Re: [sidr] WGLC: draft-ietf-sidr-bgpsec-reqs

[Christopher Morrow <[e-mail]>]

On Tue, May 20, 2014 at 10:38 AM, Randy Bush <[e-mail]> wrote:
>> i didn't update the tracker... (i hadn't ever in the past).
>
> uh, that is between you and the datawhacker
>
>> Did we circle down on an answer for the leak/persay language that
>> everyone's happy with? If so I'd like to push out a pub request today.
>
> as far as i am aware, there is no issue with leak language.  we got past
> folk looking up 'per se' in their dictionaries.  the one open issue is
>
>     >>>>>   3.14  While the trust level of a route should be determined by the
>     >>>>>         BGPsec protocol, local routing preference and policy MUST then
>     >>>>>         be applied to best path and other routing decisions.  Such
>     >>>>>         mechanisms SHOULD conform with [I-D.ietf-sidr-ltamgmt].
>     >>>>> ...
>     >>>>>   3.17  If a BGPsec design makes use of a security infrastructure, that
>     >>>>>         infrastructure SHOULD enable each network operator to select
>     >>>>>         the entities it will trust when authenticating data in the
>     >>>>>         security infrastructure.  See, for example,
>     >>>>>         [I-D.ietf-sidr-ltamgmt].
>     >>>
>     >>> What about adding that "the connection to this security infrastructure
>     >>> MUST be through a secure channel"?
>     >
>     > it's done via rcynic and/or rpki-to-rtr, right? depending on where in
>     > the process you are... presuming the process looks like:
>     >   publication-point - gatherer - cache - router
>     >                       (rcynic)     (rcynic)   (rpki-rtr)
>
>     apologies to roque.  some external data were indeed what was meant (an
>     rpki-like thing is an example), and was inteneded by "security
>     infrastructure."
>
>     the authenticity of those data is an issue.  we might say so in sec
>     cons.
>
> and i am waiting for wglc to close so i can make the hack once.

Roque, is the change/text ok? or ?