Subject: Re: [Sidrops] Alvaro Retana's No Objection on draft-ietf-sidrops-rtr-keying-03: (with COMMENT)

From: Sean Turner <[email-masked]>
Date: Tue, 12 Feb 2019 21:25:31 -0500

> On Jan 23, 2019, at 12:46, Alvaro Retana <[email-masked]> wrote:
> 
> Alvaro Retana has entered the following ballot position for
> draft-ietf-sidrops-rtr-keying-03: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-sidrops-rtr-keying/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> (1) I don't really have a strong objection for this document being a BCP. 
> However, while documenting two different methods, there is no clear indication
> of "what is believed to be the best" [rfc2026], or even better, which method
> should be used in what situations.  I understand that operators have different
> preferences/needs and that prescribing one method as the default in not the
> right thing to do.
> 
> I would really like to see some text (maybe a "Deployment Considerations"
> section) that talks about when one or the other might be preferred/considered.

Right so I am hoping that Randy’s answer helped here.  The only thing I will add is that it really depends on what gear you buy so in some sense I am kind of wobbly on whether we should pick one.

> (2) §4: s/BGP Identifier [RFC4271]/BGP Identifier [RFC6286]

Good catch!

> (3) §4: "In the case where the operator has chosen not to use unique per-router
> certificates, a BGP Identifier of 0 MAY be used." rfc6286 defines the BGP
> Identifier as always being non-zero.  rfc8209 says that "if the same
> certificate is issued to more than one router (and hence the private key is
> shared among these routers), the choice of the router ID used in this name is
> at the discretion of the Issuer."  It seems to me that it doesn't matter which
> ID is used...it just can't be 0.  The simple fix is to just remove the sentence.

Agreed.

> (4) §8: "Enabling the router-to-CA connectivity MAY require connections to
> external networks (i.e., through firewalls, NATs, etc.)."  That "MAY" is out of
> place because this sentence is just stating a fact.

Can do r/MAY require/requires

> (5) §8: "Note that the checks performed by the router in Section 7...SHOULD be
> performed."  Besides confirming the checks from §7, I'm not sure what this
> sentence really contributes...but I do think that the "SHOULD" is out of place
> because the Normative language is already in §7.

These are just consistency checks.

> (6) Nits
> s/used by the the/used by the
> s/corresponds to the private used/corresponds to the private key used

fixed

Cheer,

spt

---

From: Alvaro Retana <[email-masked]>
Date: Wed, 13 Feb 2019 13:55:52 -0500

On February 12, 2019 at 9:25:33 PM, Sean Turner ([email-masked]) wrote:

Sean:

Hi!

> On Jan 23, 2019, at 12:46 <http://airmail.calendar/2019-01-23 12:46:00
EST>, Alvaro Retana <[email-masked]> wrote:

...

> section) that talks about when one or the other might be
preferred/considered.

Right so I am hoping that Randy’s answer helped here. The only thing I will
add is that it really depends on what gear you buy so in some sense I am
kind of wobbly on whether we should pick one.

I’m not sure which of Randy’s messages you’re referring to, but I would
this related reply (to the RtgDir review): "we do not tell operators how to
run their networks. for example many will choose operator driven because it
allows them to quickly swap new gear for a failed device without backflow
into the rpki. "

I’m not asking you to pick one…or to declare one to be the default/best..

I’m hoping that you can provide some guidance on the pros/cons of using one
method or another in different scenarios.  Maybe you say that if the right
hw is present then one method might be better…or you might say (as above)
that one method is better for some operational cases….

In any case, just a non-blocking comment. :-)

Thanks!

Alvaro.