Subject: [sidr] Subject names wrt sidr-ta, sidr-arch

From: Terry Manderson <[email-masked]>
Date: Mon, 13 Apr 2009 12:38:04 +1000

All,

Currently in the sidr-arch draft the only RPKI certs that are  
meaningfully named belong to the originally issued party, ie IANA/RIR  
etc.

There seemed to be quite some interest @SFO in why these higher level  
certs are named. I spent some time talking to folk about the benefits  
and liabilities of meaningful names in rpki certs.

I seemed to collect more reason to not name the RPKI certs (ones that  
hold 3779 extns) across the board, than for the naming of them..

For meaningful names:
	Directly identifies the resource holder to any third party
	
For no meaningful names:
	CPS isn't constructed to do identity checks on the resource recipient
	Subordinate CAs may adopt a different CPS and make naming inconsistent
	ISPs may not want to identify their customers to others
	Concern over having RPKI certs used for non SIDR uses
	Not all organisations do their own routing, it may be valid for XYZ  
Widgets LLC to outsource routing, and Techy-Person Inc would be  
handling all rpki private key material.

(if you have others, please provide them)

So, in this light I would urge the authors to remove all requirements  
for ANY RPKI certs to be named, including the higher order RPKI certs.

This leads me to the sidr-ta draft. The ETA is not a RPKI cert. It  
signs the CMS blob that holds the RTA. If anywhere that naming may be  
important it would be the ETA. (visual inspection of who is saying  
that they have rights for 0/0 etc). So IANA might be named in the ETA,  
but it (nor any other org) should not be named in the RTA.

I'm reluctant to say that the ETA MUST have a meaningful name, but to  
err on the side of consistency for implementation I think it would  
have to be "MUST". Another option is to say "SHOULD" and then mandate  
it through policy process outside of the IETF frame.

Terry

---

From: Randy Bush <[email-masked]>
Date: Mon, 13 Apr 2009 12:36:32 +0900

> 	Directly identifies the resource holder to any third party

actually not.  note that, due to trademark rules
   Randy's Inviting but Peculiar Epicurian
can have the trade name RIPE which does not conflict with the one
on singelstraat

> for ANY RPKI certs to be named, including the higher order RPKI certs.

this change in the document certainly did not seem to have consensus in
the meeting, though sandy would be the one to judge that.

> This leads me to the sidr-ta draft.

wear a nose plug

randy

---

From: Terry Manderson <[email-masked]>
Date: Mon, 13 Apr 2009 13:44:38 +1000

> can have the trade name RIPE which does not conflict with the one

Fair point. :-)

> the meeting, though sandy would be the one to judge that.

perhaps it can be brought up for consideration again now, on the list,  
and represented in Stockholm given that some clarification is now  
underway.

>> This leads me to the sidr-ta draft.

I don't swim ;-)

Terry

---

From: Heather Schiller <[email-masked]>
Date: Mon, 13 Apr 2009 11:14:21 -0400

Terry Manderson wrote:
> meaningfully named belong to the originally issued party, ie IANA/RIR etc.
> 

We already "identify our customers to others" publicly today with 
SWIP... most RIR's require SWIP/RWHOIS when you assigned/allocate a 
netblock over a particular size.  Not sure I understand why an ISP that 
is already required to publicly register a netblock of a given size 
today, would have a problem with this?

> Widgets LLC to outsource routing, and Techy-Person Inc would be handling 
> all rpki private key material.
> 
> 
> This leads me to the sidr-ta draft. The ETA is not a RPKI cert. It signs 
> the CMS blob that holds the RTA. If anywhere that naming may be 
> important it would be the ETA. (visual inspection of who is saying that 
> they have rights for 0/0 etc). So IANA might be named in the ETA, but it 
> (nor any other org) should not be named in the RTA.
> 
> err on the side of consistency for implementation I think it would have 
> to be "MUST". Another option is to say "SHOULD" and then mandate it 
> through policy process outside of the IETF frame.
> 
> Terry
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: Terry Manderson <[email-masked]>
Date: Tue, 14 Apr 2009 08:44:06 +1000

Hi Heather,

On 14/04/2009, at 1:14 AM, Heather Schiller wrote:

> netblock over a particular size.  Not sure I understand why an ISP  
> that is already required to publicly register a netblock of a given  
> size today, would have a problem with this?

APNIC has a privacy policy:
Proposal prop-007: Privacy of customer assignment records
http://www.apnic.net/policy/proposals/prop-007-v001.html

It varies from region to region.

Terry

---

From: Randy Bush <[email-masked]>
Date: Tue, 14 Apr 2009 08:52:24 +0900

> SWIP

some do.  some don't.

randy

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 16 Apr 2009 11:57:50 -0400 (EDT)

> 	Subordinate CAs may adopt a different CPS and make naming 
...
> So, in this light I would urge the authors to remove all 
> requirements for ANY RPKI certs to be named, including the higher 
> order RPKI certs.

I concur.

As convenient as is surely would be to have meaningful names for IANA 
and the RIRs, there's nothing eventiny another entity from issing 
certs with those names, and surely some tools will be written that 
check the names rather than the keys.  Let's not lead the tool writers 
into such temptation.

-- Sam

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 16 Apr 2009 12:14:20 -0400 (EDT)

> As convenient as is surely would be to have meaningful names for 
> IANA and the RIRs, there's nothing eventiny another entity from ...

nothing "preventing", that is.