Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06

[Randy Bush <[e-mail]>]

> Prefix validate assumes full knowledge of all applicable ROAs (or
> other sources of information if they are used) 

no, it can not.  there is no notion of global completeness in the RPKI,
only manifests to resist object removal attack.  from origin-ops

6.  Notes

   Like the DNS, the global RPKI presents only a loosely consistent
   view, depending on timing, updating, fetching, etc.  Thus, one cache
   or router may have different data about a particular prefix than
   another cache or router.  There is no 'fix' for this, it is the
   nature of distributed data with distributed caches.

   Operators should beware that RPKI caches are loosely synchronized,
   even within a single AS.  Thus, changes to the validity state of
   prefixes could be different within an operator's network.  In
   addition, there is no guaranteed interval from when an RPKI cache is
   updated to when that new information may be pushed or pulled into a
   set of routers via this protocol.  This may result in sudden shifts
   of traffic in the operator's network, until all of the routers in the
   AS have reached equilibrium with the validity state of prefixes
   reflected in all of the RPKI caches.

randy