Subject: [sidr] draft-ietf-sidr-ta-02: comment on ETA EE revocation

From: Andrew Chi <[email-masked]>
Date: Tue, 16 Feb 2010 16:22:29 -0500

While implementing the "compound trust anchor structure" described in 
draft-ietf-sidr-ta-02, we noticed that some semantics were not 
explicitly stated, so a couple of us implementers were not 100% certain 
of the correct behavior.

This following is clear.  The compound TA structure consists of:
1. An ETA ("external TA") CA cert without RFC 3779 extensions.
2. A single ETA EE cert without RFC 3779 extensions.
3. A CRL for revoking the ETA EE cert.
4. An RTA ("RPKI TA") cert with RFC 3779 extensions, which is contained 
inside a CMS blob signed by the ETA EE cert.

The clearly stated intent is to allow the RTA to be replaced relatively 
frequently due to changes in the resource holdings encoded into the 
RTA's 3779 extensions.  The ETA CA cert can remain the long-term trust 
anchor.

I believe the following was also intended (but it was not 100% clear): 
if either the ETA CA cert expires or the ETA EE cert is revoked, then 
the RTA must also be considered invalid.  That is, the relationship 
between the ETA EE certificate and the RTA is a full "issuer-subject" 
relationship, not simply a secure delivery mechanism.

If that's true, could a sentence be added that states it explicitly?

Thanks,

Andrew Chi
BBN