Subject: Re: [Sidrops] Minor comments on draft-ietf-sidrops-aspa-profile-00

From: Alexander Azimov <[email-masked]>
Date: Mon, 4 Nov 2019 23:50:06 +0300

Hi Tim, all,

I've just submitted a new version of ASPA profile and verification drafts.
As it was suggested in this thread, the ASPA object is transformed to
(customer, set_of_providers).

We also added 'unknown' state for verification procedure that might be
useful at medium/high adoption rates.
There are other minor changes in the documents, including some drawings,
which, I hope, will make the algorithm easier to read.

We are looking for your feedback, and it is time to also look for the
implementations.
I know at least about one implementation on top of BIRD - thanks to Eugene
Bogomazov and Ondrej Zajicek.

If there are already other implementations in place - please let me know.

вт, 15 окт. 2019 г. в 16:35, Tim Bruijnzeels <[email-masked]>:

> Hi Jakob, all,
>
> On 14 Oct 2019, at 23:49, Jakob Heitz (jheitz) <[email-masked]> wrote:
>
> The time for such enhancements is not now and may never happen, but we
> should think about it when choosing the format for the object.
>
>
> I am not convinced about that. The object has a distinct OID and version,
> either of which could be updated by possible future versions.
>
> Tim
>
>

-- 
Best regards,
Alexander Azimov

---

From: Tim Bruijnzeels <[email-masked]>
Date: Tue, 5 Nov 2019 18:50:02 +0100

Hi Alexander,

Thank you for updating. I gave it a quick read only so far, and it looks good.

I have one comment on section 4, where you have:

   o  The autonomous system identifier delegation extension [RFC3779] is
      present in the end-entity (EE) certificate (contained within the
      ASPA), and the customer AS number in the ASPA is contained within
      the set of AS numbers specified by the EE certificate's autonomous
      system identifier delegation extension.

This is technically fine. But, I would really recommend that the EE certificate is restricted to contain the customer AS only. This is the only resource that is needed here, and including other resources introduces an avoidable risk of the certificate to become invalidated if any of those is no longer contained by the CA certificate above this object.

Tim

> On 4 Nov 2019, at 21:50, Alexander Azimov <[email-masked]> wrote:
> 
> Hi Tim, all,
> 
> As it was suggested in this thread, the ASPA object is transformed to (customer, set_of_providers).
> 
> We also added 'unknown' state for verification procedure that might be useful at medium/high adoption rates. 
> There are other minor changes in the documents, including some drawings, which, I hope, will make the algorithm easier to read.
> 
> We are looking for your feedback, and it is time to also look for the implementations. 
> I know at least about one implementation on top of BIRD - thanks to Eugene Bogomazov and Ondrej Zajicek. 
> 
> вт, 15 окт. 2019 г. в 16:35, Tim Bruijnzeels <[email-masked] <mailto:[email-masked]>>:
> Hi Jakob, all,
> 
>> On 14 Oct 2019, at 23:49, Jakob Heitz (jheitz) <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> The time for such enhancements is not now and may never happen, but we should think about it when choosing the format for the object.
> 
> I am not convinced about that. The object has a distinct OID and version, either of which could be updated by possible future versions..
> 
> Tim
> 
> 
> 
> -- 
> Best regards,
> Alexander Azimov
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops