Subject: [sidr] comments on draft-ymbk-sidr-transfer-01???

From: Sandra Murphy <[email-masked]>
Date: Thu, 8 Oct 2015 14:56:33 -0400

The draft draft-ietf-sidr-rpki-validation-reconsidered speaks forcefully of the potential for damage if a certificate over claims, i.e., claims more resources than its parent.  The draft discusses how that could result from a failure of timing in a transfer of resources.

In a presentation in the November 2014 IETF session on this topic, it was suggested that discussion of "a standard procedure for certificate management during resource transfer” and "current CA operational procedures for managing transfers” would help in the reconsideration of the validation algorithm.

A draft was submitted and discussed at the last meeting.  https://tools.ietf.org/html/draft-ymbk-sidr-transfer  But no comments have been received.

This is an important topic, folks, and deserves our attention.

Please do read the draft and comment.

—Sandy

---

From: Stephen Kent <[email-masked]>
Date: Thu, 8 Oct 2015 16:57:48 -0400

Sandy,

I provided detailed comments on this document on June 2.

Randy later said he didn't see them, so I resent (just to Randy) on July 7.

Steve

---

From: Geoff Huston <[email-masked]>
Date: Thu, 8 Oct 2015 17:45:00 -0400

> On 8 Oct 2015, at 2:56 PM, Sandra Murphy <[email-masked]> wrote:
> 

** or form any other form of a drop in precise synchronisation between the CA’s number resource database and the state of a CA’s issued certificates.

While I’m sure perfection is an admirable objective, snafus do occur, and another part of the motivation of the reconsidered document was to reduce degree of catastrophic result from certain forms of certificate issuance failure from one where all subordinate certificates cannot be validated to one that impacts only of the validation status relative to the resource that was placed in this inconsistent state.

i.e. validation reconsidered is not 1:1 isomorphic to just transfers, as you may have been led to believe from the next sentence...

> In a presentation in the November 2014 IETF session on this topic, it was suggested that discussion of "a standard procedure for certificate management during resource transfer” and "current CA ope…

regards,

   Geoff