Re: [Sidrops] nlnet rp and rsync

[Martin Hoffmann <[e-mail]>]

Randy Bush wrote:
> rrdp is more fragile.  e.g. the nlnet labs client (rightly, imiho)
> checks the full certificate chain.  if any piece of the chain expires,
> is CRLed, ... the client does not go to rsync.  bam!

I would argue that operating an rsync server is much more fragile in
practice, simply because operators have much less experience with it.
As opposed to keeping an HTTPS server up and running which is absolutely
essential to each and every Internet operation now. 

If a certificate appears on a CRL, there is probably a good reason for
it and perhaps the service shouldn’t be trusted anymore.

> falling back to rsync is not a 'downgrade' in that the rpki uses an
> object, not transport, security model.

It has been demonstrated that by maliciously withholding RPKI objects
you can cause damage to the routing system, so we should perhaps
revisit the choice of not relying on transport security.

> the goal in rrdp was to make the rpki more, not less reliable.  we
> found the nllnet labs misfeature in the wild when CA data were no
> longer fetched.  imiho not good.

Was that a permanent issue or did the CA in question fix their RRDP
service in due time? From what I am seeing, the current shift to reject
stale manifests and CRLs will cause much more issue.

Kind regards,
Martin