On 4 May 2011, at 17:24, Brian Nisbet wrote:
You seem to be imagining a scenario where a national governement would just ring up the NCC and say, "revoke these certs." I have seen no evidence to suggest this risk is anything close to real.
I suppose this depends on the definition of "real" and "evidence" Brian. If the NCC gets told to revoke a cert -- eg via a Dutch court order or equivalent -- it will have to do that. It would be sensible to assume that well-funded and/or litigious organisations might well be minded to pursue that avenue if they think getting a cert revoked will either disrupt or shut down some activities they dislike. Or bury their opponents in legal costs before it gets to the point where a court order gets issued. Certificates for routing will provide another vector for these sorts of layer-9 and up attacks. IMO it's foolish to assume or pretend otherwise. There are parallels with existing "control" mechanisms that governments and others use to restrict access to illegal content (for some definition of illegal content). If another control mechanism is made available, it will be used: that's the nature of the beast. [In this context RPKI has that control property as a side-effect.] Assuming that it won't or suggesting there's no real risk is just not credible, sorry. And from a practical perspective, is there really a material difference between a blacklist of naughty IP address blocks (commonly used today) and address blocks that have revoked certs (probably commonly used tomorrow) as control mechanisms? Personally, I'm not too fussed by this. The bad guys are not likely to be forming an orderly queue to get their certs from the NCC. And I think/hope the Dutch courts would take a robust view when governments or the Scientologists come looking for a court order. But in the final analysis, I struggle to see how an RPKI cert revocation would be any different from adding a prefix to the "official" blacklist that ISPs are encouraged to implement today. PS: Apologies for changing the Subject: header to something meaningful.