nanog mailing list archives
Re: [arin-announce] ARIN Resource Certification Update
From: Joe Abley <jabley () hopcount ca>
Date: Mon, 24 Jan 2011 21:02:00 -0500
On 2011-01-24, at 20:24, Danny McPherson wrote:
<separate subject> Beginning to wonder why, with work like DANE and certificates in DNS in the IETF, we need an RPKI and new hierarchical shared dependency system at all and can't just place ROAs in in-addr.arpa zone files that are DNSSEC-enabled.
In the case where (say) RIR allocates 10.0.0.0/8 to A A allocates 10.1.0.0/16 to B B allocates 10.1.1.0/24 to C there's a clear path of delegations in the DNS under IN-ADDR.ARPA from RIR -> A -> B -> C and this matches the chain of address assignments. If you adopt the convention that a secure delegation (a signed DS RRSet) is analogous to an RPKI signature over a customer certificate, then this seems vaguely usable. But what about this case? RIR allocates 10.0.0.0/8 to A A allocates 10.0.0.0/16 to B B allocates 10.0.0.0/24 to C In this case the DNS delegations go directly from RIR to C; there's no opportunity for A or B to sign intermediate zones, and hence no opportunity for them to indicate the legitimacy of the allocation. As a thought experiment, how would you see this working? Joe
Current thread:
- Re: [arin-announce] ARIN Resource Certification Update, (continued)
- Re: [arin-announce] ARIN Resource Certification Update Joe Abley (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Roland Dobbins (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Richard Barnes (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Randy Bush (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Danny McPherson (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Randy Bush (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Roland Dobbins (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Randy Bush (Jan 24)
- Message not available
- Re: [arin-announce] ARIN Resource Certification Update Randy Bush (Jan 27)
- Re: [arin-announce] ARIN Resource Certification Update Roland Dobbins (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Joe Abley (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Danny McPherson (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Richard Barnes (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Danny McPherson (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Christopher Morrow (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Steven Bellovin (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Christopher Morrow (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Roland Dobbins (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Christopher Morrow (Jan 24)
- Re: [arin-announce] ARIN Resource Certification Update Joe Abley (Jan 25)
- Re: [arin-announce] ARIN Resource Certification Update Roland Dobbins (Jan 25)