Subject: [Sidrops] AD Review of: draft-ietf-sidrops-rpki-has-no-identity

From: Warren Kumari <[email-masked]>
Date: Thu, 3 Mar 2022 09:37:41 -0500

Hi there authors and WG,

Firstly, thank you very much for this document, and apologies it has taken
a while for me to review it.

I must admit that I *wanted* to / felt I should be able to use the RPKI to
do things like sign LOAs and similar "the RIR says I'm the 'owner', seem
mah cert!" type things, and so, even though the document makes me sad, it's
useful and needed.

I do have a number of editorial comments / nits. Addressing these
before IETF LC and IESG review should make progressing the document
easier and smoother, as well as being politer to the RFC Editor.

Please let me know LOUDLY once you'd had a chance to address them, and I'll
start IETF LC.

Issues / comments:
Sec 1:
O: "Though since, it has grown to include..."
C: I don't have suggested text, but "Though since" is difficult to
parse -- it's not clear from the prior sentence what the "though" or
"since" refer to. Perhaps "Since publication of [RFC6480], the term has
grown
to include ..."? Actually, I'm not really sure what the sentence was trying
to
say though, so I have no idea if my suggestion works...

Nits:
Sec 1:
O: "In security terms the phrase "Public Key"... "
P: "In security terms, the phrase "Public Key"  ..."
C: Comma.

O: "But in reality, the RPKI certificate is only an
   authorization to speak for for the explicitly identified INRs;"
P: "But in reality, the RPKI certificate is only an
   authorization to speak for the explicitly identified INRs;"
C: Repeated 'for'

Sec 2:
O: "Registries such as the Regional Internet Resistries (RIRs)"
P: "Registries such as the Regional Internet Registries (RIRs)"
C: Typo

O: "That the RPKI does not authenticate real world identity is a feature
   not a bug."
P: "That the RPKI does not authenticate real world identity is a feature,
   not a bug "
C: Comma

O: "Note that, if there is sufficient external, i.e. non-RPKI,
   verifcation of authority"
P: Note that, if there is sufficient external, i.e. non-RPKI,
   verification of authority"
C: Typo

Sec 4:
O: "When a document is signed with the private key associated with a RPKI
   certificate"
P: "When a document is signed with the private key associated with a RPKI
   certificate"
C: s/a/an/ - grammar

 Misc:
 s/real world/real-world/g -- I think?

----
Again, I know that many of these are nits, but they'll have to be addressed
at some point, and before everyone reads it and gets riled up is best :-)

W

-- 
Perhaps they really do strive for incomprehensibility in their specs.
After all, when the liturgy was in Latin, the laity knew their place.
-- Michael Padlipsky

---

From: Russ Housley <[email-masked]>
Date: Thu, 3 Mar 2022 10:52:08 -0500

Warren:

Thanks for the review.

> Firstly, thank you very much for this document, and apologies it has taken a while for me to review it.
> 
> I must admit that I *wanted* to / felt I should be able to use the RPKI to do things like sign LOAs and similar "the RIR says I'm the 'owner', seem mah cert!" type things, and so, even though the document makes me sad, it's useful and needed.
> 
> Please let me know LOUDLY once you'd had a chance to address them, and I'll start IETF LC.
> 
> Issues / comments: 
> Sec 1:
> "since" refer to. Perhaps "Since publication of [RFC6480], the term has grown
> to include ..."? Actually, I'm not really sure what the sentence was trying to 

I suggest: "Since initial deployment, the RPKI has grown to include ..."

> P: "That the RPKI does not authenticate real world identity is a feature,

The above suggestions seem fine to me.

>    verification of authority"

Suggestion for the whole paragraph:

   Given sufficient external, i.e. non-RPKI, verification of authority,
   the use of RPKI-based credentials seems superfluous.

> P: "When a document is signed with the private key associated with a RPKI

I can see this one either way.

>  s/real world/real-world/g -- I think?

If you mean in Sec 2:
	s/real world identity/real-world identity/
	s/real world documents/real-world documents/

Russ

---

From: Warren Kumari <[email-masked]>
Date: Thu, 3 Mar 2022 11:01:13 -0500

On Thu, Mar 3, 2022 at 10:52 AM Russ Housley <[email-masked]> wrote:

> > I must admit that I *wanted* to / felt I should be able to use the RPKI
> to do things like sign LOAs and similar "the RIR says I'm the 'owner', seem

Perfect.

> The above suggestions seem fine to me.

Thanks!

>    the use of RPKI-based credentials seems superfluous.

Grteat!

> I can see this one either way.

Me too; I don't really care / whatever you want...

>         s/real world documents/real-world documents/

There are 12 "real world" instances -- I think that the hyphenated version
is cleaner (and some random grammar tool seems to agree), but again, I
don't really care. Whatever y'all think.
W

-- 
The computing scientist’s main challenge is not to get confused by the
complexities of his own making.
  -- E. W. Dijkstra

---

From: Randy Bush <[email-masked]>
Date: Thu, 03 Mar 2022 12:33:11 -0800

-04 pushed

there were many cases of 'real world'  i whacked them all, though i
personally thing 'real world' is fine as it is quite unusual.

i had to run out and buy a bag of commas; as you seem to like them a
lot.

randy

---

From: Warren Kumari <[email-masked]>
Date: Fri, 4 Mar 2022 14:23:22 -0500

> -04 pushed

Thanks, IETF LC requested / started.

> i had to run out and buy a bag of commas; as you seem to like them a

Yup, I get mine in bulk at Costco....

(actually, I run drafts through a grammar tool (Grammarly); it doesn't do a
perfect job (to some extent because it believes that every hard newline in
a text document is a new sentence, and also because, well, terminology),
but it is useful to me for review)
W