<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Erik,<br class=""><br class="">Publish in Parent does require its users to have a valid RPKI certificate for a delegated CA in order to be able to publish objects in it. That could either be a member, a PI holder (with a sponsoring LIR) or legacy holders with a contract relationship. A user can also create other publication points, for example for CAs of business units, or a (grand)child CA.<br class=""><br class="">In other words, in order to use the system, you either have to have a contract relationship with the RIPE NCC, be associated with a sponsoring LIR or have access delegated to you from one of these.<br class=""><br class="">Allowing SSO accounts without one of the above conditions would open the door to abuse, as it would be difficult, if not impossible, to track down users abusing the system.<br class=""><br class="">I hope that clarifies your queries, otherwise I am happy to elaborate further.<br class=""><br class="">Kind regards,<br class="">Felipe<br class=""><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 6 Oct 2022, at 14:56, Erik Bais <<a href="mailto:ebais@a2b-internet.com" class="">ebais@a2b-internet.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="NL" class="">HI Felipe, <o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="NL" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Could you provide some insight on how the authorization for the PiP system is envisioned ? <o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">We have been discussing that the PiP implementation is planned for RIPE members, which to my view would mean that PiP is only available for LIR’s in good standing. <o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">That would also mean that if you are not an LIR anymore, that you lose the ability to upload objects ( correct ? )<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Or .. is the authorization linked to a RIPE NCC SSO account, ( which is free…) and it will also be available for RIPE PI space holders or legacy space holders ..<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">I would say that it would be better for the community to have the authorization for this with a free to setup NCC SSO account, as those don’t need to be linked to a LIR .. and it will allow for less issues if the LIR closes for some reason . . .<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="NL" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">I would also think that if someone would like to use the publication point, it should have something to do with some RIPE resource …<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Looking forward to your reply, <o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Regards,<br class="">Erik Bais<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class=""><o:p class=""> </o:p></span></div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="font-size: 12pt;" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;" class="">routing-wg <<a href="mailto:routing-wg-bounces@ripe.net" class="">routing-wg-bounces@ripe.net</a>> on behalf of Felipe Victolla Silveira <<a href="mailto:fvictolla@ripe.net" class="">fvictolla@ripe.net</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Thursday, 29 September 2022 at 16:15<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>"<a href="mailto:routing-wg@ripe.net" class="">routing-wg@ripe.net</a>" <<a href="mailto:routing-wg@ripe.net" class="">routing-wg@ripe.net</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>[routing-wg] Publish in Parent - input requested<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="" class="">Dear all,<br class=""><br class="">As some of you are aware, the RIPE NCC has been working on a new service for RPKI, called Publish in Parent. This service is intended for RPKI users who have chosen to run their own Certificate Authority (delegated RPKI) but don’t want to take the burden of maintaining a highly available publication point. By using this service, it will be possible for our members with delegated RPKI to publish their signed RPKI objects in the RIPE NCC repositories (RRDP and rsync) instead of maintaining their own.<br class=""><br class="">Following a discussion with the Executive Board in our meeting last June, we would like to ask our community for input on the requirements for this service. The service was originally designed to allow all objects to be published in our repositories, regardless of whether the associated resources are part of the RIPE NCC or another RIR, and this is how we would like to proceed. However, it has been argued that there should be a restriction in this service so that it allows only RIPE NCC resources to be published and not resources belonging to a different RIR.<br class=""><br class="">If you are potential user of this service, what are your expectations for its functionality? Do you want to be able to publish all your objects in RIPE NCC repositories, regardless of whether they are from the RIPE NCC or not? Or will you publish each object in the corresponding RIR repositories? Please note that we are only talking about publication. The objects out of region will be signed with their own parent certificate.<br class=""><br class="">If you are a developer of one of the Relying Party softwares, will the presence or absence of such a restriction impact your software package in any way? Do you expect the need to make changes, depending on the direction this takes?<br class=""><br class="">To make informed decisions on how we should progress with Publish in Parent, we need input from potential users of the service. Please reply with your feedback until 14 October so we can incorporate it in our planning and inform you about our progress at RIPE 85.<br class=""><br class="">Kind regards,</span><o:p class=""></o:p></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="" class=""><br class=""><br class=""></span><o:p class=""></o:p></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="" class="">Felipe Victolla Silveira</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="" class="">Chief Operations Officer</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="" class="">RIPE NCC</span></div></div></div></div></div></blockquote></div><br class=""></div></body></html>