On Mon, 14 Sep 2009, Joel M. Halpern wrote:
Let me start by saying a couple of positive things:
1) In order to even start on securing this space, we are going to need some
sort of certificates
2) As far as I can tell, in order for the certificates to make any sense they
have got to be related to the hierarchy of address assignment. (Private
addresses are a different matter.
SO I do think the approach we are on is the right approach.
That's good.
But, Steve, I think you are misunderstanding the issue David Conrad raises.
(What follows is my understanding of what he pointed out, and I could also be
confused.)
If there is such a hierarchy, tehn, look at what happens from a leaf ISP down
the tree. They need to reliably be able to advertise their routes, and have
everyone trust their advertiseements if they sign with the key they
registered.
I'm not sure what you mean by "the key they registered".
When an ISP receives an address allocation, the allocater signs a cert
associating that address with a public key, and that public key can come
the ISP. Is that what you mean by "the key they registered"? The cert is
more a "registration" of the address than it is the registration of the
key.
Given the scope, this almost inherently requires that there be a single (or
may a small number of disjoint) starting point. Otherwise, receivers will
not have access to and trust of the chains.
But now turn it around. Suppose that ISP is unsure as to whether they
actually trust the hierarchy. Or even if they trust it now, they are
concerned that with a political change, they might not trust the situation
then. Yes, you can argue that the ISP can register with whomever they like.
But that is only useful if there is trust chain that other people believe
between them and that whomever.
What do you mean about not trusting the hierarchy? The RPKI hierarchy
represents the hierarchy of address allocation in a cryptographically
assured manner. Are you saying that at some point an ISP might not trust
the hierarchy by which it receives addresses?
I have difficulty conceiving of a (global) mechanism for allocating
addresses that would not be hierarchical. So I think that an ISP that
was not sure it trusted the address allocation hierarchy would be in a
difficult state.
I recognize that there is an fear that this system somehow puts ISPs under
someone's control. I would answer that there is not any more control than
is already the case.
We need to emphasize that the cryptography here is just improving the
assurance of address relationships that already exist.
If there start to be Cert-R-Us signers of RPKI certificates (so "the ISP
can register with whomever they like"), that statement will no longer be
true, which would be a very bad thing for the trust model. As you note.
--Sandy
This turns into a massive political and public relations pain.
Yep.
I don't know a better answer.
But ignoring this dimension of the deployment problem will not serve us well.
I agree whole-heartedly that we need to keep deployment in mind in all
our design!
Easing into the current operational practice is important, for one thing.
--Sandy
Yours,
Joel
Stephen Kent wrote:
At 9:51 AM +1000 9/15/09, Terry Manderson wrote:
Hi John,
While I appreciate the work by Steve here to allow a relying party to put
on the rose coloured validation glasses, it is an inside view looking out.
That means is allows an organisation to locally say what it believes is
the RPKI view of the world irrespective of what is said globally.
Terry,
I think you misunderstand the nature of trust anchors in PKIs. No entity
can force all relying parties adopt the entity as a TA, period. The
acceptance of a TA is always a local matter, if the software is properly
designed. For example, in most of my browsers I can choose to remove the
many self-signed CA certs that the browser vendor has chosen to present to
me as TAs. Only if the user (RP) is forced to use software that fails to
offer such choices does a third party have an ability to impose it's view
of who is and is not a TA. This "sphere of influence" notion is applicable
in some contexts, but it is not applicable to all the ISPs in the world.
So, rather than characterizing the local TA management model that I
presented as "rose coloured validation glasses" I would say that it is a
realistic representation of what RPs ought to be able to do, and what they
will be able to do with the RP software that BBN will make available in
open source form.
So it certainly has its place - but doesn't address David's position
completely where an organisation, such as the UK government, might wish to
validly assert their own independent trust anchor for their 51/8 SIDR
hierarchy and have the rest of the relying parties on the internet collect
it and validate routes against it.
The problem is that nobody, including the UK gov, can ensure that every ISP
in the world will recognize it as a TA, period. The sooner folks get past
tjis notion the faster we can have meaningful discussions on this topic.
Steve
------------------------------------------------------------------------
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
