> a (let's assume dual homed) leaf site does not have to do much for > bgpsec. their upstreams validate, so they do not have to. all they > have to do is sign their announcement. we refer to this as a > 'simplex' site, they announce signed but do not accept signed data, do > not hold any key or cert other than their own, ... cool result is > that current leaf site hardware could do this, no upgrade. so, for my > simplex lazy customer, yes i gen the bgpsec router key for them, and > they or i stuff it in their router.
< side discussion > cool hack 14.3: the router itself can gen the public/private key pair a la ssh, the person configuring can extract the public key and send it to the rpki goddesses to be signed by the appropriate cert and put in the rpki. the private key never leaves the router! randy _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
