Subject: [sidr] I-D Action:draft-ietf-sidr-ta-04.txt

From: [email-masked]
Date: Wed, 12 May 2010 03:45:02 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF.

	Title           : A Profile for Trust Anchor Material for the Resource Certificate PKI
	Author(s)       : G. Michaelson, et al.
	Filename        : draft-ietf-sidr-ta-04.txt
	Pages           : 18
	Date            : 2010-05-12

This document defines a standard profile for the publication of Trust
Anchor material for the Resource Certificate Public Key
Infrastructure.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sidr-ta-04.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Terry Manderson <[email-masked]>
Date: Mon, 17 May 2010 22:34:24 -0700

> http://www.ietf.org/internet-drafts/draft-ietf-sidr-ta-04.txt

I have a question not specifically targeted at the content of the ID, but
related to it.

Are there any software releases that implement the compound trust anchor
given that the idea has been in document play (and presumably adopted as the
direction in the WG) since august '09?

If so, please email URLs.

Cheers
Terry

---

From: Stephen Kent <[email-masked]>
Date: Tue, 18 May 2010 15:50:34 -0400

>If so, please email URLs.

BBN's RPKI relying party software does.

I'll ask our development folks to send you a link.

Steve

---

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 20 May 2010 10:00:13 +0200

Hi Terry,

> If so, please email URLs.

We have a 'work-in-progress' implementation here:
rsync://certrepo.ripe.net/certeta/CN=ETA,O=RIPE%20NCC,C=NL.cer

It is not following spec currently:
- we have multiple RTACMS objects
- we have a manifest
- we use the 'RTA' as the production certificate for the test RPKI

We plan to revise this over the next month or so and do a new release
that should be in line with the current draft:
- One RTACMS object
- True compound, have the RTA part sign our production cert
- No more manifest

.. and possibly other modifications in case we missed something -- we
plan to double check this ourselves of course, but your feedback is welcome.

Our validator also handles our current, off-spec, implementation of the
compound trust anchor, but is currently only available to members that
participate in our test programme. We plan to make this validator
available to a wider public as well (and update its compound TA
handling). If people on this list are interested I can make sure we send
a ping to this list when it's available.

Cheers,
Tim

Senior Software Developer
RIPE NCC