>> then create the subsidiary cert, ee cert, and roa for them. you will >> then have two certs, >> 10.0.0.0/16-16 >> 10.0.66.0/24-24 >> >> i call this the lazy customer. they probably pay me to one or more of >> provision the circuit, configure their cpe, ... i might as well >> provision their certs and roa. > > Will you sign his announcement too?
no, because we are talking origin validation, not bgpsec > If he doesn't implement sidr on all his routers yet, he will not sign > his announcements. first, 'sidr' is highly ambiguous. sidr is documenting three main technologies, rpki, rpki-based origin validation, and bgpsec. we were discussing the first two. second, origin validation and bgpsec can be partially deployed within an operator. this is one of the reasons they are blended into local policy, and do not force policy upon the operator. third, a (let's assume dual homed) leaf site does not have to do much for bgpsec. their upstreams validate, so they do not have to. all they have to do is sign their announcement. we refer to this as a 'simplex' site, they announce signed but do not accept signed data, do not hold any key or cert other than their own, ... cool result is that current leaf site hardware could do this, no upgrade. so, for my simplex lazy customer, yes i gen the bgpsec router key for them, and they or i stuff it in their router. randy _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
