question about Mark Koster's ARIN presentation
Randy Bush
randy at psg.com
Tue Jun 30 01:50:24 UTC 2009
>> We are using the same code that RIPE is using at http://certtest.ripe.net.
>> RIPE has been very kind to allow us to use their code. As for ARIN,
>> this is a pilot and is certainly not a final fixed-feature set. The
>> first go of this is the "hosted" solution where an ISP can come into
>> ARIN's pilot and create ROAs based off of allocations that they
>> have received from ARIN.
>>
>> All the ROAs will be placed into a rsync repository that can be retrieved
>> and validated. Specifically, here are the features that are a part of the
>> system:
>>
>> * Enables ARIN resource holders to request certificates for their IPv4 and
>> IPv6 Provider Aggregatable (PA) resources
>> * Enables ARIN resource holders to manage Route Origin Authorizations (ROAs)
>> for their PA address space
>> * Provides a public repository of certificates and ROAs
>> * Handles key rollovers and revocations
>
> the simple version of the question: who holds my private key(s)?
i guess the answer is ARIN does. not very private are they.
> the longer version: does this implement my having my own subsidiary CA
> with it communiciating with ARIN's and RIPE's ... using the protocols of
> the ietf sidr work?
i guess not.
so how do i, a transit provider arin member, get certs and roas for my
downstream multi-homed customers?
randy
More information about the NANOG
mailing list