Subject: [sidr] adverse actions -01 posted

From: Stephen Kent <[email-masked]>
Date: Mon, 25 Jul 2016 11:26:04 -0400

Folks,

I have just posted the -01 version of the adverse actions document. It 
contains the edits I noted in my response to Tim on 7/19, as well as the 
revisions to the intro in response to feedback from Sandy and Randy.

Please send any comments on the revised version to the list.

I want to thank Daiming Li of ZDNS for transforming my revisions into a 
new .txt file suitable for posting.

Steve

---

From: Tim Bruijnzeels <[email-masked]>
Date: Tue, 26 Jul 2016 15:57:40 +0200

Hi Steve, list,

I still have an issue with the word "adverse" used in this document, and especially the first line in the introduction:

   In the context of this document, any change to the Resource Public
   Key Infrastructure (RPKI) [RFC6480] that results in a diminution of
   the set of Internet Numeric Resources (INRs) associated with an INR
   holder contrary to the holder's wishes is termed "adverse".

To me the word "adverse" communicates an unfavourable, possibly even malicious, action by an adversary. It implies that for conscious actions by a parent CA against the will by a child CA, the parent is "wrong" and the child is "right" (the victim of something that is "adverse"). As I said earlier there are circumstances where we as RIPE NCC are bound to reclaim resources from holders against their will. And however "unwanted" this may be by the holder of the resources, this is not because we bear these holders any ill will (and actually in most cases there is no dispute). Reclaiming resources is based on policy discussed in a bottom-up policy development process in our address policy working group. Calling this "adverse" implies that the holder is "right", and RIPE NCC is "wrong" in these cases.

I strongly believe that this document should not take sides. This may be what the authors intended in the first place, but then I would be much more comfortable if the word used was "unwanted". I believe this term is also more appropriate when the cause of the problem is unintentional (an error/glitch).

Tim

> On 25 Jul 2016, at 17:26, Stephen Kent <[email-masked]> wrote:
> 
> Folks,
> 
> I have just posted the -01 version of the adverse actions document. It contains the edits I noted in my response to Tim on 7/19, as well as the revisions to the intro in response to feedback from Sandy and Randy.
> 
> I want to thank Daiming Li of ZDNS for transforming my revisions into a new .txt file suitable for posting.
> 
> Steve
> 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Stephen Kent <[email-masked]>
Date: Tue, 26 Jul 2016 14:41:07 -0400

Tim,

> To me the word "adverse" communicates an unfavourable, possibly even malicious, action by an adversary.

The term adverse is appropriate as used in this document. When I look up 
the term I find the following primary definitions:

     unfavorable or antagonistic in purpose or effect, opposed to one's 
interests, causing harm, etc.

Synonyms include inimical and injurious.

These meanings are precisely what is intended here.

>   It implies that for conscious actions by a parent CA against the will by a child CA, the parent is "wrong" and the child is "right" (the victim of something that is "adverse").
You seem to be imposing your own interpretation here. Your description 
above is not consistent with dictionary definitions or normal English 
usage. There is no sense that an adversely affected entity is 
necessarily right.
> As I said earlier there are circumstances where we as RIPE NCC are bound to reclaim resources from holders against their will. And however "unwanted" this may be by the holder of the resources, this is not because we bear these holders any ill will (and actually in most cases there is no dispute). Reclaiming resources is based on policy discussed in a bottom-up policy development process in our address policy working group. Calling this "adverse" implies that the holder is "right", and RIPE NCC is "wrong" in these cases.
Use of the term does not imply that the INR holder is right and the CA 
is wrong. The fact that you keep using RIPE as the example CA suggests, 
to me, that you are biased and very defensive, in your interpretation of 
the term.
> I strongly believe that this document should not take sides. This may be what the authors intended in the first place, but then I would be much more comfortable if the word used was "unwanted". I b…
The term is appropriate irrespective of the source or motivation of the 
action.

Steve

---

From: Randy Bush <[email-masked]>
Date: Wed, 27 Jul 2016 08:21:09 +0900

> The term adverse is appropriate as used in this document. When I look
> up the term I find the following primary definitions:
> 
>      unfavorable or antagonistic in purpose or effect, opposed to
> one's interests, causing harm, etc.
> 

and what tim, and others, are trying to say is that exactly those
meanings are inappropriate.  we do not really know intent, contracts,
and business/social context.

i picked the first example of an 'adverse action' in your document and
explained how it can be normal operations (and it is said you have fixed
it, tyvm).  i had hopes you would induce.

operations and deployment are messy.  apologies.

tim made a fair suggeston of a lighter word.

randy

---

From: Stephen Kent <[email-masked]>
Date: Wed, 27 Jul 2016 13:38:54 -0400

Randy,

I read your comments carefully, and I'm puzzled by several of them.

> and business/social context.
the introduction says:

    Thus this document examines the implications of adverse actions with
    respect to
    INRs irrespective of the cause of the actions.

That text was trying to indicate that , for example, nothing to do with 
whether an action is adverse. But, I have revised the intro to make this 
clearer.
> it, tyvm).  i had hopes you would induce.
Your comments persuaded me to revise the text in question and to note 
that not all examples of competing ROAs or certs represent adverse 
actions. That, IMHO, was an appropriate and adequate change. You didn't 
say that you found the term "adverse" to be a problem.

> tim made a fair suggeston of a lighter word.
Tim offered no suggestion for a different term, which is not helpful. 
Moreover, his tone communicated bias and defensiveness, which is also 
not helpful.

Nonetheless, I have revised the introduction to address the cited 
concerns, but I have not adopted a new term, because:
     - it's reasonable, if one understands the definition
     - nobody has offered any alternative, much less a better 
alternative, that encompasses the full range of actions that may be he 
result of errors, attacks, etc.

Steve
--------

1.Introduction

Key Infrastructure (RPKI) [RFC6480] that modifies the set of Internet 
Numeric Resources (INRs) associated with an INR holder, and that is 
contrary to the holder's wishes, is termed "adverse". An action that 
results inan adverse charge (as defined above), may be the result of an 
attack on a CA [RFC7132], an error by a CA, or an error by or an attack 
on a repository operator. *Note that the CA that allocated the affected 
INRs may be acting in accordance with established policy, and thus the 
change may be legally justified, even though viewed as adverse by the 
INR holder. This document examines the implications of adverse actions 
with respect to INRs irrespective of the cause of the actions.*

Additionally, when a ROA or router certificate is created that

"competes" with an existing ROA or router certificate (respectively), 
the creation of the new ROA or router certificate may be adverse.(A 
newer ROA competes with an older ROA if the newer ROA points to a 
different ASN, contains the same or a more specific prefix, and is 
issued by a different CA.A newer router certificate competes with an 
older router certificate if the newer one contains the same ASN a 
different public key, and is issued by a different CA.)Note that 
transferring resources, or changing of upstream providers may yield 
competing ROAs and/or router certificates, under some circumstances. 
Thus not all instances of competition are adverse actions.

As noted above, adverse changes to RPKI data may arise due to several 
types of causes. A CA may make a mistake in managing the RPKI objects it 
signs, or it may be subject to an attack. If an attack allows an 
adversary to use the private key of that CA to sign RPKI objects, then 
the effect is analogous to the CA making mistakes. There is also the 
possibility that a CA or repository operator may be subject to legal 
measures that compel them to make adverse changes to RPKI data.In many 
cases, such actions may be hard to distinguish from mistakes or attacks, 
other than with respect to the time required to remedy the adverse 
action.(Presumably the CA will take remedial action when a mistake or an 
attack is detected, so the effects are similar in these cases. If a CA 
has been legally compelled to effect an adverse change, remediation will 
likely not be swift.)

This document analyzes the various types of actions by a CA (or

independent repository operator) that can adversely affect the INRs

associated with that CA, as well as the INRs of subordinate CAs.The

analysis is based on examination of the data items in the RPKI

repository, as controlled by a CA (or independent repository operator) 
and fetched by Relying Parties (RPs).The analysis is done from the 
perspective of an affected INR holder.

---

From: Matthias Waehlisch <[email-masked]>
Date: Wed, 27 Jul 2016 21:02:57 +0200

Hi Steve,

> Tim offered no suggestion for a different term, which is not helpful. 
  the suggestion was "unwanted".

  I just had a brief look into "Internet Security Glossary, Version 2" 
(https://tools.ietf.org/html/rfc4949), "corrupted" could be an 
alternative but I suppose it's still not light version.

Cheers
  matthias

---

From: Stephen Kent <[email-masked]>
Date: Wed, 27 Jul 2016 16:13:24 -0400

Matthias,

>    the suggestion was "unwanted".
I reread Tim's message; I don't interpret it as having suggested 
"unwanted" as an alternative. What I see is Tim noting that the changes 
are unwanted by the INR holder. That's true, but the term evocative, 
i.e., it fails to communicate the fact that the changes adversely effect 
the INR holder.
> alternative but I suppose it's still not light version.
Corruption usually implies an unauthorized change, an integrity 
violation. Suppression of an update to the RPKI repository system would 
not be accurately characterized as corruption, yet it is one of the 
actions we consider.

Steve

---

From: Randy Bush <[email-masked]>
Date: Thu, 28 Jul 2016 09:10:53 +0900

> "unwanted" as an alternative.

that is clear.  others, such as matthias and i, did.  but this is not
productive.

to be clear, i hereby suggest s/adverse/unwanted/

randy

---

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 28 Jul 2016 10:31:04 +0200

> On 28 Jul 2016, at 02:10, Randy Bush <[email-masked]> wrote:
> 

To be clear, that was my intended suggestion

Tim

---

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 28 Jul 2016 10:43:22 +0200

Hi Steve,

> On 26 Jul 2016, at 20:41, Stephen Kent <[email-masked]> wrote:
> 
> Use of the term does not imply that the INR holder is right and the CA is wrong. The fact that you keep using RIPE as the example CA suggests, to me, that you are biased and very defensive, in your interpretation of the term.

I keep using RIPE as an example because I am speaking out of my own experience - an experience that I believe is relevant to this discussion. And while I expect that others who act as parent CA, at any level, might share my concern, I don't presume to speak on their behalf.

Tim