speaking as a regular ol' member
On Sat, 1 Oct 2011, Randy Bush wrote:
cool hack 14.3: the router itself can gen the public/private key pair
a la ssh, the person configuring can extract the public key and send
it to the rpki goddesses to be signed by the appropriate cert and put
in the rpki. the private key never leaves the router!
I believe that Steve Kent says that usually a certificate request is
required to present Proof Of Possession (of the private key). So just
discovering the public key somehow would not be sufficient to be able
to request a cert with that public key.
dear dr nit pick,
when dealing with goddesses, one always frames things as a request
I am not at all sure what you mean.
Cautiously, I'll try to say what I meant again.
You say "the person configuring" could extract the public key and get a
cert created for that public key.
The request would have to be accompanied by Proof of Possesssion of the
private key - e.g., something like a signature might do.
Unless the "person configuring" has access to the private key on the
router, there would be no way to produce the Proof of Possession.
I read what you were suggesting as the customer router gen-ing the key
pair and the "person configuring" sitting at the provider, off-router.
Maybe you meant the provider was doing the configuration of the customer
router, in which case the provider would have access to the private key
for the proof of possession for the request.
(Of course, if the provider has that much access to the customer router,
the line blurs between the key-gen-ing happening on the provider side or
the customer side.)
--Sandy, speaking as regular ol' member
randy
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
