Subject: [DNSOP] AS112 LOA?

From: Joe Abley <[email-masked]>
Date: Mon, 26 Nov 2007 11:48:38 -0500

Hi all,

Afilias runs AS112 servers at its various anycast nodes, as well as  
authoritative servers for the various TLDs that Afilias hosts. We just  
turned up a new node last week, which brought the following issue back  
to prominence; I thought I'd send a note about it before I forgot  
about it again.

Most if not all transit providers these days install prefix filters to  
make sure that their BGP-speaking customers only send them the routes  
that they should. (Many ASes install similar filters towards peers,  
but the extent to which that is commonplace varies from region to  
region.)

The AS112 project operates under the service prefix 192.175.48.0/24,  
which is originated by AS112. Announcing that prefix to a transit  
provider is an identical situation from the point of view of transit  
provider policies as announcing routes for a new downstream customer;  
in this case the customer is (from whois) "Root Server Technical  
Operations Assn".

Transit providers commonly request a Letter Of Authorisation (LOA)  
from ISPs who want to propagate their customers' routes in this  
fashion. The LOA would come from the customer, and would confirm that  
the ISP is authorised to propagate or announce the routes on their  
behalf.

The trouble with the AS112 project is that there's no actual connected  
customer, and explaining that AS112 is special to transit providers  
who haven't already heard of the concept can be a draining and  
frequently unfulfilling exercise. I seem to think there's no actual  
legal entity that carries the name "Root Server Technical Operations  
Assn", and similarly no listed officers, letterhead, etc which makes  
any LOA likely to be an exercise in photoshoppery and subterfuge.

So, the thought occurred to me (warning, text on-topic for DNSOP  
approaching) that it'd be nice to be able to publish an LOA in the  
form of an RFC so that, in effect, the IETF provides authorisation for  
the prefix in question to be propagated. Such a document could be  
quite brief, but I seem to think its existence would make it far  
easier for providers to accept 192.175.48.0/24 from ISPs.

The benefit would be to ISPs (or other ASes) who decide to start  
providing public AS112 service, and to existing ISPs providing the  
service who change transit providers or peer with people that filter.

I don't have strong feelings about whether the "LOA in an RFC" idea is  
plausible, or even good, but I thought I'd throw it out anyway. If  
there was consensus that such a document was worthwhile, I'd happy to  
do the legwork (and it'd be sufficiently brief in content and purpose  
that I could imagine it being thrown up to the IESG fairly swiftly).

Comments and opinions welcome :-)

Joe

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Nov 2007 13:26:00 -0500

On Nov 26, 2007, at 11:48 AM, Joe Abley wrote:
>
>
> I don't have strong feelings about whether the "LOA in an RFC" idea  
> is plausible, or even good, but I thought I'd throw it out anyway.  
> If there was consensus that such a document was worthwhile, I'd  
> happy to do the legwork (and it'd be sufficiently brief in content  
> and purpose that I could imagine it being thrown up to the IESG  
> fairly swiftly).

I think it sounds like an excellent idea -- I think that you may still  
have some issues getting providers to accept it, but hopefully way  
fewer issues than you would otherwise...

The other option would be to actually create a legal entity called   
"Root Server Technical Operations Assn" and have some way of  
automatically generating LOA's (maybe a web form that generates a  
PDF!), but this sounds like it may be a bad idea...

W

> Comments and opinions welcome :-)

---
Schizophrenia beats being alone.

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Nov 2007 13:26:00 -0500

W

---

---

From: [email-masked]
Date: Mon, 26 Nov 2007 20:39:39 +0000

> >Comments and opinions welcome :-)

	humph.... I think this is a surefire way to poison this prefix
	forever.  if the "IETF" is the body holding the delegation, then
	they would be able to sign the ROA... otherwise, the body holding
	the prefix (paying the bills) will be signing the ROA...  the
	system is not prepared to deal w/ anonymous roll/shell accounts.
	(see the RBN mess)

	so, i'm not persuaded that this si a smart or wise idea.  its
	hardcoding another special use prefix in millions of places all
	over the net.  

	that said, i;m sure it will be seen as a provident/prudent way
	forward and there will be herds of folks lining up in support.
	good luck :)

--bill

---

From: [email-masked]
Date: Mon, 26 Nov 2007 20:39:39 +0000

--bill

---

From: Joe Abley <[email-masked]>
Date: Mon, 26 Nov 2007 15:46:31 -0500

> 	system is not prepared to deal w/ anonymous roll/shell accounts.

The problem I was tentatively suggesting a solution for was the one  
where transit providers rely on LOAs (which seems fairly common today,  
although I have done no survey).

If/when transit providers start to accept ROAs instead of LOAs, the  
generation of ROAs sounds like a separate (although clearly not  
completely unrelated) problem.

> 	hardcoding another special use prefix in millions of places all

In addition to the hard-coding of that prefix that the working group  
has already agreed should happen in draft-ietf-dnsop-as112-*?

> 	forward and there will be herds of folks lining up in support.

:-)

Joe

---

From: Joe Abley <[email-masked]>
Date: Mon, 26 Nov 2007 15:46:31 -0500

:-)

Joe

---

From: Florian Weimer <[email-masked]>
Date: Mon, 26 Nov 2007 22:10:50 +0100

> any LOA likely to be an exercise in photoshoppery and subterfuge.

Even if there were a blanket LOA letter, the issue still remains if
*everyone* who can technically annoucne a prefix in the global table is
entitled to run a global AS112 instance if they feel the urge to do so.
I suppose the answer is "no", and you're back to square one.

(The same issue arises with 6to4 and the 192.88.99.0/24 prefix, BTW.)

---

From: Florian Weimer <[email-masked]>
Date: Mon, 26 Nov 2007 22:10:50 +0100

---

From: Geoff Huston <[email-masked]>
Date: Tue, 27 Nov 2007 09:49:39 +1100

I can't help thinking that resource certification might help here - but 
thats a "tomorrow" response rather than a "today" solution

(see page 23 of 
http://www.potaroo.net/presentations/2006-10-12-certs.pdf) for this 
concept of a digitally signed LOA)

   Geoff

---

From: Geoff Huston <[email-masked]>
Date: Tue, 27 Nov 2007 09:49:39 +1100

(see page 23 of 

   Geoff

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Nov 2007 21:17:08 -0500

> I suppose the answer is "no", and you're back to square one.

Well, currently it seems that *everyone* who can technically announce  
a prefix in the global table *and convince their ISP to accept it*  
gets to run a global AS112 instance. What do people think about  
setting up a legal entity called RSTOA that would then perform some  
very simple checks before handing out a LOA?

Those who have providers with clue would probably still manage to  
announce 192.175.48.0/24 without talking to anyone, those who need an  
LOA would have to contact RSTOA, show that they have configured thongs  
in a sane manner and would then get a pretty, signed LOA on "official"  
letterhead.

Of course, getting it so that the legal entity was actually allowed to  
hand out LOAs would be another matter...

W

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Nov 2007 21:17:08 -0500

W

---

From: Paul Vixie <[email-masked]>
Date: 27 Nov 2007 15:23:11 +0000

[email-masked] (Warren Kumari) writes:

> ... What do people think about setting up a legal entity called RSTOA
> that would then perform some very simple checks before handing out a LOA?

RSTOA is an existing unincorporated association.  you can ask it to do this
kind of thing.  just find any root name server operator and make your case.
(a convenient list of same can be found at <http://www.root-servers.org/>.)
-- 
Paul Vixie

---

From: Paul Vixie <[email-masked]>
Date: 27 Nov 2007 15:23:11 +0000

---

From: Warren Kumari <[email-masked]>
Date: Tue, 27 Nov 2007 17:03:36 -0500

On Nov 27, 2007, at 10:23 AM, Paul Vixie wrote:

> (a convenient list of same can be found at <http://www.root-servers.org/ 
> >.)

Oh, well, there you go then... :-)

W

--
She'd even given herself a middle initial - X - which stood for  
"someone who has a cool and exciting middle name".

     -- (Terry Pratchett, Maskerade)

---

From: Warren Kumari <[email-masked]>
Date: Tue, 27 Nov 2007 17:03:36 -0500

W

---

From: Joe Abley <[email-masked]>
Date: Wed, 28 Nov 2007 08:15:51 -0500

> (a convenient list of same can be found at <http://www.root-servers.org/ 

So, would it be possible for one or more of the root server operators  
to prepare a generic-yet-official-looking LOA on suitable "letterhead"  
and perhaps stash it on www.root-servers.org somewhere?

Such an LOA would probably be less remarkable to your average transit  
provider; the response to "here's a signed LOA as a PDF" is certainly  
likely to be more useful in practice than "here's an un-signed ASCII  
text file filled with legal boilerplate which really is an LOA, honest".

I can suggest the kind of text I think is needed off-line if that  
seems useful.

[I copy the list on this so that it doesn't appear that the thread  
ended over-abruptly in the archive.]

Joe

---

From: Joe Abley <[email-masked]>
Date: Wed, 28 Nov 2007 08:15:51 -0500

Joe

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:02:32 +0000

> ended over-abruptly in the archive.]

	Sure...  It should be there shortly.

--bill

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:02:32 +0000

--bill

---

From: Paul Vixie <[email-masked]>
Date: Wed, 28 Nov 2007 23:33:54 +0000

> So, would it be possible for one or more of the root server operators to
> prepare a generic-yet-official-looking LOA on suitable "letterhead" and
> perhaps stash it on www.root-servers.org somewhere?

in principle, sure.  but i think if it's a form available on the web, then
some enterprising transit provider out there will reject the LOA as "fake".

> [I copy the list on this so that it doesn't appear that the thread ended
> over-abruptly in the archive.]

do send text.  [email-masked] would be my preferred favourite for this.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 28 Nov 2007 23:33:54 +0000

---

From: Masataka Ohta <[email-masked]>
Date: Thu, 29 Nov 2007 09:36:48 +0900

> in principle, sure.

If anyone, even those with their own root zone contents different
from others, can operate anycast root server of AS112, that will
be fine.

Otherwise, those who want to operate anycast root server of AS112
must interact with "Root Server Technical  Operations Assn", result
of which will be an LOA.

For example, "Root Server Technical  Operations Assn" may provide
a web site for anycast root server operators agree on proper contents
of root zone and register their contact information to be used to
notify root zone change and, in return, get LOAs.

						Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Thu, 29 Nov 2007 09:36:48 +0900

Masataka Ohta