Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpsl-sig-06.txt

From: Stephen Kent <[email-masked]>
Date: Tue, 03 Mar 2015 11:29:33 -0500

Brian,

I apologize for this very, very late comment. Your message from late 
November
got lost in my inbox.

I worry that accommodating multiple signatures will cause confusion for
RPs. One would need to specify what to do if one sig fails, but other 
succeed,
for example.

Steve
> All,
>       Robert and I have found the time/energy to push this work to
> completion.  This version does not contain any substantive updates from
> the -05, I simply got this version out to allow for discussion on it to
> resume.
>
>       One question that I would like to discuss is the currently optional
> "o" attribute.  Robert feels it is not needed if the "c" attribute
> references a RFC 3779-compliant certificate.  I feel that the
> flexibility of having multiple signatures allows for instances where
> different parties own, for example, the prefix being advertised and the
> ASN.  I would appreciate feedback on this issue.
>
>       A follow-on version will address comments raised previously on the
>

---

From: Andrei Robachevsky <[email-masked]>
Date: Wed, 04 Mar 2015 01:32:19 +0100

> RPs. One would need to specify what to do if one sig fails, but other

I think the draft is clear about that, requiring all signatures to be
valid. And if we want to follow the RPSS/RFC2725 approach, then multiple
signatures are needed.

But, it is not entirely clear to me why we need an "o" field and not
just multiple "signature:" attributes in cases when signing by several
parties is required.

Regards,

Andrei

---

From: Robert Kisteleki <[email-masked]>
Date: Wed, 11 Mar 2015 16:21:41 +0100

> just multiple "signature:" attributes in cases when signing by several

Indeed, that is why we're dropping it. The o= field was suggested a long
time ago to make interdependent signatures. When thinking about the
implementability of it, it became clear that it has a *lot* of added
complexity, with not much benefit, if you compare to multiple, independent
signatures (which only make real sense for route objects, I think).

The draft already allows multiple signatures, therefore dropping the o=
field is the simplest and most forward looking step.

Cheers,
Robert

---

From: Brian Haberman <[email-masked]>
Date: Thu, 12 Mar 2015 13:48:47 -0400

As an update...

> field is the simplest and most forward looking step.

The above and a few other editorial changes will be made in an upcoming
revision... Hopefully published when the draft submission blackout lifts.

Regards,
Brian