Subject: [Sidrops] Roman Danyliw's Discuss on draft-ietf-sidrops-lta-use-cases-06: (with DISCUSS and COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Wed, 01 May 2019 11:35:56 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-sidrops-lta-use-cases-06: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-lta-use-cases/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I had a few questions about use case #3.

(1) I want to discuss what I see as a dissonance between use case #3 (Section
4, “Alice is responsible for the trusted routing for a large organization …”)
and the Security Considerations.  It appears that use case #3 is explicitly
describing an on-path attack per RFC3552.  Is use case #3 a use case or an
attack against RPKI?

There seems to me to be an analog between use case #3 and the TLS/web MitM
discussions where the consensus was not to standardize these features despite
their existence.  In what way do you see RPKI as different?

(2) Thanks for the additional background in in [1].  More to clarity along the
lines of Mirja’s DISCUSS, I’m trying to unpack the use case #3 text in Section
4.

Original Text: “Alice is responsible for the trusted routing for a large
organization, commercial or geo-political, in which management requests to
redirect their competitors' prefixes to socially acceptable data.”

If Alice is “(us|china|uk|justabouteverybody)” per [1], who is the “management”
in the context of a government? Furthermore, “competitor’s” is confusing to me
because it seems odd to characterize the networks of objectionable content as
competitors to other governments.  I would have read this text as “Alice is a
network operator who has been directed to inspect and redirect select prefixes
to …”.

[1] https://mailarchive.ietf.org/arch/msg/sidrops/qGulOfrDPxXgMC9HLJWpXYeBOi4

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

A few editorial nits:

(1) Section 3.  Editorial Nit.

s/There are critical uses of the RPKI where a local administrative and/or
routing domain, e.g. an end-user site, a particular ISP or content provider, an
organization, a geo-political region, ... may wish to have a specialized view
of the RPK./

There are critical uses of the RPKI where a local administrative and/or routing
domain (e.g., an end-user site, a particular ISP or content provider, an
organization, a geo-political region) may wish to have a specialized view of
the RPK./

(2) Section 4.  Editorial Nit.
s/(LIR, PI holder, …)/(e.g., LIR, PI holder)/

---

From: Randy Bush <[email-masked]>
Date: Wed, 01 May 2019 13:58:08 -0700

> (1) I want to discuss what I see as a dissonance between use case #3
> (Section 4, “Alice is responsible for the trusted routing for a large
> organization …”)  and the Security Considerations.  It appears that
> use case #3 is explicitly describing an on-path attack per RFC3552.
> Is use case #3 a use case or an attack against RPKI?

it is using the rpki to facilitate an attack on the internet within a
local scope.

in a sense, all three use cases describe 'attacks' on the rpki.  they
are all about having divergent local views of the rpki content.  like
many tools, they have applications good and bad.

> There seems to me to be an analog between use case #3 and the TLS/web
> MitM discussions where the consensus was not to standardize these
> features despite their existence.  In what way do you see RPKI as
> different?

well, it's not a transport/network layer, so the monkey can not find a
middle :).  but it definitely is an attack.

note that this draft does not describe mechanisms, only use cases.  but,
as i said in response to mirja, i have sympathy for the position and am
willing to go either way.  but this use case is, and will likely
continue to be, the dominant use for tree modification a la slurm.

> (2) Thanks for the additional background in in [1].  More to clarity
> along the lines of Mirja’s DISCUSS, I’m trying to unpack the use case
> #3 text in Section 4.
> 
> If Alice is “(us|china|uk|justabouteverybody)” per [1], who is the
> “management” in the context of a government?

different cultures have different organizational relationships between
political decision making and internet operations.  anybody here
understand the mechanisms by which the USG shuts down a thousand web
sites?  we read in the press about various cultures doing this stuff all
the time, and it is pretty complex.

> Furthermore, “competitor’s” is confusing to me because it seems odd to
> characterize the networks of objectionable content as competitors to
> other governments.  I would have read this text as “Alice is a network
> operator who has been directed to inspect and redirect select prefixes
> to …”.

glad to have a different term which conveys the intent.  we have always
been at war with eastasia.

btw, the use case which is most interesting to operators is that of
carol, the 'dutch court attack.'  while carol or a third party can
easily construct a slurm patch, how is that distributed, authenticated,
and how do third parties decide whether to apply it?

> A few editorial nits:

thanks.  as it is now within 24 of your telechat, i will hold back on a
new draft.

randy