Subject: Re: [Sidrops] draft-kwvanhove-sidrops-rpki-tree-hints-01

From: Ties de Kock <[email-masked]>
Date: Thu, 3 Feb 2022 17:26:57 +0100

> On 13 Dec 2021, at 17:00, Ties de Kock <[email-masked]> wrote:
> 
> 
> Hi Koen,
> 
>> On 13 Dec 2021, at 16:36, Koen van Hove <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Dear all,
>>  
>> Based on your feedback I hereby present the second version of the tree hints draft [1]. 
>>  
>> Russ Housley rightly pointed out to me that whilst additional fields cannot be added to the PKIX certificate profile, non-critical extensions can be added. I believe adding the hints to the certificate directly, rather than using a separate object, reduces operational complexity, might simplify some issues with “what if the limits change” (as that now only happens when the certificates change). I hope it also makes the political problem less troubling. Additionally, I reduced the limits to the two main ones, although others can be added in a similar fashion. Apart from that, the main concept was left unchanged.
> 
> That is a significant realisation. I think this will need some testing to see
> what implementations are intolerant to additional extensions, but that should be
> quick --- but if this works, this is much easier to implement, both for RPs and
> CAs.
> 
> This also specifies the exceptions much more naturally :).

Recent versions of Fort, OctoRPKI, routinator, rpki-client, rpki-prover, and
rpstir2 accepted non-critical certificate extensions on a CA certificate during
interoperability testing.

The RIPE NCC RPKI Validator 3 was not tested but should also accept such
certificates. Due to the lack of a testing environment, rpstir, and rcynic were
not tested.

This means we have a limited but interoperable path to extend resource
certificates.

Kind regards,
Ties

---
> 
> Kind regards,
> Ties
> 
> ---
>>  
>> Koen van Hove
>>  
>> [1] https://datatracker.ietf.org/doc/draft-kwvanhove-sidrops-rpki-tree-hints/ <https://datatracker.ietf.org/doc/draft-kwvanhove-sidrops-rpki-tree-hints/>_______________________________________________
>> Sidrops mailing list
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/sidrops <https://www.ietf.org/mailman/listinfo/sidrops>
> _______________________________________________
> Sidrops mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sidrops <https://www.ietf.org/mailman/listinfo/sidrops>