Re: [sidr] I-D Action: draft-ietf-sidr-algorithm-agility-01.txt

Sandra Murphy <Sandra.Murphy@sparta.com> Mon, 11 July 2011 15:22 UTC

Return-Path: <Sandra.Murphy@cobham.com>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A72DC21F86AA for <sidr@ietfa.amsl.com>; Mon, 11 Jul 2011 08:22:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -100.037
X-Spam-Level:
X-Spam-Status: No, score=-100.037 tagged_above=-999 required=5 tests=[AWL=2.562, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id geTTP2922boN for <sidr@ietfa.amsl.com>; Mon, 11 Jul 2011 08:22:26 -0700 (PDT)
Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 6B8A421F86DF for <sidr@ietf.org>; Mon, 11 Jul 2011 08:22:09 -0700 (PDT)
Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id p6BFM74v002617; Mon, 11 Jul 2011 10:22:07 -0500
Received: from mailbin2.ads.sparta.com (mailbin.sparta.com [157.185.85.6]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id p6BFM7As029630; Mon, 11 Jul 2011 10:22:07 -0500
Received: from SMURPHY-LT.columbia.ads.sparta.com ([157.185.81.116]) by mailbin2.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Mon, 11 Jul 2011 11:22:06 -0400
Date: Mon, 11 Jul 2011 11:22:06 -0400
From: Sandra Murphy <Sandra.Murphy@sparta.com>
To: Roque Gagliano <rogaglia@cisco.com>
In-Reply-To: <C6D4299F-7C55-4420-B114-A829533A981C@cisco.com>
Message-ID: <Pine.WNT.4.64.1107111119490.3744@SMURPHY-LT.columbia.ads.sparta.com>
References: <20110708161252.27961.972.idtracker@ietfa.amsl.com> <42FAFCD2-C5F0-471C-8E90-A6AF0EC17DE6@cisco.com> <AAA28269-7DC5-4E19-A05B-6FAA4DF01388@cisco.com> <C6D4299F-7C55-4420-B114-A829533A981C@cisco.com>
X-X-Sender: sandy@mailbin.sparta.com
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
X-OriginalArrivalTime: 11 Jul 2011 15:22:06.0533 (UTC) FILETIME=[4B49F750:01CC3FDE]
Cc: "sidr@ietf.org wg" <sidr@ietf.org>
Subject: Re: [sidr] I-D Action: draft-ietf-sidr-algorithm-agility-01.txt
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sidr>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Jul 2011 15:22:27 -0000

On Mon, 11 Jul 2011, Roque Gagliano wrote:

> Hi Brian,
>
> Thank you very much for your review.
>
> Please see my comments inline.
>
> Roque
>
> On Jul 8, 2011, at 9:08 PM, Brian Weis wrote:
>
>> Hi Roque,
>>
>> This draft seems very complete. I have just a few questions and comments:
>>
>> 1. Section 2. "A failure to comply with this process during an algorithm transition MUST be considered as non-compliance with ...
>> I-D.ietf-sidr-cp". I can't detect in the CP where failing to comply with this process would be result in non-compliance. It would be hopeful to more specific here.
>
> (Roque) This is good feedback but I think we cannot delay the publication of the CP document. The idea is that the Algorithm Suites definition are part of the CP, consequently, the process to modify these suites should also be consider as a global RPKI requirement and thus tied to the CP.
>

You seem to be saying that the alg transition mechanism is an addition to
the global cert policy - an addendum/update of the CP (RSN an) RFC.

True?

If so, that should be noted.

--Sandy, speaking as wg chair, ceremonial vestments and badges donned


>>
>> 2. Section 3. The definition of a "Non-Leaf CA" is "A CA that issues certificates to entities not under its administrative control." I believe this effectively  means "CAs that have children", and if that's the intended meaning perhaps that's a better statement. The present definition could apply to a CA cross-certifying another CA and other non-child certificate signing. Even if those situations don't expect to be possible within the RPKI, it would be helpful to clarify the definition. Also, it's not clear to me that a child CA is "under its administrative control" in the sense that the child CA (e.g., ISP) might not be administered by the parent (e.g., RIR).
>
> (Roque) These are the "CA that have children and with whom the signaling is carried out through the provisioning protocol".
>
> What about changing the definition to"
>
> Non-Leaf CA: A CA that issues certificates to external entities by using the provisioning protocol described in [PROV.].
>
>>
>> 3. Section 4.2. "The only milestone that affects both CAs and RPs, at the same moment is the EOL date.". But the "Process for RPKI CAs" figure shows that two milestones are aligned: (5) and (6). How do these reconcile?
>
> (Roque)
> I will change that, however, the milestone 5 (Twilight Date) is the date where the NEW becomes CURRENT and the CURRENT becomes OLD. If the RP and the CA did their part of the work, they should both be ready at that time to issue/revoke and validate certificates with both algorithms, so there is no "action" that should be taken at
>
>>
>> 4. Section 4.3. The alignment errors that Arturo mentioned don't seem to be fixed in -01. Did you mean to adjust them? Also, it might be worth stating explicitly in the Note following this first example that the indentation mean "signed by".
>
> (Roque)
> Thanks. I will correct and do better "quality control".
>
>>
>> 5. Section 4.5. "During this phase all signed product sets MUST be available using both Algorithm Suite A and Algorithm Suite B." It isn't clear to me what "During this phase" means in Phase 2. Does it mean "By the end of this phase"? Or does it mean "Before the start of Phase 3", which is not the same moment in time according to the figures in Section 4.2. I'm inclined to think it means "Before the start of Phase 3", because by Phase 3 "all product sets are available". Although again, Section 4.6 uses the phrase "During this phrase" so that also isn't clear and I would recommend being more precise here too.
>
> (Roque) "During this phase" means since start to end of these phase (i.e. after "CA Go Algorithm B date"). In Phase 2 all products are available using both algorithms but not all RP MUST validate them both, that only happens in Phase 3 (after "RP Ready Algorithm B Date")
>
>
>> 6. Section 4.5. "An RP that validates all signed product sets using both Algorithm Suite A or Algorithm Suite B, SHOULD expect the same results." The text added to this paragraph in -01 clarifies how to resolve certificate validation results that differ, but I think it would be helpful to include references to both Sections 6 and 7 here which cover issues when on there are differences in validation more thoroughly.
>
> (Roque) ok. will add.
>
>> 7. (nit) The references for I-D.ietf-sidr-cp didn't get updated to -17. I didn't check other references.
>
> (Roque) ok.
>
> Thanks again,
>
> Roque
>
>>
>> Thanks,
>> Brian
>>
>> On Jul 8, 2011, at 9:14 AM, Roque Gagliano wrote:
>>
>>> In this new version we included the changes from the review by Arturo and several editorial nits.
>>>
>>> Please take a look at the document and send your comments.
>>>
>>> Roque.
>>
>> --
>> Brian Weis
>> Security Standards and Technology, SRTG, Cisco Systems
>> Telephone: +1 408 526 4796
>> Email: bew@cisco.com
>>
>>
>>
>>
>>
>
>