Subject: [sidr] WG adoption poll for draft-huston-rpki-validation-01

From: Sandra Murphy <[email-masked]>
Date: Fri, 25 Apr 2014 12:05:14 -0400

The authors of draft-huston-rpki-validation-01.txt, RPKI Validation Reconsidered, have requested wg adoption.

See http://tools.ietf.org/html/draft-huston-rpki-validation-01.

Please do respond to the list as to whether you support the wg adopting this as a work item.  You do not need to comment on the content of this draft at this time.  You are asked to indicate if you think that this is work that the wg should be doing and whether this draft is an acceptable starting point.  Adding whether you can/will review or not is useful.

Note that active support is required for adoption.  Silence is a vote against adoption.

This adoption call will end on 9 May 2014.

--Sandy, speaking as wg co-chair

---

From: Randy Bush <[email-masked]>
Date: Fri, 25 Apr 2014 12:06:40 -0700

i really hate to side with dr kent :)

i am unsure of this is a useful work item.  please explain how it is
other than a complex (i.e. dangerous) patch to accommodate sloppy
operational praactices by a CA.  

make the protocol complex and you are vulnerable forever.  sloppy CA
ops practices can always be remedied.  so which is the worse problem?

randy

---

From: Andy Newton <[email-masked]>
Date: Mon, 28 Apr 2014 20:14:57 +0000

I support the adoption of this draft, as it makes the operations of a CA less problematic.

I also 100% disagree with Randy’s view that it adds complexity. To the contrary, it lessens complexity, aids flexibility and decreases fragility.

-andy

On Apr 25, 2014, at 3:06 PM, Randy Bush <[email-masked]> wrote:

> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: George Michaelson <[email-masked]>
Date: Tue, 29 Apr 2014 10:11:13 +1000

I would like to see the WG discuss validation. I think there are inherent
risks in the current model, which could be avoided if we had a more nuanced
understanding of the validity of any given resource under consideration.

So as a co-author of this draft its hardly surprising I support adoption,
because I want us to have a real conversation.

-George, speaking as co-author of the draft.

On Sat, Apr 26, 2014 at 2:05 AM, Sandra Murphy <[email-masked]> wrote:

> The authors of draft-huston-rpki-validation-01.txt, RPKI Validation
> Reconsidered, have requested wg adoption.
>
> Please do respond to the list as to whether you support the wg adopting
> this as a work item.  You do not need to comment on the content of this
> draft at this time.  You are asked to indicate if you think that this is
> work that the wg should be doing and whether this draft is an acceptable
> starting point.  Adding whether you can/will review or not is useful.
>

---

From: Geoff Huston <[email-masked]>
Date: Tue, 29 Apr 2014 10:42:22 +1000

Obviously, I also support this call for adoption, for the reasons George has outlined here.

   Geoff

On 29 Apr 2014, at 10:11 am, George Michaelson <[email-masked]> wrote:

> I would like to see the WG discuss validation. I think there are inherent risks in the current model, which could be avoided if we had a more nuanced understanding of the validity of any given resource under consideration.
> 
> So as a co-author of this draft its hardly surprising I support adoption, because I want us to have a real conversation.
>

---

From: Mark Kosters <[email-masked]>
Date: Tue, 29 Apr 2014 15:14:02 +0000

+1

Mark

From: George Michaelson <[email-masked]<mailto:[email-masked]>>
Date: Monday, April 28, 2014 at 8:11 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sidr] WG adoption poll for draft-huston-rpki-validation-01

---

From: Tim Bruijnzeels <[email-masked]>
Date: Tue, 29 Apr 2014 17:48:38 +0200

Hi,

I read the draft and I support adoption.

I think this addresses a real problem both in the transfer case described in the document, and in fragility wrt unintended changes in the hierarchical RPKI. This could be considered bad CA ops, but even then I think the impact on the children should be reduced. Furthermore, as a general approach I agree with the proposed model.

I understand this is a deviation from the existing RFC3779 validation algorithms that are currently implemented (obviously the point of this proposal), but while this will therefore require work to implement I see absolutely no problems doing so in the RP tool that we maintain. For what it's worth I think our work for this can be counted in days tops.

Tim

---

From: Sofía Silva Berenguer <[email-masked]>
Date: Tue, 29 Apr 2014 13:18:05 -0300

I support the adoption of this draft.

Kind regards,

Ing. Sofía Silva Berenguer

Senior SSR Engineer

PGP Key ID: 0xAAD4EB5F

LACNIC - www.lacnic.net
Latin American and Caribbean Internet Address Registry
Rambla República de México 6125
Montevideo - Uruguay
+598 2604 2222 ext 4408

---

From: "Sriram, Kotikalapudi" <[email-masked]>
Date: Tue, 29 Apr 2014 17:01:33 +0000

I have read the draft, and offered extensive comments and discussed the contents
with the authors on this list.

I support adoption as a WG document, but would like to see 
more discussion to further clarify the proposal and its pros/cons.

Sriram

>-----Original Message-----
>From: sidr [mailto:[email-masked]] On Behalf Of Sandra Murphy
>Sent: Friday, April 25, 2014 12:05 PM
>To: [email-masked]
>Cc: Sandra Murphy
>Subject: [sidr] WG adoption poll for draft-huston-rpki-validation-01
>
>Please do respond to the list as to whether you support the wg adopting this as
>a work item.  You do not need to comment on the content of this draft at this
>time.  You are asked to indicate if you think that this is work that the wg should
>be doing and whether this draft is an acceptable starting point.  Adding whether
>you can/will review or not is useful.
>

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Tue, 29 Apr 2014 14:21:42 -0300

I support adoption of this draft and I second all of Andy's comments.

I do believe that we need to be tolerant in the operation of the CA's as
we move forward in adoption of origin validation in routers.

Cheers!

~Carlos

---

From: Rob Austein <[email-masked]>
Date: Tue, 29 Apr 2014 18:01:19 -0400

Unfortunately, the binary adopt-or-not question is insufficiently
nuanced for a case like this.

I think the WG needs a work item to explore the issue of decoupling
RFC-3779-style[*] path validation from certificate validation.  It may
be that at the end of that process we will decide not to change the
base specification, but in addition to whatever sympathy the WG might
feel for CA operators near the root of the tree, I think there may be
some real issues lurking here with respect to out-of-order validation
problems and we need to explore them further.

I really do not know at this point whether the result of the work we
need to do on this will be a publishable document or not.

I do not support the addition of joins in the RPKI tree, full stop.

The WG chairs asked a couple of specific questions:

> You are asked to indicate if you think that this is work that the wg
> should be doing

Yes, with the proviso that the end result may be a decision to leave
well enough alone, in which case the only thing we might publish would
be a history of our decision not to change anything.

> and whether this draft is an acceptable starting point.

As a problem statement, yes.  With no intent to give offense, it's
nowhere near being suitable as an amended specification, but such a
document would be premature at this stage in any case.

Starting with a problem statement seems appropriate, so long as we
retain the option of keeping the current specification.  Yes, this
might end up meaning that, after years of work, the WG concludes that
we should not change the specification.  Sometimes you have to work on
something for a while before you know whether you should be doing it.

[*] "RFC-3779-style" because, if we change it, it won't be RFC 3779
    anymore.  It might well reuse all of RFC 3779's syntax and most of
    RFC 3779's semantics, but since there is deployed code that thinks
    it knows how to validate with the current semantics, at minimum I
    would want the hypothetical new thing to use different extnID OID
    values to flag the change.  So, strictly speaking, this would be a
    new set of X.509v3 extensions that just happen to look exactly
    like the ones from RFC 3779.

---

From: Terry Manderson <[email-masked]>
Date: Tue, 29 Apr 2014 17:38:35 -0700

I think there is a discussion here that needs to occur. I'm not convinced
that this document is the complete embodiment of that which should be
adopted or it's the sole answer to the problem space.

However I do share the concerns that in the growing complexity of RPKI
certificate structures any incorrect construction of the 3779 extensions
affects all subordinate certificates, even if some other lineage of INRs
in that certificate chain is pristine throughout, thus impacting the IN
holder's / routing operator's attestations. My reading of this problem
statement reaches the conclusion that the impact on a route degrades the
security posture (invalid certificate hence invalid ROA) such that the
RP's decision should interpreted as 'NotFound' (RFC6907/RFC6811).

Clearly a degradation of the security posture isn't ideal, and may cause
the litigious parts of the internet community to initiate action (clearly
not a desirable thing for any CA operator) as it allows any permutation of
routing attacks. But I also wonder if this is a facet of the tight binding
of the secure routing operations to the RPKI hierarchy and in the efforts
of reaching 'perfect' security attestations we have caused ourselves some
disservice in introducing unacceptable[1] levels of operational fragility.
 [[1] I'm quite sure this is subjective.]

Or perhaps (humour me for a minute) x.509 certificates might be the wrong
tool to use. When I consider a pure view of an x.509 certificate I view it
as "this certificate attests that all of it's contents are 100% correct".
For me, changing that position is a slippery slope - I'm not allergic to
it but I want the hiking boots on all the same.

For me this is then conditional support, if the authors (and the WG) are
willing to think of this document as the germination of the discussion
(which I believe I saw in George's email), then I will support adoption.

Cheers
Terry

---

From: Byron Ellacott <[email-masked]>
Date: Wed, 30 Apr 2014 06:39:26 +0000

I do support this draft, I am willing to review.

Thanks,
  Byron

---

From: Neriah Sossou <[email-masked]>
Date: Wed, 30 Apr 2014 11:08:20 +0400

In support of this draft.
Neriah