Subject: [sidr] I-D Action: draft-ietf-sidr-rfc6490-bis-03.txt

From: [email-masked]
Date: Sat, 28 Mar 2015 16:20:12 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF.

        Title           : Resource Certificate PKI (RPKI) Trust Anchor Locator
        Authors         : Geoff Huston
                          Samuel Weiler
                          George Michaelson
                          Stephen Kent
	Filename        : draft-ietf-sidr-rfc6490-bis-03.txt
	Pages           : 9
	Date            : 2015-03-28

Abstract:
   This document defines a Trust Anchor Locator (TAL) for the Resource
   Certificate Public Key Infrastructure (RPKI).  This document
   obsoletes RFC 6490 by adding support for multiple URIs in a TAL.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidr-rfc6490-bis/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-sidr-rfc6490-bis-03

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-rfc6490-bis-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Geoff Huston <[email-masked]>
Date: Mon, 30 Mar 2015 06:47:41 +1100

Minor change to the Abstract and Introduction explaining the motivation for the update to the RFC, as requested by the WG Chairs.

Geoff

> On 29 Mar 2015, at 10:20 am, [email-masked] wrote:
> 
> 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: David Mandelberg <[email-masked]>
Date: Tue, 31 Mar 2015 21:06:16 -0500

Hi,

While thinking about RRDP (draft-ietf-sidr-delta-protocol-00), I 
realized that there's a minor conflict between RRDP's push to transition 
from rsync to http(s), and the TAL format's requirement to use only 
rsync URIs. I propose the below changes to 
draft-ietf-sidr-rfc6490-bis-03 to make RRDP's work easier in the future 
without causing any harm now. Sorry to bring this up so late in the 
process for draft-ietf-sidr-rfc6490-bis.

In the abstract, change:

    This document obsoletes RFC 6490 by adding support for multiple URIs 
in a TAL.

to:

    This document obsoletes RFC 6490 by adding support for multiple URIs 
in a TAL, and allowing URI schemes other than rsync.

In section 2.1, change:

    where the URI section is comprised of one of more of the ordered
    sequence of:

       1.1)  an rsync URI [RFC5781],

       1.2)  a <CRLF> or <LF> line break.

to:

    where the URI section is comprised of one of more of the ordered
    sequence of:

       1.1)  a URI [RFC3986],

       1.2)  a <CRLF> or <LF> line break.

    The URI section MUST include one or more rsync URIs [RFC5781]. 
Non-rsync URIs MAY be present.

I assume that an rfc3986 URI cannot include either <CRLF> or <LF>, but 
if I'm wrong then I'd like to add a MUST NOT somewhere in this text.

In section 2.2, change:

    Each rsync URI in the TAL MUST reference a single object.

to:

    Each URI in the TAL MUST reference a single object.

and:

    Where the TAL contains two or more rsync URIs, then the same self-
    signed CA certificate MUST be found at each referenced location.  In
    order to operational increase resilience, it is RECOMMENDED that the
    domain name parts of each of these URIs resolve to distinct IP
    addresses that are used by a diverse set of repository publication
    points, and these IP addresses be included in distinct Route
    Origination Authorizations (ROAs) objects signed by different CAs.

to:

    Where the TAL contains two or more URIs, then the same self-
    signed CA certificate MUST be found at each referenced object.  In
    order to increase operational resilience, it is RECOMMENDED that
    no two URLs which share a scheme have domain name parts that can
    resolve to the same IP address. Additionally, it is RECOMMENDED that
    these IP addresses be included in distinct Route
    Origination Authorizations (ROAs) objects signed by different CAs.

In section 3, add this paragraph at the beginning:

    An RP MUST support the rsync URI scheme and MAY support additional
    URI schemes. An RP SHOULD ignore all URIs with unsupported schemes.

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/