Subject: [Sidrops] draft-sidrops-rpkimaxlen

From: Matthias Waehlisch <[email-masked]>
Date: Thu, 21 Feb 2019 11:31:25 +0100

Hi,

  I read the (expired) draft draft-sidrops-rpkimaxlen.

  The problem analysis in the draft is misleading.

  The problem is not the usage of the max length field. Even without a 
max length field, a "forged-origin subprefix hijack" may occur easily. 
For example, a minimal, more specific ROA has been created, and the 
prefix is currently not announced by the origin AS configured in the 
ROA.

  The draft implicitly suggests: "Only create ROAs for prefixes that are 
currently announced." I'm not sure whether the WG has consensus about 
that.

  The draft is expired. I suggest to leave it expired because it leads 
to incorrect conclusions, see for example 
https://github.com/DECIX/RPKI/wiki/RPKI-deployment-options

Cheers
  matthias

-- 
Matthias Waehlisch
.  Freie Universitaet Berlin, Computer Science
.. http://www.cs.fu-berlin.de/~waehl

---

From: Randy Bush <[email-masked]>
Date: Thu, 21 Feb 2019 19:58:51 +0900

>   The problem analysis in the draft is misleading.

you are too polite

> prefix is currently not announced by the origin AS configured in the 

yep

> currently announced." I'm not sure whether the WG has consensus about 

that'll be great for all the make before break scenarios: ddos
mitigation, provider switching, ...

> to incorrect conclusions

yep

randy