Re: [secdir] [Last-Call] Secdir last call review of draft-ietf-opsawg-finding-geofeeds-06

[Randy Bush <[e-mail]>]

just a quickie.  i will try to get to the other stuff after $dayjobs

assumptions that the rpki and the inetnum: are congruent in ip address
space are quite unsafe, sad to say.

the granularity of the rpki is not that of the inetnum: space.

for a tragic example, among other things, in the arin (noam) region,
most address space can not get rpki data for artificial political
reasons[0].

and in a sane region, emea, if i am an LIR and get a /32 from ripe, and
get an rpki cert for it; i can delegate a /56 to a customer with an
inetnum: and sadly they tend not to get rpki certs, but have geoloc.

geofeed adoption is being driven by social pressure, customers want
their mtv and are loud about it.  rpki adoption is driven by operator
gossip, not money.

these conditions will continue for years, though not as long as ipv6
take-up.  the draft is deployable on today's internet with today's
administrative and technical infrastructure.  in fact, it is deployed
and working.

more later

randy

[0] - https://scholarship.law.upenn.edu/faculty_scholarship/2035/