Subject: [sidr] sidr-origin-ops-09

From: "George, Wesley" <[email-masked]>
Date: Wed, 25 May 2011 15:54:06 -0400

I'm not sure if this is a nitpick or a legitimate concern, but:

"Use of RPKI-based origin validation removes any need to originate
   more specifics to protect against mis-origination of a less specific
   prefix.  Having a ROA for the covering prefix should protect it."

I'm not sure I totally agree with this. Sure, with a relatively complete implementation among major networks, coupled with some sane policies in how those networks deal with invalid routes, that is basically true. However, in an incremental deployment model, it's a little overly optimistic.

Perhaps some sort of caveat about incremental deployment and policy is appropriate here?

Off of the top of my head-
"As it is deployed in more and more networks, use of RPKI-based origin validation coupled with appropriate policies to handle invalid announcements will lessen (and hopefully eliminate?) the need to originate more specifics..."

Thanks
Wes George

________________________________
This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

---

From: Randy Bush <[email-masked]>
Date: Wed, 25 May 2011 22:30:23 +0200

>    more specifics to protect against mis-origination of a less
>    specific prefix.  Having a ROA for the covering prefix should
>    protect it."
> 
> I'm not sure I totally agree with this. Sure, with a relatively
> complete implementation among major networks, coupled with some sane
> policies in how those networks deal with invalid routes, that is
> basically true. However, in an incremental deployment model, it's a
> little overly optimistic.
> 

sure.  i'll add some text next pass.  thanks.

randy