Re: [Sidrops] request to consider draft-spaghetti-sidrops-rpki-prefixlist for WG adoption

On the technical level, no overlap because they are different objects. 

On the validation level, do have overlaps because both Prefix List and REAP (More precisely, REAP+ROAs) can indicate the complete set of prefixes that an AS can advertise. 

Best,
Nan

> -----Original Message-----
> From: Sidrops <sidrops-bounces@ietf.org> On Behalf Of Job Snijders
> Sent: Wednesday, July 26, 2023 1:47 AM
> To: Sriram, Kotikalapudi (Fed) <kotikalapudi.sriram@nist.gov>
> Cc: sidrops-chairs@ietf.org; Montgomery, Douglas C. (Fed) <dougm@nist.gov>;
> Geoff Huston <gih@apnic.net>; sidrops@ietf.org
> Subject: Re: [Sidrops] request to consider draft-spaghetti-sidrops-rpki-prefixlist
> for WG adoption
> 
> Dear Sriram,
> 
> On Tue, Jul 25, 2023 at 05:36:14PM +0000, Sriram, Kotikalapudi (Fed) wrote:
> > Hi Chris, Keyur, Russ,
> >
> > I wish to point out respectfully that this draft largely overlaps with
> > the REAP (ROAs Exist for All Prefixes) draft authored by Doug and
> > myself (-00 published in July 2020):
> 
> I am not sure the drafts overlap.
> 
> In REAP the AS holder attests 'a boolean', that all prefixes they might originate
> are covered by ROAs. This means that a prefix holder can create a ROA
> authorizing the AS that created a REAP object, and then proceed to spoof the
> REAP-AS and cause misattribution.
> 
> In the prefixlist approach the AS holder attests an actual list of prefixes they
> might originate, regardless of whether ROAs exist.
> 
> On a technical level I see no overlap as the two approaches have different
> security properties and different execution, and offer different functionality.
> 
> Where there might be overlap is that both drafts aspire to improve the routing
> security of the Internet.
> 
> > https://datatracker.ietf.org/doc/html/draft-sriram-sidrops-as-hijack-d
> > etection-06
> >
> > We presented it at IETF 108 and received feedback (including from Job). The
> video of my presentation is here:
> >
> > https://youtu.be/6kZaf-hyEGU?t=2310
> > Slides:
> > https://datatracker.ietf.org/meeting/108/materials/slides-108-sidrops-
> > draft-sriram-sidrops-as-hijack-detection-00-00
> >
> > The two draft have common objectives and similarly approach the
> > problem by proposing a new RPKI signed object. Basically, an attacker
> > is prevented from spoofing an ASN, i.e., if they announce a prefix not
> > covered by ROA while spoofing the mentioned ASN as the origin AS, then
> > their route will get an Invalid valuation rather than NotFound (due to
> > presence of the proposed new RPKI object).
> >
> > Doug and I will be happy to join with Geoff and Job to merge the best
> > from each draft into one draft going forward. I am hoping Geoff and
> > Job are amenable to that.
> 
> Of course we appreciate your contributions!
> 
> > Can you kindly hold back on the WG adoption call so the four of us can
> > attempt to find a way to work together and have one draft?
> 
> I am not 100% sure what a delay buys us, but before or after WG adoption
> there is room for contributions from additional authors.
> 
> With REAP in mind, what would you change about the current prefixlist draft?
> 
> Kind regards,
> 
> Job
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops