 2010 17:33:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.542 X-Spam-Level: X-Spam-Status: No, score=-102.542 tagged_above=-999 required=5 tests=[AWL=0.057, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hvUwqOBnxCgp for ; Thu, 16 Dec 2010 17:33:30 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id ABA273A6A55 for ; Thu, 16 Dec 2010 17:33:30 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id oBH1ZAT2018737; Thu, 16 Dec 2010 19:35:10 -0600 Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id oBH1ZAmM022258; Thu, 16 Dec 2010 19:35:10 -0600 Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.150]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Thu, 16 Dec 2010 20:35:10 -0500 Date: Thu, 16 Dec 2010 20:35:09 -0500 (Eastern Standard Time) From: Sandra Murphy To: George Michaelson In-Reply-To: <27ED66B0-305E-414D-9AEE-3E7C93C96863@apnic.net> Message-ID: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> <27ED66B0-305E-414D-9AEE-3E7C93C96863@apnic.net> X-X-Sender: sandy@mailbin.sparta.com MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-OriginalArrivalTime: 17 Dec 2010 01:35:10.0374 (UTC) FILETIME=[A4A86C60:01CB9D8A] Cc: sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Dec 2010 01:33:31 -0000 On Fri, 17 Dec 2010, George Michaelson wrote: > > On 04/12/2010, at 8:04 AM, Randy Bush wrote: > >>>> Andrew suggests that the new naming schemes should be added to the >>>> repos-struct draft. >>>> >>>> Tim's message implies that the naming scheme would be added to the >>>> roa-format draft (by extension, to whatever draft creates a new >>>> repository structure element, like the ghostbusters draft). >>>> >>>> I'd like wg consideration as to which would be best, both now and >>>> going forward. >>> >>> I support adding .roa; I didn't realize it was not there already. >>> >>> I think we can wait for GB, because it is a new doc, not yet final >>> (it was just adopted by the WG). We will need to have each new RPKI >>> signed object specify it's file extension for the future, so why now >>> start with the GB doc, when it is approved. >> >> lemme repeat. keeping track of a changing list of identifiers is (part >> of) the iana function and is why we have iana consideration sections in >> documents. >> >> probably repo structure should create the registry with certs and >> manifests and crls, and roa, ghostbusters, ... should add to it. >> > > I hesitate to block anything here, but I observe that preserving 8.3 filename semantics is hugely anachronistic and leaves a bad taste in my mouth. We worked very hard to get rid of this insanity in UNIX filesystems/services space, and you can compile any named file you like from C to object to running binary in any legal nameform that the filesystem will accept. The repos-struct draft does already mandate three file extensions: .cer, .crl, and .mft. As co-author, are you thinking of retracting that? --sandy, speaking with wg hood on > > Its not proscriptive. /etc/magic is the registry, such as it is. > > If there is a need for a registry, so be it. But can we acknowledge that this is a retrograde decision? > > .cgi is not in a registry > .html is not in a registry > > the MIME encodings are in a registry. an OID might be analogous. Cannot the CMS carry an OID, and is an OID not an extensible prefix for creation of identity? > > -G > > > From terry@terrym.net Thu Dec 16 17:41:22 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 635913A6A51 for ; Thu, 16 Dec 2010 17:41:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U49N6WLy44ce for ; Thu, 16 Dec 2010 17:41:20 -0800 (PST) Received: from mail-gw0-f42.google.com (mail-gw0-f42.google.com [74.125.83.42]) by core3.amsl.com (Postfix) with ESMTP id 512B13A6A4F for ; Thu, 16 Dec 2010 17:41:20 -0800 (PST) Received: by gwb20 with SMTP id 20so131741gwb.15 for ; Thu, 16 Dec 2010 17:43:05 -0800 (PST) Received: by 10.91.189.16 with SMTP id r16mr1591906agp.73.1292550185664; Thu, 16 Dec 2010 17:43:05 -0800 (PST) Received: from [192.168.1.100] (c122-104-151-4.fitzg3.qld.optusnet.com.au [122.104.151.4]) by mx.google.com with ESMTPS id c34sm3556639anc.30.2010.12.16.17.43.01 (version=TLSv1/SSLv3 cipher=RC4-MD5); Thu, 16 Dec 2010 17:43:04 -0800 (PST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: Terry Manderson In-Reply-To: <27ED66B0-305E-414D-9AEE-3E7C93C96863@apnic.net> Date: Fri, 17 Dec 2010 11:42:58 +1000 Content-Transfer-Encoding: quoted-printable Message-Id: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> <27ED66B0-305E-414D-9AEE-3E7C93C96863@apnic.net> To: George Michaelson X-Mailer: Apple Mail (2.1082) Cc: Sandra Murphy , sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Dec 2010 01:41:22 -0000 Speaking strictly for myself on this topic. On 17/12/2010, at 10:28 AM, George Michaelson wrote: >=20 > I hesitate to block anything here, but I observe that preserving 8.3 = filename semantics is hugely anachronistic and leaves a bad taste in my = mouth. I find this contradictory. On the one hand the working group has adopted = a repository structure where we describe directories and files, not = URIs. Further we speak of manifests with registering file names and so = forth. Section 2.2 in draft-ietf-sidr-repos-struct-06 specifies .cer, mft, and = .crl. thus holding the ".3" part of the name. Do you now wish to make that = arbitrary? > We worked very hard to get rid of this insanity in UNIX = filesystems/services space, and you can compile any named file you like = from C to object to running binary in any legal nameform that the = filesystem will accept.=20 >=20 > Its not proscriptive. /etc/magic is the registry, such as it is. >=20 > If there is a need for a registry, so be it. But can we acknowledge = that this is a retrograde decision?=20 >=20 > .cgi is not in a registry > .html is not in a registry >=20 > the MIME encodings are in a registry. an OID might be analogous. = Cannot the CMS carry an OID, and is an OID not an extensible prefix for = creation of identity?=20 >=20 I would put forth, regardless of the file name extension length that the = extension have special meaning within the SIDR work and hint nicely as = to what the file contents might be. I see no reason not to have a stable = registry. Cheers Terry= From ggm@apnic.net Thu Dec 16 17:42:02 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4E3483A6A4F for ; Thu, 16 Dec 2010 17:42:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aNz3MfAOjwXx for ; Thu, 16 Dec 2010 17:42:01 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id 7F4103A6A4D for ; Thu, 16 Dec 2010 17:42:00 -0800 (PST) Received: from [IPv6:2001:dc0:a000:4:21f:5bff:fef4:b044] (unknown [IPv6:2001:dc0:a000:4:21f:5bff:fef4:b044]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id 15277B6822; Fri, 17 Dec 2010 11:43:45 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: George Michaelson In-Reply-To: Date: Fri, 17 Dec 2010 11:43:44 +1000 Content-Transfer-Encoding: quoted-printable Message-Id: <1347BF74-28C4-4395-BB7F-3536698222B3@apnic.net> References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> <27ED66B0-305E-414D-9AEE-3E7C93C96863@apnic.net> To: Sandra Murphy X-Mailer: Apple Mail (2.1082) Cc: sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Dec 2010 01:42:02 -0000 On 17/12/2010, at 11:35 AM, Sandra Murphy wrote: > =20 > The repos-struct draft does already mandate three file extensions: = .cer, .crl, and .mft. As co-author, are you thinking of retracting = that? >=20 No. I have no sense this is reversible, and I see a registry of some = kind as inevitable. rsync doesn't have a mechanism other than apparent filename to filter = the fetched objects so I suspect the name *has* to be proscriptive to = permit --include-file=3D*mft --exclude-file=3D*roa type selections. -George= From gih@apnic.net Thu Dec 16 19:19:57 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4FFEA3A68EF for ; Thu, 16 Dec 2010 19:19:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -90.349 X-Spam-Level: X-Spam-Status: No, score=-90.349 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_DHCP=1.398, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_AU=0.377, HELO_EQ_CPE=0.5, HOST_EQ_AU=0.327, HOST_EQ_CPE=0.979, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id onZkhVuRvDxi for ; Thu, 16 Dec 2010 19:19:56 -0800 (PST) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by core3.amsl.com (Postfix) with ESMTP id D93D93A68E8 for ; Thu, 16 Dec 2010 19:19:55 -0800 (PST) Received: from cpe-138-217-211-136.lns1.fli.bigpond.net.au (CPE-138-217-211-136.lns1.fli.bigpond.net.au [138.217.211.136]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id 2FE68B66DB; Fri, 17 Dec 2010 13:21:31 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1082) Content-Type: text/plain; charset=us-ascii From: Geoff Huston In-Reply-To: Date: Fri, 17 Dec 2010 14:21:24 +1100 Content-Transfer-Encoding: 7bit Message-Id: References: <4CE4F46A.3020806@ripe.net> <4CF42DA0.7030102@bbn.com> To: Randy Bush X-Mailer: Apple Mail (2.1082) Cc: Sandra Murphy , sidr@ietf.org Subject: Re: [sidr] upcoming wg calls X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Dec 2010 03:19:57 -0000 On 04/12/2010, at 9:04 AM, Randy Bush wrote: >>> Andrew suggests that the new naming schemes should be added to the >>> repos-struct draft. >>> >>> Tim's message implies that the naming scheme would be added to the >>> roa-format draft (by extension, to whatever draft creates a new >>> repository structure element, like the ghostbusters draft). >>> >>> I'd like wg consideration as to which would be best, both now and >>> going forward. >> >> I support adding .roa; I didn't realize it was not there already. >> >> I think we can wait for GB, because it is a new doc, not yet final >> (it was just adopted by the WG). We will need to have each new RPKI >> signed object specify it's file extension for the future, so why now >> start with the GB doc, when it is approved. > > lemme repeat. keeping track of a changing list of identifiers is (part > of) the iana function and is why we have iana consideration sections in > documents. > > probably repo structure should create the registry with certs and > manifests and crls, and roa, ghostbusters, ... should add to it. this works for me as well. I'll respin the draft with iana considerations added for registry. From tim@ripe.net Tue Dec 21 06:11:15 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B05DB3A687D for ; Tue, 21 Dec 2010 06:11:15 -0800 (PST) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Improper folded header field made up entirely of whitespace (char 20 hex): X-RIPE-Spam-Report: ...al Points: -2.9 points\n \n pts rule nam[...] X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I0fe7wATQmai for ; Tue, 21 Dec 2010 06:11:14 -0800 (PST) Received: from postlady.ripe.net (postlady.ipv6.ripe.net [IPv6:2001:610:240:11::c100:1341]) by core3.amsl.com (Postfix) with ESMTP id 8F3513A68C0 for ; Tue, 21 Dec 2010 06:11:13 -0800 (PST) Received: from ayeaye.ripe.net ([193.0.23.5]) by postlady.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1PV2xf-0004Zi-Cl for sidr@ietf.org; Tue, 21 Dec 2010 15:13:09 +0100 Received: from timbru.vpn.ripe.net ([193.0.21.62] helo=guest82.guestnet.ripe.net) by ayeaye.ripe.net with esmtp (Exim 4.72) (envelope-from ) id 1PV2xf-0006Yc-AC for sidr@ietf.org; Tue, 21 Dec 2010 15:13:07 +0100 Message-ID: <4D10B5F3.5050106@ripe.net> Date: Tue, 21 Dec 2010 15:13:07 +0100 From: Tim Bruijnzeels User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7 MIME-Version: 1.0 To: "sidr@ietf.org" Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07194ec33005252553a6024d39a77c9df3c5 X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07194ec33005252553a6024d39a77c9df3c5 Subject: [sidr] Probable bug in rsync and non-normative file names in repo doc X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Dec 2010 14:11:15 -0000 Hi all, we noticed a possible problem when using the, non-normative, file name strategy suggested in the repos-structure document section 2.2. I don't think the suggestion should be changed, but operationally the following may be of interest... There seems to be bug in rsync when you try retrieve a single file that start with a '-' (minus) character ('-' is part of the file system safe base64 set). It seems this is related to the rsync daemon implementation, but we have not yet followed up with the rsync mailinglist (could not find anything in bugtracker): rsync: on remote machine: -SndBLVaDchzm60h4WPrfNiVu5k.cer: invalid numeric value rsync error: requested action not supported (code 4) at clientserver.c(841) [sender=3.0.7] rsync: read error: Connection reset by peer (54) rsync error: error in rsync protocol data stream (code 12) at /SourceCache/rsync/rsync-40/rsync/io.c(603) [receiver=2.6.9] Note that this probably does not affect the validation implementation for BBN and rcynic. Recursive downloads are not affected. Our validator supports bottom-up validation as well and tries to fetch all objects in the chain individually, so this functionality is affected. From our side we are putting a work-around in place, for the time being, that will prepend any filename that would start with '-' with a '1' character. If you are implementing software that produces repositories you may want to prevent having file names starting with '-' as well. In general one can never be sure that RPs will not try to fetch files individually and if this is a bug in rsync (as it seems to be) than even a fix to rsync may not be good enough as people out there may use old versions (impact also depends on whether the problem is server or client side..) If anyone has any other ideas (or experience) on this, much appreciated. In the meantime we will try to follow with the rsync developers. Is there anyone on this list who could quickly verify this with them? I don't mind using the regular bug-tracker but if someone knows these people that might speed up matters. If we have more news on this we'll let the list know.. Regards Tim Bruijnzeels From Internet-Drafts@ietf.org Tue Dec 21 15:45:12 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B9AEB3A6A6B; Tue, 21 Dec 2010 15:45:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.494 X-Spam-Level: X-Spam-Status: No, score=-102.494 tagged_above=-999 required=5 tests=[AWL=0.105, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Gv6qRNdHQTB; Tue, 21 Dec 2010 15:45:06 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A037B3A6910; Tue, 21 Dec 2010 15:45:02 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.10 Message-ID: <20101221234502.25909.34121.idtracker@localhost> Date: Tue, 21 Dec 2010 15:45:02 -0800 Cc: sidr@ietf.org Subject: [sidr] I-D Action:draft-ietf-sidr-usecases-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Dec 2010 23:45:12 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : Use Cases and interpretation of RPKI objects for issuers and relying parties Author(s) : T. Manderson, et al. Filename : draft-ietf-sidr-usecases-01.txt Pages : 24 Date : 2010-12-21 This document provides use cases, directions, and interpretations for organizations and relying parties when creating or encountering RPKI object scenarios in the public RPKI in relation to the Internet routing system. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sidr-usecases-01.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-sidr-usecases-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-21153949.I-D@ietf.org> --NextPart-- From kotikalapudi.sriram@nist.gov Wed Dec 22 04:27:36 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 799043A6B62 for ; Wed, 22 Dec 2010 04:27:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id twzqR7XI6Jzj for ; Wed, 22 Dec 2010 04:27:35 -0800 (PST) Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by core3.amsl.com (Postfix) with ESMTP id 2EB9A3A6B0D for ; Wed, 22 Dec 2010 04:27:34 -0800 (PST) Received: from WSXGHUB2.xchange.nist.gov (WSXGHUB2.xchange.nist.gov [129.6.18.19]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id oBMCTQ7C009351 for ; Wed, 22 Dec 2010 07:29:26 -0500 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB2.xchange.nist.gov ([129.6.18.19]) with mapi; Wed, 22 Dec 2010 07:29:18 -0500 From: "Sriram, Kotikalapudi" To: "sidr@ietf.org" Date: Wed, 22 Dec 2010 07:29:17 -0500 Thread-Topic: [sidr] I-D Action:draft-ietf-sidr-usecases-01.txt Thread-Index: AcuhaX2cLfcFVD8JTtmMnhmfHGnlaQAaHaZp Message-ID: References: <20101221234502.25909.34121.idtracker@localhost> In-Reply-To: <20101221234502.25909.34121.idtracker@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: kotikalapudi.sriram@nist.gov Subject: Re: [sidr] I-D Action:draft-ietf-sidr-usecases-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Dec 2010 12:27:36 -0000 Made changes in sub-sections 7.2.7 thru 7.2.11 (deleted the old and substituted new) to be consistent with consensus reached at the Beijing meeting regarding updates with AS_SETs. Made editorial improvements throughout the I-D, and added new wording in some places to improve on clarity. Updated all the references with the latest version numbers, etc. Added Warren Kumari's I-D in IDR WG on deprecation of AS_SETs as a reference and added text referencing it at the top of Section 7.2. Terry / Sriram / Russ W. ________________________________________ From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] On Behalf Of Internet-Drafts@ietf.org [Internet-Drafts@ietf.org] Sent: Tuesday, December 21, 2010 6:45 PM To: i-d-announce@ietf.org Cc: sidr@ietf.org Subject: [sidr] I-D Action:draft-ietf-sidr-usecases-01.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : Use Cases and interpretation of RPKI objects for issuers and relying parties Author(s) : T. Manderson, et al. Filename : draft-ietf-sidr-usecases-01.txt Pages : 24 Date : 2010-12-21 This document provides use cases, directions, and interpretations for organizations and relying parties when creating or encountering RPKI object scenarios in the public RPKI in relation to the Internet routing system. URLs for this Internet-Draft: http://tools.ietf.org/html/draft-ietf-sidr-usecases-01 http://www.ietf.org/internet-drafts/draft-ietf-sidr-usecases-01.txt From tim@ripe.net Wed Dec 22 07:10:43 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5FDF53A69F9 for ; Wed, 22 Dec 2010 07:10:43 -0800 (PST) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Improper folded header field made up entirely of whitespace (char 20 hex): X-RIPE-Spam-Report: ...al Points: -2.9 points\n \n pts rule nam[...] X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id La3w3j4qhXkg for ; Wed, 22 Dec 2010 07:10:41 -0800 (PST) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:610:240:11::c100:1342]) by core3.amsl.com (Postfix) with ESMTP id 637343A69EE for ; Wed, 22 Dec 2010 07:10:40 -0800 (PST) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1PVQMl-0007g4-0y for sidr@ietf.org; Wed, 22 Dec 2010 16:12:36 +0100 Received: from timbru.vpn.ripe.net ([193.0.21.62] helo=guest82.guestnet.ripe.net) by ayeaye.ripe.net with esmtp (Exim 4.72) (envelope-from ) id 1PVQMk-0000M4-MB for sidr@ietf.org; Wed, 22 Dec 2010 16:12:34 +0100 Message-ID: <4D121562.9020302@ripe.net> Date: Wed, 22 Dec 2010 16:12:34 +0100 From: Tim Bruijnzeels User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7 MIME-Version: 1.0 To: sidr@ietf.org References: <4D10B5F3.5050106@ripe.net> In-Reply-To: <4D10B5F3.5050106@ripe.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07197333886d25ffc5554cac470dba4a4f2b X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07197333886d25ffc5554cac470dba4a4f2b Subject: Re: [sidr] Probable bug in rsync and non-normative file names in repo doc X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Dec 2010 15:10:43 -0000 On 12/21/10 3:13 PM, Tim Bruijnzeels wrote: > There seems to be bug in rsync when you try retrieve a single file that > start with a '-' (minus) character ('-' is part of the file system safe > base64 set). It seems this is related to the rsync daemon > implementation, but we have not yet followed up with the rsync > mailinglist (could not find anything in bugtracker): We did some more testing and as it turns out this problem only occurs when a file starting with '-' is in the top of the repository: /Users/tim $ rsync --list-only 'rsync://xxxx/repository/-fails' rsync: connection unexpectedly closed (0 bytes received so far) [receiver] rsync error: error in rsync protocol data stream (code 12) at /SourceCache/rsync/rsync-40/rsync/io.c(452) [receiver=2.6.9] /Users/tim $ rsync --list-only 'rsync://xxxx/repository/rsync-bug/-works' -rw-r--r-- 218 2010/12/22 10:11:12 -works I raised the issue on the rsync list. I can let this list know if it gets resolved.. In the meantime you may still want to avoid having '-' as a starting character, especially for your TA since everyone will try to download that direct. Other, probably better, work-around is to make sure that you don't publish to the actual top of the repository as configured in rsyncd.conf, but one directory below. This is better as discarding one in 64 keys essentially degrades security.. it's not really 2048 bit that way.. Cheers Tim From tim@ripe.net Wed Dec 29 02:29:30 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B92C53A68B0 for ; Wed, 29 Dec 2010 02:29:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q8wE8+Sbh+0K for ; Wed, 29 Dec 2010 02:29:30 -0800 (PST) Received: from postlady.ripe.net (postlady.ipv6.ripe.net [IPv6:2001:610:240:11::c100:1341]) by core3.amsl.com (Postfix) with ESMTP id 3791F3A67B3 for ; Wed, 29 Dec 2010 02:29:29 -0800 (PST) Received: from ayeaye.ripe.net ([193.0.23.5]) by postlady.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1PXtJb-0005XO-Uo for sidr@ietf.org; Wed, 29 Dec 2010 11:31:33 +0100 Received: from dhcp184.ripe.net ([193.0.1.184]) by ayeaye.ripe.net with esmtp (Exim 4.72) (envelope-from ) id 1PXtJb-0006gO-H8 for sidr@ietf.org; Wed, 29 Dec 2010 11:31:31 +0100 Message-ID: <4D1B0E03.2060702@ripe.net> Date: Wed, 29 Dec 2010 11:31:31 +0100 From: Tim Bruijnzeels User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7 MIME-Version: 1.0 To: sidr@ietf.org References: <4D10B5F3.5050106@ripe.net> <4D121562.9020302@ripe.net> In-Reply-To: <4D121562.9020302@ripe.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719c82b60a1451b5247de452ac1b31a3aa8 X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719c82b60a1451b5247de452ac1b31a3aa8 Subject: Re: [sidr] Probable bug in rsync and non-normative file names in repo doc X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Dec 2010 10:29:30 -0000 Hi, update as promised.. On 12/22/10 4:12 PM, Tim Bruijnzeels wrote: > I raised the issue on the rsync list. I can let this list know if it > gets resolved.. it's not 100% clear to me whether the problem is client side or server side, but it's _somewhere_ in the communication between the two. Word on the wire is that it may be fixed, but there is no ETA. Having said that. In the RPKI one cannot really be sure that everyone will be using the latest rsync versions for their validators / repositories. So I am not sure if a fix will really help operations.. There is however another work-around that will work: just prefix ./ in front of any file starting with '-': rsync://host/repository/-file becomes: rsync://host/repository/./-file and then it does work. It's not a problem do the same for deeper levels: rsync://host/repository/sub/-file becomes: rsync://host/repository/sub/./-file since you can't be sure in general as RP whether /repository or /repository/sub is the actual top of the repo. We will update our validator to do this. Other validators that fetch individual files (eg a trust anchor referred to in a tal) may want to do something similar. Cheers Tim From Internet-Drafts@ietf.org Fri Dec 31 13:00:04 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2A0263A693C; Fri, 31 Dec 2010 13:00:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.527 X-Spam-Level: X-Spam-Status: No, score=-102.527 tagged_above=-999 required=5 tests=[AWL=0.072, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tI87E2fY4eAV; Fri, 31 Dec 2010 13:00:02 -0800 (PST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5A0393A6874; Fri, 31 Dec 2010 13:00:02 -0800 (PST) MIME-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 3.10 Message-ID: <20101231210002.20816.65811.idtracker@localhost> Date: Fri, 31 Dec 2010 13:00:02 -0800 Cc: sidr@ietf.org Subject: [sidr] I-D Action:draft-ietf-sidr-signed-object-02.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Dec 2010 21:00:04 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : Signed Object Template for the Resource Public Key Infrastructure Author(s) : M. Lepinski, et al. Filename : draft-ietf-sidr-signed-object-02.txt Pages : 12 Date : 2010-12-31 This document defines a generic profile for signed objects used in the Resource Public Key Infrastructure (RPKI). These RPKI signed objects make use of Cryptographic Message Syntax (CMS) as a standard encapsulation format. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sidr-signed-object-02.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-sidr-signed-object-02.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2010-12-31125339.I-D@ietf.org> --NextPart-- From mlepinski@bbn.com Fri Dec 31 13:02:16 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4848B3A681E for ; Fri, 31 Dec 2010 13:02:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JeeOBSe0ZCjC for ; Fri, 31 Dec 2010 13:02:15 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by core3.amsl.com (Postfix) with ESMTP id 848C93A6817 for ; Fri, 31 Dec 2010 13:02:15 -0800 (PST) Received: from [128.89.252.180] (port=2386) by smtp.bbn.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.71 (FreeBSD)) (envelope-from ) id 1PYm97-0005Mg-Er for sidr@ietf.org; Fri, 31 Dec 2010 16:04:21 -0500 Message-ID: <4D1E4563.8000101@bbn.com> Date: Fri, 31 Dec 2010 16:04:35 -0500 From: Matt Lepinski User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7 MIME-Version: 1.0 To: sidr@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [sidr] New Version : draft-ietf-sidr-signed-object-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Dec 2010 21:02:16 -0000 In response to comments received during the November WGLC, the authors have submitted a new version of draft-ietf-sidr-signed-object The new version contains the following changes: ** Changed the list in Section 4 of the document to address Geoff's concern. In particular, the list is now three items long (previously was four) and the new text makes it clear that a specification for an object that uses the signed-object profile MUST specify only one OID to identify the content type. (However, this single OID is used in two places in the signed-object profile.) ** Removed the requirement that a particular ASN.1 version number syntax in the encapsulated content (in response to Rob's comment). It is RECOMMENDED that signed object contents include some form of version number but no particular syntax is specified. ** Fixed a couple of nits, must notably in the bibliography [Thanks Sean] The authors believe that this new version addresses all of the issues raised during WGLC. - Matt Lepinski From sra@hactrn.net Fri Dec 31 13:12:33 2010 Return-Path: X-Original-To: sidr@core3.amsl.com Delivered-To: sidr@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6BC443A6821 for ; Fri, 31 Dec 2010 13:12:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ARtlOLXMa24k for ; Fri, 31 Dec 2010 13:12:32 -0800 (PST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [IPv6:2002:425c:4242:0:210:5aff:fe86:1f54]) by core3.amsl.com (Postfix) with ESMTP id 873533A681E for ; Fri, 31 Dec 2010 13:12:32 -0800 (PST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id E1E8528441 for ; Fri, 31 Dec 2010 21:14:35 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 63F2422829 for ; Fri, 31 Dec 2010 16:14:35 -0500 (EST) Date: Fri, 31 Dec 2010 16:14:35 -0500 From: Rob Austein To: sidr@ietf.org In-Reply-To: <4D1E4563.8000101@bbn.com> References: <4D1E4563.8000101@bbn.com> User-Agent: Wanderlust/2.14.0 (Africa) Emacs/21.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20101231211435.63F2422829@thrintun.hactrn.net> Subject: Re: [sidr] New Version : draft-ietf-sidr-signed-object-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Dec 2010 21:12:33 -0000 This version addresses my concern. Thanks, Matt. I would now urge Randy to remove the no-longer-mandated ASN.1 wrapper from the eContent specification in section 5 of the Ghostbusters Record draft, so that we can use off-the-shelf tools to parse both the Ghostbusters Record and its encapsulated content.