Subject: Re: [sidr] Working Group Last Call - draft-ietf-sidr-arch-09.txt

From: Rob Austein <[email-masked]>
Date: Mon, 23 Nov 2009 18:25:56 -0500

I have read this draft, believe that (with one exception, below) it's
consistent with my implementation, and think it should go forward.

The one exception is section 4.3 on access protocol, already noted in
WG trac ticket #6.  Terry's right here, the draft is wrong, and the
authors have already agreed to fix it, so I have no further issue.

---

From: Samuel Weiler <[email-masked]>
Date: Wed, 25 Nov 2009 06:25:47 -0500 (EST)

First, many thanks to the editors of the architecture document.  For
as dense as it is, it's readable.

There are a couple of "gotta-fix" nits, as well as a broader concern
that lead me to say "not yet" to this doc.

The fix-it items:

Section 4.3 (access protocols): the rsync item, as noted by others.
4.3 also uses 2119 language to specify requirements for (current and
future) access protocols.  I'm not convinced that language is
appropriate for these requirements.

5 (Manifests) allows an EE cert to sign multiple manifests.  That
seems inconsistent with section 2.3 re: one-to-one correspondence.

The broader concern:

I continue to lack confidence that our validation algorithm is
complete, particularly when we look at incremental deployment.  That
leads me to wonder whether changes to the validation model will lead
us to changes in the data.  There's a reason the architecture doc has
normative references to so many other active sidr docs, including ones
that aren't yet to the point of WGLC, and I'm uneasy about pushing
this doc out until I'm more confident about the validation model.

This doc doesn't talk in depth about incremental deployment.  Instead,
it uses 2119 MUSTs to describe a full-deployment world (e.g., in
7.2.3, "A holder of a portable IP address space allocation MUST
authorize one or more ASes to originate routes to these prefixes.")
I'd prefer to see this doc acknowledge the existence of partial
deployment and explain how it will work.  (Will it?  If so, how?)  For
example: the document never clearly states what (if anything) signals
that the set of ROAs for a given address block is complete.  Maybe we
need to say "we're not yet defining a signal for 'this is the complete
set of ROAs'; that's be in a different doc", but it's a glaring
omission.

This document also asks IANA to issue RPKI certs.  I'm leery of asking 
them to do that when I still have doubts about the completeness of the 
architecture.  Should we be pushing out the doc calling on IANA to 
deploy when the other bits aren't done yet?

And the little stuff:

3.2 "There is no independent method of invoking a ROA."
s/invoking/revoking/, perhaps?

Section 7.1: "However, if the certificates for these allocations
contain different validity intervals, creating a certificate that
combines them might create problems, and thus is NOT RECOMMENDED."
Doesn't this problem arise when the underlying validity (e.g. the
validity of the assignment/allocation/etc.) intervals vary, rather
than the cert validity intervals?  Perhaps this could be clearer.

7.2 "Furthermore, a relying party must fetch new ROAs from the
repository system before taking any routing action in response to a
ROA revocation."  Is this reflected in the validation drafts?  It
should be likely be repeated in section 3 or 4 of the ROA format doc.

-- Sam

---

From: Geoff Huston <[email-masked]>
Date: Mon, 30 Nov 2009 09:01:26 +1100

WG co-chair hat ON

The WGLC of this document as a proposed BCP has now finished

I observed on the mailing list five WG members who responded to this last call. No response was in favour of progressing the document as it stands. 

Tickets #2, #6, #14 and #15 contain a record of the issues that have been raised in these responses

I would like to request the document's authors to respond to these issues, either in the tracker on on the mailing list, and revise the document as considered necessary to address these review comments. 

A further WGLC will be made on a revised version of this draft.

Thanks,

   Geoff

   WG co-chair hat ON

On 28/10/2009, at 1:50 PM, Geoff Huston wrote:

> The WG chairs have received a Working Group Last Call request from the authors of draft-ietf-sidr-arch-09.txt.
> 
> The document (and the draft history) is at http://tools.ietf.org/html/draft-ietf-sidr-roa-arch-09
> 
> The Last Call will end as of the close of business on Monday 23rd November - this is a longer period than a conventional 2 week last call period in order to include the forthcoming SIDR WG meeting at IETF 76.
> 
> The intended status of this document is informational.
> 
> As usual, please address all comments to the WG mailing list, and please be clear in your comments to this last call if you are supporting the document's submission to the IESG or if you are opposed, or if you are not expressing a view either way. As there are a number of documents that are being last-called at this point in time it would be appreciated if responses could clearly identify which document is being referred to.
> 
> 
> Thanks,
> 
> Geoff
> 
> WG Co-CHair hat ON
> 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr