Speaking as regular ol' member
On Sat, 1 Oct 2011, Randy Bush wrote:
a (let's assume dual homed) leaf site does not have to do much for
bgpsec. their upstreams validate, so they do not have to. all they
have to do is sign their announcement. we refer to this as a
'simplex' site, they announce signed but do not accept signed data, do
not hold any key or cert other than their own, ... cool result is
that current leaf site hardware could do this, no upgrade. so, for my
simplex lazy customer, yes i gen the bgpsec router key for them, and
they or i stuff it in their router.
< side discussion >
cool hack 14.3: the router itself can gen the public/private key pair a
la ssh, the person configuring can extract the public key and send it to
the rpki goddesses to be signed by the appropriate cert and put in the
rpki. the private key never leaves the router!
I believe that Steve Kent says that usually a certificate request is
required to present Proof Of Possession (of the private key). So just
discovering the public key somehow would not be sufficient to be able to
request a cert with that public key.
I await correction in quoting Steve.
--Sandy, speaking as regular ol' member
randy
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
