> From an IETF perspective, if we want RPKI to be deployed, it is the > providers that have to be sold... and selling a system that causes > them to lose control (even to a small degree) of a service which is > essential to their core business, will be a difficult sell.
To some degree as v4 address space depletion continues providers holding smaller bits of address space may view the enhancements RPKI brings as a tool in the war on prefix hijacks. Although there is plenty of sense in aligning the RPKI chain of trust with the resource allocation chain, ISPs may have concerns with the RIRs being the trust anchors. The incentive structure for the RIRs is fundamentally different than that of a certificate provider like Verisign/Thawte/CyberTrust. If these trusted root CAs time and again demonstrate that they are untrustworthy they lose customers, revenue, and potentially their trusted status. What entices an RIR toward vigilance as they validate the supposedly authorized origin of a prefix? Ryan Shea Senior Engineer, Network and Info Security Verizon Business
signature.asc
Description: This is a digitally signed message part
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
