<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="font-family: 'Segoe UI',Frutiger,'Frutiger Linotype','Dejavu Sans','Helvetica Neue',Arial,sans-serif; font-size: 14px;">
<div class="hiri-body-wrapper" contenteditable="true">
<div>Hi Alex,<br>
</div>
</div>
<div class="hiri-extra" contenteditable="true">
<p>On 2019-04-10 21:02:41+02:00 Alex Band wrote:</p>
<blockquote style="padding-left:10px; border-left:1px solid #ccc; margin:0">
<div>
<pre class="hiri-plaintext-quote">
&gt; This is most certainly a corner case, but is at least theoretically possible given that all RIRs claim 0/0 in their root certs.
Corner case or not, in my opinion it’s a very slippery slope to use such an example.
The RIRs have put in proper measures to make sure such a scenario doesn’t occur. For example, precisely for this reason the RIPE NCC have a more constrained “RIPE NCC Managed Resources” intermediate certificate in place, from which all Member Certificates are derived.
</pre>
</div>
</blockquote>
<br>
I'm not a fan of the default claims in the RIR root certs, and I'm not a fan of OOB workarounds that can't be verified cryptographically. My understanding is that this practise is in order to avoid re-issuing the root as the result of a transfer, but given
that the cert which a TAL points at can change (as long as the keypair is the same) without touching the TAL, I've never understood why this workaround was necessary.<br>
<br>
If you agree with the practise, I'm open to persuasion.<br>
<br>
If we're going to be stuck with disjoint per-RIR RPKIs forever, we (RPs) should at least be able to verify that they are disjoint!<br>
<br>
Cheers,<br>
<br>
Ben</div>
</body>
</html>