At 9:51 AM +1000 9/15/09, Terry Manderson wrote:
Hi John,
While I appreciate the work by Steve here to allow a relying party
to put on the rose coloured validation glasses, it is an inside view
looking out. That means is allows an organisation to locally say
what it believes is the RPKI view of the world irrespective of what
is said globally.
Terry,
I think you misunderstand the nature of trust anchors in PKIs. No
entity can force all relying parties adopt the entity as a TA,
period. The acceptance of a TA is always a local matter, if the
software is properly designed. For example, in most of my browsers I
can choose to remove the many self-signed CA certs that the browser
vendor has chosen to present to me as TAs. Only if the user (RP) is
forced to use software that fails to offer such choices does a third
party have an ability to impose it's view of who is and is not a TA.
This "sphere of influence" notion is applicable in some contexts, but
it is not applicable to all the ISPs in the world.
So, rather than characterizing the local TA management model that I
presented as "rose coloured validation glasses" I would say that it
is a realistic representation of what RPs ought to be able to do,
and what they will be able to do with the RP software that BBN will
make available in open source form.
So it certainly has its place - but doesn't address David's position
completely where an organisation, such as the UK government, might
wish to validly assert their own independent trust anchor for their
51/8 SIDR hierarchy and have the rest of the relying parties on the
internet collect it and validate routes against it.
The problem is that nobody, including the UK gov, can ensure that
every ISP in the world will recognize it as a TA, period. The sooner
folks get past tjis notion the faster we can have meaningful
discussions on this topic.
Steve
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
