Subject: [sidr] RFC 3779 and its relationship to Geoff's proposal

From: Stephen Kent <[email-masked]>
Date: Fri, 02 Aug 2013 08:48:54 -0400

The relevant text from 3779 is copied below, and underlined.

2.3.  IP Address Delegation Extension Certification Path Validation

    Certification path validation of a certificate containing the IP
    address delegation extension requires additional processing.  As _each_
    certificate in a path is validated, the IP addresses in the IP
    address delegation extension of that certificate _MUST be subsumed by_
_IP addresses in the IP address delegation extension in the issuer's__
_ _certificate_. _Validation MUST fail when this is not the case_.  A
    certificate that is a trust anchor for certification path validation
    of certificates containing the IP address delegation extension, as
    well as all certificates along the path, MUST each contain the IP
    address delegation extension.  The initial set of allowed address
    ranges is taken from the trust anchor certificate.

---

From: Geoff Huston <[email-masked]>
Date: Fri, 2 Aug 2013 22:56:58 +1000

On 02/08/2013, at 10:48 PM, Stephen Kent <[email-masked]> wrote:

> 2.3.  IP Address Delegation Extension Certification Path Validation immutable
> 

Thanks for this Steve. This would imply that in order to contemplate a change of the style of validation of RPKI certificates into order to improve the robustness of certificate operation, there is also contemplation of changes to RFC3779.  Just as well we don't have the hubris to proclaim that RFC's are immutable.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 02 Aug 2013 10:08:12 -0400

Geoff,
> Thanks for this Steve. This would imply that in order to contemplate a change of the style of validation of RPKI certificates into order to improve the robustness of certificate operation, there is…
Hubris, no, very stiff resistance from the authors in this case, yes. I 
believe that RPKI is not the only user of 3779. The SeND folks refer to 
it as well.

I copied Russ on this message since he worked on this notion and 
promoted its use.

Steve

---

From: Geoff Huston <[email-masked]>
Date: Sat, 3 Aug 2013 04:23:29 +1000

> 
> Hubris, no, very stiff resistance from the authors in this case, yes. I believe that RPKI is not the only user of 3779. The SeND folks refer to it as well.
> 
> I copied Russ on this message since he worked on this notion and promoted its use.
> 

And who knows, maybe other users of the same RPKI framework, such as SeND, may see some very real benefit from a validation procedure that exhibited a little less brittleness in operational environments. I keep hearing concerns that even the slightest snafu in RPKI certificate management, or some form of deliberate intervention in the certificate infrastructure, has the potential to blackhole large parts of the net, and thats a rather worrisome concern for me. The thoughts I presented to the WG today were the outcomes of my thinking about a far simpler way to support resource transfer, the long-standing LTAM issue, and similar cases. I was thinking about various ways to mitigate some of these operational concerns without introducing even more complexity and brittleness into the picture. Other folks perspectives about the level of concern in this space may vary for mine, of course.