Subject: [CGA-EXT] [draft-ietf-csi-send-cert-01] Review

From: Jean-Michel Combes <[email-masked]>
Date: Tue, 8 Dec 2009 17:42:52 +0100

Hi,

here are some comments/questions regarding the draft:

o Section 4, p7
Typo:
s/(i.e. and end user could deploy SEND without the need of RPKI
deployment in its ISP)/(i.e. an end user could deploy SEND without the
need of RPKI deployment in its ISP)

"This model MAY include ULA addresses."
I would add a reference to the RFC 4193.

o Section 5.1, p8
IMHO, it should be clearer:
s/"This certificate will be obtained from the publication point of
certificate defined as trust anchor."/"This certificate will be
obtained from the publication point of the trust anchor certificate."
BTW, as you used "EE" term at the beginning of the section, why not to
use the rest of the terminology specified in [draft-ietf-sidr-ta-02]
(i.e. ETA, RTA)?

"The identification for the Trust Anchor Material will be included in
the Name Type Field of the ICMP Trust Anchor Option as decribed in RFC
3971 and MUST always to refer to a certificate that includes as RFC
3779 address extension."
s/as decribed in RFC 3971/as described in RFC 3971
What do you mean by "MUST always to refer to a certificate that
includes as RFC 3779 address extension."?
Because, as far as I understood the RPKI structure
[draft-ietf-sidr-ta-02], normally, the device validating the router's
EE cert has only an ETA cert which doesn't contain a RFC 3779 Address
Extension (this last one refers to a RTA which contains a RFC 3779
Address Extension). Am I correct?

Thanks in advance for your reply.

Best regards.

JMC.

---

From: Roque Gagliano <[email-masked]>
Date: Wed, 9 Dec 2009 12:21:47 +0100

Jean Michel,

Thank you very much for your review. We need to update the draft after the comments received in Hiroshima and will include your suggestions.

Some comments inline.

Roque

> need of RPKI deployment in its ISP)
Good.

> I would add a reference to the RFC 4193.
Good.

> use the rest of the terminology specified in [draft-ietf-sidr-ta-02]
Good, I will. This section is the one that I was planning to revisit.

> s/as decribed in RFC 3971/as described in RFC 3971

Good.

> Address Extension). Am I correct?

Here is the thing. When you use a non RFC3779 Cert as a trust anchor, there is no IP resources in your TA certificate (the ETA). Someone needs to fetch the RTA cert (the one that has IP resources). 

We have two options, either the host does it or the router does it.

I believe that making the router to do it is problematic because the router is always expecting a TA that has IP resources and there is no way to reach the ETA from the RTA as the RTA is self-signed. So, my proposal is that in the SEND TA option the certificate that is referred always has to have IP resources in it and the host needs to make sure it can fetch it.

Regards,

Roque.

> _______________________________________________
> CGA-EXT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cga-ext

-------------------------------------------------------------
Roque Gagliano
LACNIC
[email-masked]
GPG Fingerprint: E929 06F4 D8CD 2AD8 9365  DB72 9E4F 964A 01E9 6CEE