RE: [ca-tf] Next steps & Write-up of the CA-TF kick-off meeting

["Vasily Dolmatov" <]

> 
> Current thinking is that those certificates only state that
> - resources listed in the extension have been allocated (and 
> that can be validated
> - the holder of the private key corresponding to the public 
> key in the certificate has right to use the resources.
> 
> This is explained in more detail in the Certificate Policy 
> that is being discussed in the IETF:
> http://www.ietf.org/internet-drafts/draft-ietf-sidr-cp-01.txt
> 
> In particular this document states:
> 
> "1.4.1. Appropriate certificate uses
> 
>    The certificates issued under this hierarchy are for authorization
>    in support of validation of claims of current holdings of address
>    space and/or AS numbers, e.g., for routing security. With regard to
>    routing security, an initial goal of this PKI is to allow 
> the holder
>    of a set of address blocks to be able to declare, in a secure
>    fashion, the AS number of each entity that is authorized to
>    originate a route to these addresses, including the context of ISP
>    proxy aggregation.  Additional uses of the PKI, consistent with the
>    basic goal cited above, are also permitted under this policy.
> 
>    Some of the certificates that may be issued under this hierarchy
>    could be used to support operation of this infrastructure, e.g.,
>    access control for the repository system. Such uses also are
>    permitted under this policy. "
> 
> Does this help in defining the goals?
Yes. This definitely leaves out of the scope of this project two words
"legal" and" hard", which are impossible to implement in the current state
of system.
Very well.


Let us turn to these two points outlined above.

I would like to look at current state of affairs with routing security:

Now, we have RIPE NCC database, containing routing objects, which can be
inserted or edited by LIRs in accordance with established hierarchy of
database mantainers.

Someone in the network, who is the holder of password of the correspondent
mantainer can perform some operations with routing objects.
Compare: Someone in the network, who is "the holder of private key
corresponding to the public key in the certificate has right to use the
resources"

Someone in the network, who is the holder of password of the correspondent
mantainer can perform some operations with resource objects, which are
allocated to this mantainer.
Compare: Someone in the network, who is .... have "resources listed in the
extension have been allocated"

What are the threats in the current procedures which are adressed by PKI
implementation and will be eliminated with it?

What are security weaknesses in the current procedures and why PKI will make
them performed in more "secure fashion"?

I cannot see any added security in PKI-based scheme if mantainers will be
changed with certificates. 
Please, show it to me (provided no "hard certificate system" will be set up
and and provided seed of certificates will be made through current LIR
portal).

I think that we can talk about "establishing PKI now in order to have means
for increasing security in the future (in 3-5 years), when procedures will
be changed appropriately".

Either I cannot note something obvious, please, enlighten me.


 dol@

> 
>

Attachment: smime.p7s
Description: application/pkcs7-signature