Subject: [sidr] call for indication of interest: draft-ietf-sidr-rpsl-sig

From: "Murphy, Sandra" <[email-masked]>
Date: Thu, 22 Aug 2013 20:07:13 +0000

The authors of the draft-ietf-sidr-rpsl-sig have both indicated that they see a need for this draft and are still interested in pursuing the work.

But they both have been appointed to positions that put strong demands on their time.

Therefore, they would like some indication from the wg that the wg also is interested in pursuing the work.

And the co-chairs think it would be helpful to have an additional author/editor on this draft.

So.

Please do state whether you believe the wg should continue work in this area.  Responses by 5 Sep, please.

If you would be interested in serving as an additional author on this draft, please do say so.

--Sandy, speaking as wg co-chair

---

From: George Michaelson <[email-masked]>
Date: Fri, 23 Aug 2013 08:48:23 +1000

I believe this work is important and should continue, and be adopted by the
WG as a deliverable. RPKI has the capability to provide PKI assurance over
information which lies outside of BGP, as well as informing BGP, and I
think constructing the appropriate formalisms over signing of RPSL objects
will materially enhance trust in the statements made in RPSL, relating to
internet number resources.

I have no competency to work on this draft. I would encourage others to get
involved.

-George

On Fri, Aug 23, 2013 at 6:07 AM, Murphy, Sandra
<[email-masked]>wrote:

> The authors of the draft-ietf-sidr-rpsl-sig have both indicated that they
> see a need for this draft and are still interested in pursuing the work.
>
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: "Murphy, Sandra" <[email-masked]>
Date: Thu, 22 Aug 2013 23:15:29 +0000

Thanks, George.

You get the lollipop for being the first to reply.

Here's hoping that others follow your lead in replying promptly.

--Sandy

________________________________
From: George Michaelson [[email-masked]]
Sent: Thursday, August 22, 2013 6:48 PM
To: Murphy, Sandra
Cc: [email-masked]
Subject: Re: [sidr] call for indication of interest: draft-ietf-sidr-rpsl-sig

I believe this work is important and should continue, and be adopted by the WG as a deliverable. RPKI has the capability to provide PKI assurance over information which lies outside of BGP, as well as informing BGP, and I think constructing the appropriate formalisms over signing of RPSL objects will materially enhance trust in the statements made in RPSL, relating to internet number resources.

I have no competency to work on this draft. I would encourage others to get involved.

-George

On Fri, Aug 23, 2013 at 6:07 AM, Murphy, Sandra <[email-masked]<mailto:[email-masked]>> wrote:
The authors of the draft-ietf-sidr-rpsl-sig have both indicated that they see a need for this draft and are still interested in pursuing the work.

So.

--Sandy, speaking as wg co-chair
_______________________________________________
sidr mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sidr<https://urldefense.proofpoint.com/v1/url?u=https://www.ietf.org/mailman/listinfo/sidr&k=ppNirDwWpcp60F64Pj2f9Q%3D%3D%0A&r=1r2Unu%2Fc6gYAwDNJlKNsbPY52jaSAOPXvi3DGzGJXQo%3D%0A&m=Ci%2FIWbc1cLkDqWqVpAW2tbMNk2YgPEtetort52RsXJ4%3D%0A&s=b45e77fb5f5e4d67ec5d02076d49af03b7f5158c76f74ff2caa817d143a921bc>

---

From: Randy Bush <[email-masked]>
Date: Fri, 23 Aug 2013 08:42:28 +0900

> Here's hoping that others follow your lead in replying promptly.

ok, if you really wish

> From: George Michaelson
> I believe this work is important and should continue, and be adopted
> by the WG as a deliverable. RPKI has the capability to provide PKI
> assurance over information which lies outside of BGP, as well as
> informing BGP, and I think constructing the appropriate formalisms
> over signing of RPSL objects will materially enhance trust in the
> statements made in RPSL, relating to internet number resources.

it's a pki and has keys.  so the keys in it could be used to sign bank
transactions.  that does not mean we should do so.

the trust model of the rpki is that of a hierarchy of prefix ownership.
the rpsl has objects for which prefixes have no authority.  that the
rpsl has no inherent trust path has led to one being patched on in some
implementations in a rather half-assed manner.  adding another
authorization model on top of that is not gonna make it any cleaner.

this is trying make a silk purse out of a sow's ear.

but you can put a sow's ear in a silk purse, well kinda

    $ whois -h whois.rpki.net 147.28.0.0
    route:      147.28.0.0/16
    descr:      147.28.0.0/16-16
    origin:     AS3130
    notify:     [email-masked]
    mnt-by:     MAINT-RPKI
    changed:    [email-masked] 20130414
    source:     RPKI

randy, who was a poster child for the rps for many many years

---

From: George Michaelson <[email-masked]>
Date: Fri, 23 Aug 2013 09:58:35 +1000

The drafts discuss which objects it makes sense to sign, a canonicalization
order for the fields to be signed, a format like DKIM for specifying the
fields being signed, and thus defining what is not being signed, and
pointers to the public key certificate objects which in system help you
identify the RPKI signing chain authority over the signatures.

I don't see what your problem is. If somebody defines an RPSL BANK-CHEQUE:
object, then presumably a simple yes/no question eventuates: does this
object relate to any internet number resources? If not, then it doesn't
seem a good candidate for being signed over in a PKI. if it does, then I
really think its in -system.

I think you're using a very big hammer of 'Randy says no' to hit a very
small nail of 'lets see if we can define sensible specs for PKI signing
over RPSL'

They are smart guys. I think they can bring a problem to the table.

-G

---

From: Randy Bush <[email-masked]>
Date: Fri, 23 Aug 2013 09:06:45 +0900

> The drafts discuss which objects it makes sense to sign, a
> canonicalization order for the fields to be signed, a format like DKIM
> for specifying the fields being signed, and thus defining what is not
> being signed, and pointers to the public key certificate objects which
> in system help you identify the RPKI signing chain authority over the
> signatures.
> 
> I don't see what your problem is.

if the above complexity does not tell you, there is nothing more i can
add.

randy

---

From: Benno Overeinder <[email-masked]>
Date: Fri, 23 Aug 2013 12:27:48 +0200

I am also in favour of pursuing this draft.  I do see a benefit in
signing RPSL objects.

I understand the argument of Randy: with the keys in the RPKI one can
sign anything such as bank transactions, and indeed that doesn't mean we
have to do so.  But RPSL objects are close to the practice of routing,
just like RPKI.  And although technically they are different
infrastructures, operationally both technologies are used for
overlapping goals.  I also see advantages for deployment and transition
strategies.  And there are situations in which ISPs will keep using RPSL
and the added authoritative information from RPKI would be a great plus.

If the WG thinks this work should proceed, I am available as an
additional author/editor of the draft (given the current authors agree
with suggestion of chairs).

-- Benno

On 08/23/2013 12:48 AM, George Michaelson wrote:
> I believe this work is important and should continue, and be adopted by
> the WG as a deliverable. RPKI has the capability to provide PKI
> informing BGP, and I think constructing the appropriate formalisms over
> signing of RPSL objects will materially enhance trust in the statements
> made in RPSL, relating to internet number resources.
> 
> <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     The authors of the draft-ietf-sidr-rpsl-sig have both indicated that
>     they see a need for this draft and are still interested in pursuing
>     the work.
> 
>     [email-masked] <mailto:[email-masked]>

-- 
Benno J. Overeinder
NLnet Labs
http://www.nlnetlabs.nl/