Re: [Sidrops] WGLC = draft-ietf-sidrops-aspa-verification - ENDS 03/22/2023 (Mar 22 2023)

Ben Maddison <benm@workonline.africa> Tue, 28 March 2023 08:54 UTC

Return-Path: <benm@workonline.africa>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26A6EC151B12 for <sidrops@ietfa.amsl.com>; Tue, 28 Mar 2023 01:54:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=workonline.africa
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uDTzXObh8agu for <sidrops@ietfa.amsl.com>; Tue, 28 Mar 2023 01:54:48 -0700 (PDT)
Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-he1eur04on2085.outbound.protection.outlook.com [40.107.7.85]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97834C14CE2B for <sidrops@ietf.org>; Tue, 28 Mar 2023 01:54:40 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gdeSo10LTU8HnyhTjB/bdj7SOYkopOTlS1Fn1EMYzBosyM6EVvAwJHShHyDpgpgdvh2fdTXKZn/T+pG1xDxevHOtbPxzC5GTzsCCrBYpPl8Zueru3MewS+WKZcwtxMJzf4Ctht6/1tPOgZio7c644gQrG7Q7EfYrspfG5MQRpe88Qvylo+nE1GRsOfEW1ft+sjSb8u3NtHsclnGAsbdynpSu6CWKUClx56BAYGPeylWbHcTEKSfTe6P34Tjv9J3pyVy+naYoaPP/EtRBc62BRctzOuwC920d+M4ZwyQDcTDOIsDBS4Kxo3vre4Zv9fz6v2MQqSVlTFJFpnxpZOr6WQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=TCKp/JxBx81etGzaC/muZiawTeezn6wlDD3tcsQJjkQ=; b=Xm5zeu4Iq29858yS+e6i3tveGv2SRsgj2YZUNQSc/5iCEa3fLJJqluKxbgDhkAlFkFnput9yXn1E2u+A+Q3Vt0vNQmA2wm1fjY+diQQjQ+wGF8UlFqIeSpfI+se6Azfu7aDe3LzeYevgyHyC5SYqkkUrjKEGPpOZfwXoawxocF4V55ebQBGiZp88DeVwyxT+wb50DN5/M5gZedWUjn0dsaLq0IKgt6IF2dWa1uLVJOI5E0MxWcHlJSHN0AFw/vz5JrvRRNNa7MoX7rL34Ut4FeKfxkvdIIzfgi4vpU7nF+FWm492t6os+7wYnA2ycMGpvV+6+QR30zdvm98FeQQfQw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=workonline.africa; dmarc=pass action=none header.from=workonline.africa; dkim=pass header.d=workonline.africa; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=workonline.africa; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TCKp/JxBx81etGzaC/muZiawTeezn6wlDD3tcsQJjkQ=; b=pE/yTnzgIiq9reRuMfxnv9zNI6A60VGK2oxmMAsQQjarMR08bcHVj2BbkiU2zqYJgnV3kQ926Vt+JbozLC+E+LaBuUI2agk/HimvxyZE0t9X8EO8YTsSCks/p85/EY5Vg76lxh0kYkCqUVTSo5Gzzh1CB7w4gBpNF2JJu0pf7Hc=
Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=workonline.africa;
Received: from AS8P190MB1078.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:2e7::13) by PA4P190MB1101.EURP190.PROD.OUTLOOK.COM (2603:10a6:102:102::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6222.33; Tue, 28 Mar 2023 08:54:37 +0000
Received: from AS8P190MB1078.EURP190.PROD.OUTLOOK.COM ([fe80::3723:118a:8022:ba32]) by AS8P190MB1078.EURP190.PROD.OUTLOOK.COM ([fe80::3723:118a:8022:ba32%5]) with mapi id 15.20.6222.033; Tue, 28 Mar 2023 08:54:37 +0000
Date: Tue, 28 Mar 2023 17:54:26 +0900
From: Ben Maddison <benm@workonline.africa>
To: Claudio Jeker <cjeker@diehard.n-r-g.com>
Cc: Martin Hoffmann <martin@nlnetlabs.nl>, Amreesh Phokeer <phokeer=40isoc.org@dmarc.ietf.org>, "sidrops@ietf.org" <sidrops@ietf.org>, Aftab Siddiqui <Siddiqui@isoc.org>, Max Stucchi <stucchi@isoc.org>, Hanna Kreitem <Kreitem@isoc.org>
Message-ID: <20230328085426.dadqyjri7677hbkc@iolcus>
References: <SJ0PR06MB7677230255CC9134CAF94E98D6879@SJ0PR06MB7677.namprd06.prod.outlook.com> <ZBxfj74YFy/5Fhax@diehard.n-r-g.com> <20230323162051.3069b516@glaurung.nlnetlabs.nl> <ZBx7DrM3Vjf/tSms@diehard.n-r-g.com>
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="t3hwkyjnsyppjtvq"
Content-Disposition: inline
In-Reply-To: <ZBx7DrM3Vjf/tSms@diehard.n-r-g.com>
X-ClientProxiedBy: TYAPR01CA0132.jpnprd01.prod.outlook.com (2603:1096:404:2d::24) To AS8P190MB1078.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:2e7::13)
MIME-Version: 1.0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AS8P190MB1078:EE_|PA4P190MB1101:EE_
X-MS-Office365-Filtering-Correlation-Id: bf6e7625-6a56-4044-c084-08db2f6a0f4a
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: crUbfFr7bFB7JCTin4GYOaP1tStpuBFvLbN5sFXvXDa3qDJ6DDgnOOS5Lc4aAdkd5Xhz7GgclKyPculYbXrZQPfV7uJiIq8n/+QM+YuFOOwAYSjmvTIfd73IgP4rc50yYCYnxha6Jp2lpi0SEFs+XCk5SvcD0JFne2yaQfjtVhEtbivb7kp2IyJ5MEcJC6H+5XtOAVwabQccQMTaphyIpxU0nOHesljD8sOfZ78YYAiH02HRF8ZennO10n3UISzltZyKHDD2ilN9npFKA/zDy1Bkyh7ZexZ0Z2My81gAuVJvpQ/gDgNmxr2Jjz3c/sYngrvFfUQ36iSA4tGKkUux2btqJ9bcMkwyTu/rQQGmTrsv6mE2N9Hm7liMslS+laz6aQ8xgQSoZVYZcFpBi1AniABKC1UwW+fj8NGcCuDklg3Ii4KmTXFnmlIrGimDuu6Yq3oywd+1v0gYz3OEOjLtDRQLomteRDmASDm0ctomGsMuPQega8/YVUY8Mvu0IMfVO5xhs20BfFAmtQTRZbVXjVal0yBPR9FTAjrI3TGbsORKS7bPdvNJJL448L/cuCjl4tpEwoBW7lhI2LT32gYfgYFkjpv5FFfGFKR3/sR5SiExZJiyW6c3SmWg3Cc3hmC1Vbqr4UouJXdD3GjBY+d9ww==
X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AS8P190MB1078.EURP190.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230028)(7916004)(39840400004)(376002)(366004)(346002)(136003)(396003)(451199021)(5660300002)(8936002)(6916009)(4326008)(66946007)(66556008)(66476007)(8676002)(41300700001)(38100700002)(2906002)(15650500001)(6666004)(33716001)(44144004)(6512007)(6506007)(1076003)(9686003)(6486002)(186003)(21480400003)(83380400001)(316002)(86362001)(478600001)(54906003)(46492015)(2700100001); DIR:OUT; SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 5or3sII4WK5L4CBfzGoAoyeU+2Sk1dwdxCg3MwQVDuKtbuASxr6YK5HvV3MpffxBvvj+/jWjGtP5RYBNntUwL+LLd/Rk3e348Ir9Bb8+ZVmZRDjAGPl7bQiQtu8GhtbwrnHd/YlUnkNJFGSVC/didtapxhE1SqxYnaQE8wRk0Wmssk27Ympl31RUF6mQTCis7HvYKwMuYsHhQb7o3Xrd/1uRagfyvJeGWtiAnGH5OS9C1jRw4GmwCNYXzoaKSn0OKDEoxst78/fEFLzyFo5bdCtj+LSHcHXklN8Fc8FP+fP7CDfcOeIOJ/cfztvcH/n6SFT3t1ny7jlmC7RC1fSbv9ctzZ5a7mvYwVbLJNEMJxn+sYk5/+1bhvQrZrT+vjdikJNVQaHMjUQmsNuD9LnL5l0qWZeCrD/I8zjeCDfR45kyKpMpr1AnpSRaIgvlJ/3f3Bl1X6VQJLDUHG/0ZzrM7yraD5HcrQqgcjN0+NDmVlJLhDTUPc4NfYuGftvDb3P2HM9M2HfbrohJ28zWqbJNKBKKzrXSbpVOlOYHdjsUExnAoGScD4Ao305l5hq+hG/I/E1fHmy51SbB2vxo2365To6gnFUB8cc3JSnXvs1g8HBSfHV7+K38l1aZ2C58vOYgnTzB+jj06PcnEcugMMsHdbLLmh3LAkULj6yMnV7/n1JCrjLDjXvPjKx8UHvM5hsbntaTtKBllDUs3TtSXbnQHFvAGiPybRkaFeZ7VqvAE8ovBYZYyGPR5r8gGwBYm6TwQokLHCETHg+jxsyDesMdaOkjQJpMLtA9ds/+5N3ndh2cWrWmro9MxRe4GLWl9UfGTzr4AnpANmippgPXTRC7njGE51qsQfjHo/DP679+eV4LSstAarselT2CHAUwAFmCOwIENZTl5Do896THPAfIV71BTVlYNvn7OHYaBkcHnwxhRbgZ+aq/8kpUMs31cLz5CTWPHQ5efMHl9Se9zqFsjDUTKDUvOFT7m2sV/9NDTMaskyEFwYQnqrZwaDGnEAqpXaFyCbLzRvFDIebGS6XVJhkFTEIRoTiuQokdx9tdA2Ih2P2kRzBGMZL+GHr1CjDQaP199llvhZNKTV96XewMiraEiJ/sy8cCECuczHvB0z/5g9YFnBv1625LD1QhfJjdzrdhxH3enqDVi02a/vQPhmuoSk7+aIjJJTGIMY8BaQZh1QPSU9N9eh5Vwc2/2OqUwSa7berSvFtaJ/1TLC0JTL0m0Y1ng8Yd1yt1ty4MnZSezORmv+thcQX/Sqte0OWyJ5K5ej2yasi60B7BjpQuwfu+AOQHfb7G4PrARbuEZwqynVAEqRwiVLJMF59KBYaE3Ho+Tx2CZqYt11JLJggGc4qHWA15F2l1rSbtdbgUYK1JsT267F2tdLi3bKXrV9k+yyvDtsusKEJ9oMHAy6FmstHSdReXexAK812NU2oMSYx1pr8DDl98LKj2sLzt7YbHzeFW3vxXRz/pBNXEQgZuGErGaJUSuMGm2u3DyxrfdF0V62RqSvNxpV4g94E0sAFnxmfzd86hPQ3ChB0ecwydYKvRodyX/PWwNBc/ezrLHFhY0ftDEY7Q/LU3mn2CXH/nUPF+0u1KeTSf3OEIRZWcjj6M84sonw4MRuERHsGe5jXKWZxynQAABrS4XygpCxEB
X-OriginatorOrg: workonline.africa
X-MS-Exchange-CrossTenant-Network-Message-Id: bf6e7625-6a56-4044-c084-08db2f6a0f4a
X-MS-Exchange-CrossTenant-AuthSource: AS8P190MB1078.EURP190.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Mar 2023 08:54:37.6291 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: b4e811d5-95e8-453a-b640-0fba8d3b9ef7
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 6mmNmImpQoyqLI77wrCgVPn+/LCzKNcfZuGwO58JOIa57rXcpB1+xhye8fjK+Lr7jnUNes5rGjjAUsyjzTQRRw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4P190MB1101
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/28AXLdr7Y_zcLKB38_qKG-mvNj8>
Subject: Re: [Sidrops] WGLC = draft-ietf-sidrops-aspa-verification - ENDS 03/22/2023 (Mar 22 2023)
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Mar 2023 08:54:53 -0000

Hi Claudio,

On 03/23, Claudio Jeker wrote:
[..]
> I have a major issue with duplicating the CAS lookup table. The
> implication for BGP implementations is twice the memory consumption and
> more then double the computational cost and that in the most latency
> sensitive portion of the code. A lot of time is spent in getting the most
> performance out of BGP and so this should be a major consideration when it
> comes to ASPA validation.

Would you elaborate on this?

I get why the memory usage increases with this approach.

It's not obvious to me why the computational cost of the verification
process is higher with a per-AFI table.
Intuitively this seems like it should be a *cheaper* lookup, since you
don't have to filter for AFI at lookup-time.

I would be interested to hear whether this is the case for other BGP
implementers too.

I had previously argued that the expansion into per-AFI sets should
happen at the RP, based on the above intuition.
If I got that wrong, then I agree the VAP/RTR payload datastructure
should change to match the object profile.

Cheers,

Ben