On Oct 7, 2009, at 8:14 PM, Terry Manderson wrote:
But that's not what I said - I said to make this work you'd
have the EE ("owner") issue two ROAs, one for each origin -
yes. but predicated on one owner and not two. I think we are at the
same
place :-)
Yep, and one minor clarification here to the above: Because
there's a one-one mapping between EE certs and ROAs the
resource holder would have to issue an EE & ROA (or resource
cert and expect the recipient to issue their own EEs and ROAs
for the prefix(es), if the operator wants to loosen things up
a bit during transitions) for each prefix/origin pair) -- but
there's still only one "owner" (resource holder) at any instant
-- even though there may be multiple ASes originating a given
prefix (or subsets).
yes.. I think I must have misinterpreted your direction, I thought
you were
wanting overlapping validity.
Nope..
The issue of handling "staged ROAs for transition" and subsequent
pollution in an automated RPKI will be interesting, that's for sure..
-danny
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
