On 2/03/2011, at 10:18 PM, Andy Linton wrote:

So what does this say about the potential introduction of rPKI

Good question. I understand the ideas behind it, but I've yet to see much in the way of implementation, even a useful description of how what a router would need to do, and the performance impacts of RPKI. What with the coming trading of v4 address-space, I think something like RPKI is important... but I agree with Matthew that is too late. This sort of thing needed to be present in router hardware when people were doing their v6-capable hardware refresh. Although, it seems entirely practical that a bolt-on solution could easily be accomplished in software, by handing off the certificate validation to some other server and letting it do the work. Cheers, Cameron Kerr