Subject: Re: [sidr] Request for WG Last Call for draft-ietf-sidr-bogons-02.txt and draft-ietf-sidr-roa-validation-01.txt

From: Samuel Weiler <[email-masked]>
Date: Mon, 17 Nov 2008 11:28:37 -0500 (EST)

draft-ietf-sidr-bogons-02 contains a number of things that are either 
inconsistent or where I found it difficult to determine the intent. 
While some examples are discussed below and can be addressed 
piecemeal, I think it would be more effective to address them through 
a comprehensive re-editting of the document, looking to simplify the 
language and make it significantly more readable.  Accordingly, I do 
not think this document is ready for WGLC.

Item 1: May BOAs be issued only by RIRs or also by entities further down the 
heirarchy?  From section 1:

    "This document defines an application of the Resource Public Key
    Infrastructure (RPKI) to validate the attestations of INTERNET
    REGISTERIES that certain addresses are currently neither allocated
    nor assigned to any party,..." (emphasis added)

Yet section 4 says:

    "ANY PARTY with a validly assigned Internet resource set and a CA
    certificate that describes this delegation can publish a BOA,
    independently of the actions of the actions of the party that
    assigned the resource set." (emphasis added)

Item 2:  Why must a BOA contain both ASNs and addresses?  Section 2.1.3.2:

    "The content of a BOA identifies a list of one or more AS's and one
    or more IP address prefixes..."

Item 3:  Reading the document the first time, I was very confused by 
section 5, in part because the second paragraph, which talks about 
AS's, and the third paragraph, which talks about addresses, looked so 
similar.  Just to help the reader, I suggest adding two subsections, 
one referring to AS's, the other to addresses or prefixes.  Perhaps 
add a sentence referring to the differences (e.g., that AS's listed in 
a BOA may be regarded as bogons even if ROAs list those ASs, but ROAs 
take precendence over BOAs when it comes to addresses.)

Furthermore, I'm not sure the addresses section (the third paragraph) 
is complete.  When a BOA referes to an address block that's more 
specific than one in the ROA, which takes precedence?  (It looks like 
the ROA, but I got lost somewhere in the six-line sentence.)

In general, I found this document harder to read than most i-d's, and 
I suspect part of it is due to the terminology.  I hope the editors 
will look for ways to improved the terminology, substituting shorter 
names when possible.  At the very least, change the name of BOAs so 
that there's more visual difference from "ROA".  While not technically 
substantive, such readability improvements may make it easier for 
others to review the document.  And given the confusions above, I 
think more review is sorely needed.

-- Sam

_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: Roque Gagliano <[email-masked]>
Date: Thu, 20 Nov 2008 10:11:18 -0600

Samuel.
On Nov 17, 2008, at 10:28 AM, Samuel Weiler wrote:
>
>
> Item 1: May BOAs be issued only by RIRs or also by entities further  
> down the heirarchy?  From section 1:
>

Internet Registry > Regional Internet Registry. It includes National  
Internet Registry and Local Internet Registry.  The architecture  
document uses the term: "internet registry or LIR/ISP".

Roque.

---

From: Randy Bush <[email-masked]>
Date: Thu, 20 Nov 2008 10:22:45 -0600

> Internet Registry and Local Internet Registry.

and iana.  all register ip addresses and asns.

randy

---

From: Sandra Murphy <[email-masked]>
Date: Thu, 20 Nov 2008 11:51:36 -0500 (Eastern Standard Time)

On Thu, 20 Nov 2008, Roque Gagliano wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Samuel.
>> Item 1: May BOAs be issued only by RIRs or also by entities further down 
>> the heirarchy?  From section 1:
>>
> Internet Registry > Regional Internet Registry. It includes National Internet 
> Registry and Local Internet Registry.  The architecture document uses the 
> term: "internet registry or LIR/ISP".

The use of the terms NIR and LIR are more common in some regions than in 
others.  Those areas where NIR and LIR are seldom used hear "RIR" when 
"registry" is mentioned.  The architecture draft goes through all the 
possibilities, but does not introduce the "Internet Registry" as the 
generic term.  Given the potential confusion on the part of some, it might 
be best to inject a parenthetical "(RIR, NIR, LIR/ISP)" in any doc that 
uses the generic term.

But the question still stands, I think.  Some entities that receive 
addresses are not RIR/NIR/LIR. Or so I believe. Is an enterprise that 
receives address space considered a registry, even if it does not 
sub-allocate?

Hm.  What about cell phones that are being handed huge blocks of IPv6 
addresses?  Don't know that anyone is thinking of running BGP from their 
cell phone, so maybe the question is moot.

--Sandy

>
> Roque.
>
>
>> 
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (Darwin)
>
> iEYEARECAAYFAkkljCcACgkQnk+WSgHpbO62mQCeMifdEO34/awFjuGt0vItpzcj
> CqkAnAhpoYbwvJg1e/mHPA5h2mpm7+Xd
> =erP4
> -----END PGP SIGNATURE-----

---

From: Geoff Huston <[email-masked]>
Date: Fri, 21 Nov 2008 05:53:47 +1100

WG chair hat off - speaking as a co-author of the drafts in question

On 21/11/2008, at 3:51 AM, Sandra Murphy wrote:

>>> Item 1: May BOAs be issued only by RIRs or also by entities  
>>> further down the heirarchy?  From section 1:
>>>
>> Internet Registry > Regional Internet Registry. It includes  
>> National Internet Registry and Local Internet Registry.  The  
>> architecture document uses the term: "internet registry or LIR/ISP".
>
> The use of the terms NIR and LIR are more common in some regions  
> than in others.  Those areas where NIR and LIR are seldom used hear  
> "RIR" when "registry" is mentioned.  The architecture draft goes  
> through all the possibilities, but does not introduce the "Internet  
> Registry" as the generic term.  Given the potential confusion on the  
> part of some, it might be best to inject a parenthetical "(RIR, NIR,  
> LIR/ISP)" in any doc that uses the generic term.

I hear your request, but the textual change suggested seems to me to  
be no better - the generic term of an "internet registry" is used to  
describe those  entities who perform an allocation / assignment  
function for Internet number resources. If Sam's a priori  
interpretation of the term is more restricted than that broad  
intention then I can see some merit in making the change as a note in  
terminology, but I don't see it as such a big issue that it warrants a  
new rev of the documents just for this point.

> addresses are not RIR/NIR/LIR. Or so I believe. Is an enterprise  
> that receives address space considered a registry, even if it does  
> not sub-allocate?
>
>
> Hm.  What about cell phones that are being handed huge blocks of  
> IPv6 addresses?  Don't know that anyone is thinking of running BGP  
> from their cell phone, so maybe the question is moot.
>

I smell a reductio absurdum argument being made here - I don't think  
it leads anywhere useful for me!

   Geoff

---

From: Roque Gagliano <[email-masked]>
Date: Thu, 20 Nov 2008 13:24:34 -0600

>
>  The architecture draft goes through all the possibilities, but does  
> not introduce the "Internet Registry" as the generic term.

RFC 2050 does (The Internet Registry system) , maybe a ref. is enough.

> Given the potential confusion on the part of some, it might be best  
> to inject a parenthetical "(RIR, NIR, LIR/ISP)" in any doc that uses  
> the generic term.
>

In the "registry policy" world, they are called "End Users".

Why we do not just use the term: "Certificate Holders", independently  
of where they are in the hierarchy?

Roque

---

From: Sandra Murphy <[email-masked]>
Date: Thu, 20 Nov 2008 14:58:13 -0500 (Eastern Standard Time)

On Fri, 21 Nov 2008, Geoff Huston wrote:

>>> Internet Registry and Local Internet Registry.  The architecture document 
>>> uses the term: "internet registry or LIR/ISP".
>> 
> I hear your request, but the textual change suggested seems to me to be no 
> better - the generic term of an "internet registry" is used to describe those 
> entities who perform an allocation / assignment function for Internet number 
> resources. If Sam's a priori interpretation of the term is more restricted 
> than that broad intention then I can see some merit in making the change as a 
> note in terminology, but I don't see it as such a big issue that it warrants 
> a new rev of the documents just for this point.

Agree not important enough to warrant a new rev on its own, but should be 
considered if a new rev is necessary for other more pressing reasons.

> I smell a reductio absurdum argument being made here - I don't think it leads 
> anywhere useful for me!

If you mean the cell phone comment, that was an idle thought that made its 
way to my fingertips while I typed.  You can ignore it.

I would however like you to answer the question of whether there exist 
entities that might do ROAs and BOAs but are not Internet Registries.  I 
am one of those people who do not normally use the term Internet Registry 
and I do not know if it covers enterprises that receive allocations and do 
BGP.

--Sandy

---

From: Geoff Huston <[email-masked]>
Date: Fri, 21 Nov 2008 08:53:38 +1100

WG Chair hat OFF.

> I would however like you to answer the question of whether there  
> exist entities that might do ROAs and BOAs but are not Internet  
> Registries.  I am one of those people who do not normally use the  
> term Internet Registry and I do not know if it covers enterprises  
> that receive allocations and do BGP.
>

In some parts of the world such entities are termed "LIRs" and fall  
within the category of "Internet Registry". In other parts of the  
world they are generically referred to as ISPs, even though the term  
is loosely used to encompass all types of entities that "receive  
allocations and do BGP". Others use a mix of terms, including "End  
User" where in the context of use it is explicitly not referring to an  
individual person or an end user in the traditional sense. The draft  
used the term in the broad sense of the first usage quoted here.  
Obviously there is a wealth of terms for such use. Whatever usage  
convention SIDR might attempt to invent over and above the existing  
set might well have a rather limited context of use, and may well  
serve to add to the resultant terminology confusion rather than reduce  
it.

Geoff