In reviewing the repository structure draft, I was looking at the manifest
draft to see if it answered some of my questions. I came up with the
following comments on the manifests draft. This doesn't imply that I've
done a full review of the manifest draft.
These comments are made strictly as working group member. I do not make
these comments as wg chair. Wg chair hat off.
comments on draft-ietf-sidr-rpki-manifests-05.txt
(1) Multiple manifests
It appears to me that the algorithm described in the manifest document:
3. Check that every file at the publication point appears in one and
only one manifest, and that every file listed in each manifest
appears at the publication point.
implies that the union of the manifests matches the union of the objects
at the publication point. So if multiple CAs publish in the same
publication point, one manifest might list some of the objects produced by
one CA and some of the objects produced by another, as long as another
manifest associated with the other CA includes all the other objects
produced by that CA.
I don't think that is the intent. I thought a manifest was specific to
one CA and listed all that CA's objects but no other CA's objects. Other
language in the document says that a manifest contains objects associated
with one CA. But this is the definitive text, and it would be good to
have it precise.
(2) Manifests
The document says that multiple CAs might publish objects in the same
publication point. Manifests are supposed to list all objects produced by
one CA. If there is just one CA publishing in a publication point, that's
easy - retrieve all files from that publication point and compare to the
manifest.
If there are several CAs that publish to one publication point, what is
the algorithm for the manifest to be checked? I'd guess:
download all objects from publication point
sort them out by which CA issued them or issued the EE that signed them
pick the group that is associated with the CA that issued the EE that
signed the manifest.
check the manifest listing against that group
Would it be good to actually mention this? (Presuming it is correct.)
--Sandy
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
