Subject: [sidr] Validation Reconsidered (again/again) question

From: Christopher Morrow <[email-masked]>
Date: Fri, 6 Nov 2015 12:52:13 +1100

Please take 2 weeks time to consider:

"This document was adopted as a WG work item, should we accept this
change and complete the work or not?"

where:
  'this document' is:
   <http://tools.ietf.org/html/draft-ietf-sidr-rpki-validation-reconsidered>

I'll close the mic line on: 11/20/2015
                                        Nov 20, 2015

-Chris
sidr-co-chair

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Fri, 6 Nov 2015 10:56:02 +0900

Aside from process questions (whether should the draft update a standard
or nor), I definitely believe the WG should continue working on this.

-Carlos

On 11/6/15 10:52 AM, Christopher Morrow wrote:
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: Tim Bruijnzeels <[email-masked]>
Date: Fri, 6 Nov 2015 11:09:38 +0900

> On 06 Nov 2015, at 10:56, Carlos M. Martinez <[email-masked]> wrote:
> 
+1

Tim

---

From: Geoff Huston <[email-masked]>
Date: Fri, 6 Nov 2015 16:04:21 +1100

> On 6 Nov 2015, at 12:52 PM, Christopher Morrow <[email-masked]> wrote:
> 
> change and complete the work or not?”
> 

I say “Yes," for some value of somebody/some people completing the work that is != me

thanks,

  Geoff

---

From: Arturo Servin <[email-masked]>
Date: Fri, 06 Nov 2015 21:06:35 +0000

+ 1 for adoption.

And hopefully somebody would say "I take this".

Regards
as

---

From: Stephen Kent <[email-masked]>
Date: Fri, 6 Nov 2015 16:35:07 -0500

> change and complete the work or not?"
Adopting a doc as a WG item does not mean that it is acceptable
"as is"  at the time it was adopted. The intent is that the author(s)
will cooperate with WG members to refine the doc as comments are posted.

This doc has received detailed comments, posted to the list, to which the
authors have never deigned to respond. It is very poorly written, and the
specific change it describes (vaguely) is not technically consistent with
the part of RFC (6487) that it purports to be updating.

So, unless the folks who volunteered to assume responsibility for the doc
(all of whom were already listed as co-authors) are prepared to do a much
better job in addressing these shortcomings, I object to continuing with 
this work.

Steve

---

From: Oleg Muravskiy <[email-masked]>
Date: Mon, 9 Nov 2015 15:05:33 +0100

> change and complete the work or not?"

Yes, we should.

-- 
Oleg Muravskiy
RIPE NCC

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 19 Nov 2015 15:47:35 -0500 (EST)

> change and complete the work or not?"

Yes.  I believe this change in the validation algorithm improves the 
operational robustness of the RPKI.

If the WG chairs find themselves uncertain about the consensus on this 
quesiton, it might be helpful to ask ourselves: if we had chosen a 
certificate structure other than X.509, perhaps even something invented 
specifically for the purpose, would we be hesitating to make this change? 
At the very least, that could bring the discussion back to specific 
operational issues, which would, IMHO, be a good focus for it.

Hopefully the chairs will see a consensus without needing to ask that 
question - the discussion I've read here suggests to me that we have at 
least a rough consensus.

-- Sam

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 19 Nov 2015 15:56:58 -0500 (EST)

On Fri, 6 Nov 2015, Stephen Kent wrote:

> So, unless the folks who volunteered to assume responsibility for the 
> doc (all of whom were already listed as co-authors) are prepared to do a 
> much better job in addressing these shortcomings, I object to continuing 
> with this work.

It sounds like you're objecting to the work because the editors of this WG 
draft have been insufficiently responsive to your criticisms.

That sounds like a WG management issue, and I am disappointed that you 
would ask the WG to abandon useful work because of it.

I take the view that document editors have been given the task of 
documenting the consensus of a WG.  If you think the editors aren't 
documenting consensus correctly or are just doing a poor job with the 
writing, take it up with the chairs.  It might be helpful to recruit some 
alternative editors, particularly ones who don't seem to have a strong 
bias re: the topic - finding good document editors is a persistent problem 
in many WGs.  At the same time, recognize that if you're too far in the 
rough (which you might be), your own criticisms may not result in changes 
to the doc.

-- Sam

---

From: Stephen Kent <[email-masked]>
Date: Fri, 20 Nov 2015 11:34:14 -0500

Sam,

>> doc (all of whom were already listed as co-authors) are prepared to 
>> do a much better job in addressing these shortcomings, I object to 
>> continuing with this work.
>
> It sounds like you're objecting to the work because the editors of 
> this WG draft have been insufficiently responsive to your criticisms.
Non-responsive to specific suggested changes and noted technical flaws 
would be more accurate.

> would ask the WG to abandon useful work because of it.
Perhaps you have not been following this thread closely. Geoff said that 
he didn't
want to continue as document editor, and that triggered the call by thew 
WG chairs
as to whether the doc should die. I didn't initiate that question; I 
replied to it.
> writing, take it up with the chairs.  It might be helpful to recruit 
> some alternative editors, particularly ones who don't seem to have a 
> strong bias re: the topic - finding good document editors is a 
> persistent problem in many WGs.  At the same time, recognize that if 
> you're too far in the rough (which you might be), your own criticisms 
> may not result in changes to the doc.
Several folks who were listed as co-authors have offered to assume 
responsibility
for the doc, so the "recruiting" task seems to have been done, at the 
behest of the WG
chairs. As for their bias, I think they have an opportunity to revise 
the document in
a way to avoid a perception of a strong bias, and they should be given a 
chance to do so.

If I am in the rough, perhaps it's because I am one of the very few 
people who
take time to read docs like this, in detail. I recall that Chris 
admitted, at the
mic, that he had not read the adverse actions I-D, so I don't know if he 
also
didn't read (or read carefully) the validation reconsidered doc. I get 
the sense
that folks often express support for a doc based on a slide 
presentation, rather
that reading the doc. Its a problem in many WGs, and this one probably 
is not an exception.

Steve

---

From: Christopher Morrow <[email-masked]>
Date: Fri, 20 Nov 2015 13:17:04 -0500

On Fri, Nov 20, 2015 at 11:34 AM, Stephen Kent <[email-masked]> wrote:
>
> If I am in the rough, perhaps it's because I am one of the very few people
> who
> take time to read docs like this, in detail. I recall that Chris admitted,
> at the

I didn't read the adverse actions well enough to matter, yes.

> didn't read (or read carefully) the validation reconsidered doc. I get the
> sense

I did read the validation reconsidered doc a few times... most
recently when making the presentation I gave. I didn't enjoy some of
the text as much, and think a bunch of 'clean up the wording' has to
happen, but I do think (as my slides said) that the intent is an
appropriate change to improve robustness of the system.

-chris

---

From: Randy Bush <[email-masked]>
Date: Sat, 21 Nov 2015 15:24:33 +0100

> the intent is an appropriate change to improve robustness of the
> system.

i think it changes the robustness, not necessarily improves it.  the
loss of congruent hierarchic validation is exchanged for accepting some
failures we have yet to see.

being a bit of a naggumite, accepting errors is not big on my agenda.
one of my disagreements with dr postel was the receiver side of the
robustness principle.  this way lies entropic death.

randy

---

From: Christopher Morrow <[email-masked]>
Date: Mon, 23 Nov 2015 17:13:40 -0500

Pinging this thread to catch anyone who didn't reply but had thoughts
I'd like to close this out tomorrow before 5pm EST (10pm UTC).

thanks!
-chris

---

From: "Montgomery, Douglas" <[email-masked]>
Date: Tue, 24 Nov 2015 15:11:13 +0000

I would like to see this work continue.  Every public/private working
group that I have been part of that discusses potential incremental roll
out of RPKI based origin validation gets hung up on FUD about the
brittleness of the system.   While validation reconsidered does not solve
all potential threats/errors, it does mitigate one scenario, with
significant potential amplification effects, that I have heard mentioned
in these discussions.

I would prefer to avoid as many failure scenarios as possible, rather that
focus on ways of detecting them when they do occur.

dougm
— 
Doug Montgomery, Mgr Internet & Scalable Systems Research at  NIST/ITL/ANTD

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 24 Nov 2015 11:22:00 -0500

> I'd like to close this out tomorrow before 5pm EST (10pm UTC).

Damn my lack of date specificity!!
  To be clear, I'd like to make the call on this:
    2015-11-25 10pm UTC
   (November 25 2015 10pm UTC)

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 24 Nov 2015 09:58:03 -0800

> I'd like to close this out tomorrow before 5pm EST (10pm UTC).

I've been considering the concept behind this document and whether the
concept should be carried forward by the working group.  To me the
starting ID is frequently badly written or has too few editors, etc.
That always changes over time, so I'm not concerned about that issue in
particular until it is proven that no one will take it up (and many
won't volunteer for a question mark).

So, on to the concept: in my younger years I was very strict and I would
have been against this concept from the beginning, because it does bring
the status of a given certificate into question.  But my older and wiser
self has seen far too many difficult and failed protocol deployments
because of the complexity associated with "everyone everywhere needs to
do the right thing all the time".  To me, the validation reconsidered
proposal mitigates some of the very likely real-world, real-human
deployment scenarios.  And I don't think that the RPKI publicity side
can take too many negative hits (again, because I've watched too many
other protocols slow down at the minimum when negative publicity hits
them).  In short, the validation reconsidered concept reduces the
real-world impact of necessary and accidental changes, which to me means
a deployment base that will be stronger even though we're "allowing
more".

Does that do strange things to the status of a given certificate?  Yes,
it definitely does.  I know this will ruffle some feathers: but I
believe the goal of the RPKI was to make a decision, based on available
data, about the ability to trust that origin's announcement.  Everything
else has come after, or more likely as a result of implementing, that goal.
The RPKI makes use of PKIX and certificates to achieve that goal, and
along the way became a fundamental staple that we're hesitant to
change.

In the end, however, when I look at the primary original goal, along
with the need for a robust deployment, the validation reconsidered
proposal seems well worth the trade offs.

-- 
Wes Hardaker
Parsons

---

From: Randy Bush <[email-masked]>
Date: Tue, 24 Nov 2015 23:35:37 +0100

> Every public/private working group that I have been part of that
> discusses potential incremental roll out of RPKI based origin
> validation gets hung up on FUD about the brittleness of the system.

universally, the brittleness that seems to concern operators is the
hierarchy and the 'dutch court' attack.  this does nothing for that.

the brittleness this seems to address is perceived by rirs, who have
already deployed.

so i do not see this as solving a real deployment issue.  otoh, i do
not see it as being highly destructive.  more of a not clearly needed
change when there is plenty of other work to be done.

randy

---

From: Robert Kisteleki <[email-masked]>
Date: Wed, 25 Nov 2015 09:21:29 +0100

> hierarchy and the 'dutch court' attack.  this does nothing for that.

Indeed it doesn't solve all possible problems. But it solves a real tangible
one.

> the brittleness this seems to address is perceived by rirs, who have

RIRs are expected to be higher-than-average in the certificate chain,
therefore any mistake made on this level could affect a large population.
However, the issue addressed can happen on any level and will affect any
descendants -- therefore benefits apply to them to.

> change when there is plenty of other work to be done.

I don't think we should accept the situation that, for example, my
certificate (and ROA, whatever) covering my precious prefix will become
invalid because my grand-grand-grandparent, whom I never met, made a booboo
about an ASN they never had. Therefore I think this draft, or the concept
therein, should be completed.

Robert

---

From: Warren Kumari <[email-masked]>
Date: Wed, 25 Nov 2015 14:25:41 +0000

> proposal seems well worth the trade offs.

I've been delaying responding because I wasn't sure how to articulate my
thoughts (and because I got sidetracked!).

Wes managed to capture what I was thinking nicely.

We should complete this.

Hopefully I'm not too late for my views to be taken into account.
W

---

From: "Sriram, Kotikalapudi" <[email-masked]>
Date: Sat, 28 Nov 2015 00:08:38 +0000

I think the discussion on the work should continue.
New questions are being raised and the authors should address them in a revised draft going forward.

I also had a couple of new questions/suggestions (hopefully new!) about the method.
I have mentioned them in my other post replying to Tim's post.

Sriram 
________________________________________
From: sidr <[email-masked]> on behalf of Christopher Morrow <[email-masked]>
Sent: Thursday, November 5, 2015 8:52 PM
To: [email-masked]; [email-masked]; [email-masked]
Subject: [sidr] Validation Reconsidered (again/again) question

where:
  'this document' is:

-Chris
sidr-co-chair

---

From: Christopher Morrow <[email-masked]>
Date: Sun, 29 Nov 2015 15:38:18 -0500

>    (November 25 2015 10pm UTC)

Ok, with a few extra days to let some more chatter progress, I think
the overall bent here is: "Please do more work on this."

With that in mind, I'd like the authors not gih@ to ping me and i'll
provide a pointer to the current xml, then I hope we can get moving
along with this in the coming quarters.

Thanks to those folk that replied to the question(s).

-chris