Subject: [Sidrops] I-D Action: draft-ietf-sidrops-rpki-has-no-identity-01.txt

From: [email-masked]
Date: Sun, 08 Aug 2021 13:38:19 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the SIDR Operations WG of the IETF.

        Title           : The I in RPKI does not stand for Identity
        Authors         : Randy Bush
                          Russ Housley
	Filename        : draft-ietf-sidrops-rpki-has-no-identity-01.txt
	Pages           : 7
	Date            : 2021-08-08

Abstract:
   There is a false notion that Internet Number Resources (INRs) in the
   RPKI can be associated with the real world identity of the 'owner' of
   an INR.  This document attempts to put that notion to rest.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-rpki-has-no-identity/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-has-no-identity-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-rpki-has-no-identity-01

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Randy Bush <[email-masked]>
Date: Sun, 08 Aug 2021 13:43:59 -0700

my (always suspect) memory on this one is that, when it was first
published, there was a lot of discussion exacerbated by some lack of
clarity.  this was cleaned up when we made clear that we were not
attacking RTA or RSC, only warning of potential misuse.  so it was
adopted as a wg document.

are we bored enough with it to wglc it?

randy

---

From: Ties de Kock <[email-masked]>
Date: Mon, 9 Aug 2021 09:58:27 +0200

Hi Randy,

> On 8 Aug 2021, at 22:43, Randy Bush <[email-masked]> wrote:
> 

First of all: I like the draft and it demonstrates some problem with using the
RPKI for external attestations really well.

> In large organizations, INR management is often compartmentalized
> with no authority over anything beyond dealing with INR registration.
> The INR manager for Bill's Bait and Sushi is unlikely to be
> authorized to conduct bank transactions for BB&S, or even to
> authorize access to BB&S's servers in some colocation facility.

About this paragraph: This may even need to be more specific.

I think that the department performing INR _management_ often may not even have
legal authority to change INR _registration_s. I imagine a department that can
change the data related to the INR registration (“update the ROAs”) but not
manage the INR registration (“garage sale of the IPv4”).

For the latter you (hopefully) need legal signing power.

Kind regards,
Ties

---

From: Randy Bush <[email-masked]>
Date: Mon, 09 Aug 2021 12:41:18 -0700

> I think that the department performing INR _management_ often may not
> even have legal authority to change INR _registration_s. I imagine a
> department that can change the data related to the INR registration
> (“update the ROAs”) but not manage the INR registration (“garage sale
> of the IPv4”).
> 

yes, but ...

i do not see where rsc/mta/... and folk wanting to sign bank statements
with registry data are asking to change the registry database.  clue
bat, please.

randy

---

From: Ties de Kock <[email-masked]>
Date: Tue, 10 Aug 2021 15:34:49 +0200

> On 9 Aug 2021, at 21:41, Randy Bush <[email-masked]> wrote:
> 

I was thinking about the situation where an actor uses an RPKI object to lead
people to believe they have legal authority to sign contracts concerning the
resources.

RPKI does not have identity but it does not imply being an legal representative
either? I was wondering if we needed to clarify that as well.

-Ties

---

From: Randy Bush <[email-masked]>
Date: Tue, 10 Aug 2021 20:36:08 -0700

> I was thinking about the situation where an actor uses an RPKI object
> to lead people to believe they have legal authority to sign contracts
> concerning the resources.
> 
> RPKI does not have identity but it does not imply being an legal
> representative either? I was wondering if we needed to clarify that as
> well.

so you want something such as

    That someone can provide 'proof of possession' of the private key
    signing over a particular INR should not be taken to imply that they
    are a valid legal representative of the organization in possession
    of that INR.  They could be just an INR administrative person.

randy

---

From: Ties de Kock <[email-masked]>
Date: Wed, 11 Aug 2021 09:19:11 +0200

>    of that INR.  They could be just an INR administrative person.

I think that looks good!

-Ties
> 
> randy
> 
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops