IETF Logo Mail Archive

Re: [Last-Call] [secdir] Secdir last call review of draft-ietf-opsawg-finding-geofeeds-06

Randy Bush <randy@psg.com> Wed, 05 May 2021 14:38 UTC

Return-Path: <randy@psg.com>
X-Original-To: last-call@ietfa.amsl.com
Delivered-To: last-call@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F5673A0F2E; Wed, 5 May 2021 07:38:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YB6awzER7M_v; Wed, 5 May 2021 07:38:48 -0700 (PDT)
Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53AC93A0F0E; Wed, 5 May 2021 07:38:48 -0700 (PDT)
Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from <randy@psg.com>) id 1leIfk-0001Dj-DA; Wed, 05 May 2021 14:38:44 +0000
Date: Wed, 05 May 2021 07:38:43 -0700
Message-ID: <m24kfhnt3g.wl-randy@psg.com>
From: Randy Bush <randy@psg.com>
To: Kyle Rose <krose@krose.org>
Cc: Russ Housley <housley@vigilsec.com>, Last Call <last-call@ietf.org>, Ops Area WG <opsawg@ietf.org>, draft-ietf-opsawg-finding-geofeeds.all@ietf.org, IETF SecDir <secdir@ietf.org>
In-Reply-To: <CAJU8_nUE3qTmRmyE3=88DzzyXbYdvq7-aceNV=bgrMUSv4W1kw@mail.gmail.com>
References: <161969840202.30267.8231145700644479792@ietfa.amsl.com> <m21rasx3tc.wl-randy@psg.com> <CAJU8_nW2aA1SFjeAwzK+CYHPyQqJHLKYu3J9H91NpYfqhTYBWA@mail.gmail.com> <809A05C9-8ABD-4D63-970D-D3F8A2277F28@vigilsec.com> <CAJU8_nX-Timmuvv=vBpgXHYnbCLAd2ug-=BLy_Xp08ehLkGv9w@mail.gmail.com> <F6F67CB5-C824-4DA7-A85E-06EB4EBAD101@vigilsec.com> <CAJU8_nXr9MVefjgNxatfuAEWrvp+TzwLN3zGO8TVRmDJxTEoSQ@mail.gmail.com> <BF277402-4404-4D0D-9027-826C169E1A6F@vigilsec.com> <CAJU8_nUE3qTmRmyE3=88DzzyXbYdvq7-aceNV=bgrMUSv4W1kw@mail.gmail.com>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue")
Content-Type: text/plain; charset="US-ASCII"
Archived-At: <https://mailarchive.ietf.org/arch/msg/last-call/m3ScYWvZlVrfqSZM9UniM_ABmpU>
Subject: Re: [Last-Call] [secdir] Secdir last call review of draft-ietf-opsawg-finding-geofeeds-06
X-BeenThere: last-call@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF Last Calls <last-call.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/last-call>, <mailto:last-call-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/last-call/>
List-Post: <mailto:last-call@ietf.org>
List-Help: <mailto:last-call-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/last-call>, <mailto:last-call-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 05 May 2021 14:38:52 -0000

> Pivoting for a second, are you intending to support the case in which
> a provider has adopted RPKI but has no intention of signing these
> files?

unfortunately, this will be common for a while.  methods for signing
with keys from the rpki are baroque at the moment, with two documents
   draft-ietf-sidrops-rpki-rta-00
   draft-spaghetti-sidrops-rpki-rsc-03
proposing means.

> If so, then web PKI integrity (i.e., being able to trust that the data
> at the https geofeed URL is controlled by the same entity that
> controls the routing data) is still required to prevent forgery.

the draft does require tls for the temporary remarks: based url.  it
will be fixed to do so for the geofeed: url.

the web pki is not associated with ip address space control/ownership.
web pki is based on control of domain name space.  the two are quite
unrelated.

randy

v2.23.0 | Report a Bug | By Email