Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-rpkimaxlen-08 - ends 25/October/2021

From: Job Snijders <[email-masked]>
Date: Tue, 18 Jan 2022 10:43:21 +0100

Hello all,

As far as I am aware all comments have been addressed, I didn't see
additional discussion about the merits (or lack thereof!) of the
MaxLength field in RPKI ROAs.

If there still are outstanding concerns, please explicitly point me
towards those comments through mailarchive.ietf.org links so we can
continue a conversation.

Chairs, can draft-ietf-sidrops-rpkimaxlen move forward to IESG?

Kind regards,

Job

On Fri, Dec 10, 2021 at 06:05:13PM +0100, Job Snijders wrote:
> On Fri, Dec 10, 2021 at 07:38:58PM +0300, Alexander Azimov wrote:
> > > If your neighbors drop invalids, turning off egress ROV doesn't make any
> > > difference: the update gets dropped on the other end of the wire.
> > >
> > > If your neighbors don't drop invalids then this can be done in local
> > > policy using SLURM, in close to real time.
> > >
> > > In either case, this is a red-herring.
> >
> > In this scenario, I was supposing that ROV is done on egress and is absent
> > at the ingress of the neighbor.
> 
> Sasha, I fail to see what you want to achieve with this discussion -
> egress ROV is a novelty that almost nobody uses today. All of today's 
> educational outreach efforts focus on ingress ROV.
> 
> draft-ietf-sidrops-rpkimaxlen can be summarized in just a few sentences:
> "Configure your ROAs such that they align exactly with your BGP
> announcements. Adversarial actors can and will use any 'holes' you leave
> open: if you permit more-specifics but don't announce those
> more-speciics, someone else might!"
> 
> If this group really cannot come to consensus on the draft at hand, I
> suppose the next step simply is to propose to remove the ROA MaxLength
> functionality entirely from the ecosystem. Eradicate the misfeature.
> 
> The 'MaxLength' feature seems to cause nothing but confusion, as a
> result it all to easily leads to a reduction of security posture.
> 
> Kind regards,
> 
> Job