Subject: [sidr] EE cert to RTR

From: "Jakob Heitz (jheitz)" <[email-masked]>
Date: Sat, 21 Jan 2017 00:54:59 +0000

Is there a protocol to get the public key in an EE cert to the router?
Something like https://tools.ietf.org/html/rfc6810
needed to verify BGPSEC signatures.

Thanks,
Jakob.

---

From: "Jakob Heitz (jheitz)" <[email-masked]>
Date: Sat, 21 Jan 2017 00:59:14 +0000

Found it.
https://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-rfc6810-bis-08

Thanks,
Jakob.

From: sidr [mailto:[email-masked]] On Behalf Of Jakob Heitz (jheitz)
Sent: Friday, January 20, 2017 4:55 PM
To: [email-masked]
Subject: [sidr] EE cert to RTR

Thanks,
Jakob.

---

From: Randy Bush <[email-masked]>
Date: Sat, 21 Jan 2017 11:55:26 +0900

> https://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-rfc6810-bis-08

dragon research labs software supports it.  drl relying party cacheware
fully supports 6810-bis.  and the drl CA gooey has the router cert
functions you need to create the router certs.

and i presume the two test bgpsec implementations have some way of
generating router certs which you can then use with any relying party
cacheware which supports 6810-bis.

randy

---

From: Michael Baer <[email-masked]>
Date: Wed, 25 Jan 2017 10:47:09 -0800

>>>>> On Sat, 21 Jan 2017 11:55:26 +0900, Randy Bush <[email-masked]> said:

    >> https://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-rfc6810-bis-08
    RB> dragon research labs software supports it.  drl relying party cacheware
    RB> fully supports 6810-bis.  and the drl CA gooey has the router cert
    RB> functions you need to create the router certs.

    RB> and i presume the two test bgpsec implementations have some way of
    RB> generating router certs which you can then use with any relying party
    RB> cacheware which supports 6810-bis.

And the presumption is correct.  Both the BGPsec for Bird and the
BGP-Srx implementations can generate key pairs and I believe both
implementations (although I can only speak about the BGPsec on BIRD
implementation authoritatively) have support for the RPKI-RTR protocol
for delivering public keys to the router.

-Mike

-- 
Michael Baer
[email-masked]