Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Sean Turner <sean@sn3rd.com>
In-Reply-To: <793C1123-0398-455C-A316-A2DADB1F400A@sn3rd.com>
Date: Sat, 16 Jul 2016 19:02:53 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <7A61D320-EA64-41D3-AEEF-ACF0F8837CBD@sn3rd.com>
References: <20160708091943.32156.30842.idtracker@ietfa.amsl.com>
 <C570AE8F-A764-43ED-B273-005DABBDC836@ripe.net>
 <793C1123-0398-455C-A316-A2DADB1F400A@sn3rd.com>
To: Tim Bruijnzeels <tim@ripe.net>,
 sidr chairs <sidr-chairs@ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidr/PqXmnr9vpe22QBQu_PVGUbvKgHA>
Cc: sidr <sidr@ietf.org>
Subject: Re: [sidr] I-D Action:
 draft-ietf-sidr-rpki-validation-reconsidered-06.txt
Precedence: list


> On Jul 08, 2016, at 09:00, Sean Turner <sean@sn3rd.com> wrote:
>=20
>=20
>> On Jul 08, 2016, at 05:35, Tim Bruijnzeels <tim@ripe.net> wrote:
>>=20
>> Stephen Kent comment on -04 of this document saying that it should =
not attempt to update the BGPSec Router Certificate I-D because it's not =
an RFC, just yet. It's currently in IESG Processing. The current =
document therefore has a request and some suggestion to the authors to =
change the document (in which case the section can be deleted in the =
next (hopefully final) version of this document.
>>=20
>> I don't mind either way. Maybe the chairs have an idea about what the =
best process is. But in either case we would like to ask the BGPSec =
Router Certificate authors to review the included text.
>=20
> Tim,
>=20
> Just so I=E2=80=99m following along:
>=20
> - This draft replaces the text in RFC 6487 s7.2 so should =
rpki-validation-reconsidered draft include the =E2=80=9CUpdates: 6487 =
(if approved)=E2=80=9D header?  My understanding is that the proposal is =
that all RPKI validators follow these new steps so that would make sense =
process wise.

I would like to propose that sidr-rpki-validation-reconsidered include =
an updates header, i.e., =E2=80=9CUpdates: 6487 (if approved)=E2=80=9D, =
be included on the 1st page of the draft in the appropriate location.

Of the options presented in the change below for =
sidr-bgpsec-pki-profiles, I=E2=80=99d like to rely on the change =
proposed above and not make the OLD/NEW changes I proposed below, i.e., =
I am suggesting making no changes to the introductory text in s3.3 of =
sidr-bgpsec-pki-profiles to refer to sidr-rpki-validation-reconsidered =
because it=E2=80=99s an unnecessary change.

Steve=E2=80=99s suggested some other edits a a result of this thread and =
rpki-validation-reconsidered, so if the chairs direct me I can upload a =
new version of sidr-bgpsec-pki-profiles.  Since AD review hasn=E2=80=99t =
really happened yet, maybe we can treat these as late, but timely WGLC =
comments?

spt

> - bgpsec-pki-profiles s3.3 currently refers to RFC 6487 s7 for =
validation procedures and technically if rpki-validation-reconsidered =
updates RFC 6487 when bgpsec-pki-profiles refers to RFC 6487 it includes =
those references so I wouldn=E2=80=99t necessarily have to add a =
explicit reference to rpki-validation-reconsidered =E2=80=A6 but people =
will forget this and miss the update and I know Wes hates chasing =
references ;)  So, to drive this point home we could do the following =
tweak in addition to adding your suggested bullet and =
separate-certificate per ASN suggestion:
>=20
> OLD:
>=20
>  The validation procedure used for BGPsec Router Certificates is
>  identical to the validation procedure described in Section 7 of
>  [RFC6487], but using the constraints applied come from this
>  specification.
>=20
> NEW:
>=20
>  The validation procedure used for BGPsec Router Certificates is
>  identical to the validation procedure described in Section 7 of
>  [ID.sidr-rpki-validation-reconsidered], but using the constraints
>  applied come from this specification.
>=20
> Note I=E2=80=99d probably also add ID.idr-rpki-validation-reconsidered =
to the required reading list in the terminology section :/
>=20
> spt