Subject: [sidr] EE certificates

From: Geoff Huston <[email-masked]>
Date: Wed, 3 Nov 2010 10:15:20 +1100

Hi

In revising the manifests draft the topic of single use and multi use certificates came up as a discussion topic between the draft's authors.

The sidr specs allow for two forms of use of EE certificates: one is perhaps a "conventional" use, where a EE cert can be used to validate any number of objects signed with digital signatures, without any particular restrictions on the number of such digitally signed objects that may be validated by this EE cert at any one time. The res-cert draft calls this forms of ee certs "multi-use" EE certs. The other form of use is a more restricted form of use of an EE certificate, where the EE cert may be used to validate the digital signature of only a single object at any one time. This form of use of an EE cert is called a "single-use" EE cert.

Single-use EE certs allow for the validity of a RPKI digitally signed object to be controlled by the validity of the associated single-use EE certificate.

There is no clearly defined use for multi-use EE certificates, other than a general intent to allow for some potential use of RPKI EE certs in a manner that is consistent with other PKIs. 

My co-authors of the manifest draft have proposed dropping the multi-use EE cert from the RPKI spec and leave only single-use EE certs. Before making this change to the sidr drafts that I'm editing, I'd like to check on the SIDR mailer whether anyone in the WG has a strong view that this would be the wrong thing to do. So if you have the view that it is preferable to keep multi-use EE certs in the spec, please speak up now, otherwise they will be removed in the next rev of the relevant drafts.

thanks,

    Geoff