I submitted a new version of the ROA format specification.
Based on working group discussion of appropriate signature and digest
algorithms for use with the RPKI, I removed all referenced to specific
algorithms from the ROA specification. Additionally, I added text making
it clear that signature and digest algorithms used in a ROA must be
consistent with the certificate policy referenced in the resource
certificate under which the ROA is issued. This concentrates all
discussion of appropriate algorithms into the certificate policy
document which is where (I believe) such discussion belongs.
If the working group finds this change to the ROA format document
acceptable, I will make an analogous change in the next version of the
RPKI Manifests document.
Additional changes include:
-- Attempted to make more explicit the following two facts:
---- ROAs will have only a single signature
---- A ROA may contain two prefixes such that first prefix completely
encompasses the second
-- Added appropriate references to discussion of time stamp signing
attributes
-- Attempted to make ROA validation procedure more clear
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
