On Mon, Sep 21, 2009 at 10:41:58AM -0400, Sandra Murphy wrote: > We decided way back that the authorization to originate a route to a > prefix must come from the prefix holder. And that identification of > a prefix holder comes from the entity that allocated the prefix.
Who is the “We” in this case? If it is the working group, then I
suggest that a broader consensus is required.
The problem with hierarchies is that people then assume that they are
strict. The guy “higher up” is “in charge” and the guy lower down can
do nothing but accept what is promulgated. In the real world, things
are quite different. Sure, allocations are initially made by an
appropriate registry. However some allocations pre-date the existing
registration system and exactly where they sit is unclear. Then there
are business disputes that always occur. My point is that adding RPKI
can change the dynamics of these interactions, and not necessarily in
a good way.
I believe we need a solution which provides “security” against bad
actors while minimizing the impact on the business dynamics.
I purposely didn’t propose a solution, but I can...
Perhaps the RPKI CA’s should explicitly *not* be the registration
authorities (or perhaps they can be, but that there should also be a
non-affiliated CA that can issue trusted certificates).
Much like it is today with web site certificates. The CA’s do *not*
have to be the DNS registrars for the domain name. Instead the CA uses
WHOIS data to determine if it is appropriate to issue a particular
certificate. Similarly an RPKI CA can consult WHOIS data (or radb
data) to determine the information it needs to issue a certificate.
In this fashion if a dispute happens between the registration
authority and the customer, the registration authority cannot use
certificate revocation (or failure to renew a certificate) as a “tool”
to enhance its negotiating position. Keep in mind that just because an
organization is a registration authority, doesn’t mean that in a given
dispute it is “right” automatically! As Hagrid said: “Not all wizards
are good!” (sorry, couldn’t help myself :-) ).
-Jeff
P.S. I am not claiming that the solution I propose is the only one, or
even the best one, but I believe it impacts the business relationships
between the registration authorities and their customers less then if
the registration authorities were also the CA’s (or otherwise in a
position to fail to renew a certificate or revoke an existing
certificate).
--
========================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email protected]
========================================================================
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
