Re: [Sidrops] WGLC = draft-ietf-sidrops-aspa-verification - ENDS 03/22/2023 (Mar 22 2023)

[Job Snijders <[e-mail]>]

Hi Igor,

On Sat, 25 Mar 2023 at 12:29, Lubashev, Igor <ilubashe=
[e-mail]> wrote:

> An alternative to a special 'AS 0 ASPA' would be allowing a zero-length
> Provider AS list. Then there are no special rules at all.
>


Please take a moment to appreciate Section 7 of
https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-profile

At this point in time a very strong justification would be required in
order to change the ASPA object profile.

Changing to “zero-length” requires a non-trivial update to the ASN.1
profile in the internet-draft, and requires a number of implementers to
change their code. Are you maintaining a Relying Party or Signer
implementation yourself?


But if 'AS 0 ASPA' is used, a further special rule is needed to describe
> how a 'union' is taken when both 'AS 0 ASPA' and a 'normal' ASAP are
> present (maybe from different RPKI registries).
>


A sentence to clarify that if two valid ASPA objects are present, AND their
respective ProviderSets are different, AND one contains a ProviderSet that
contains a single entry listing AS 0 as provider, the latter object might
as well not exist, because it contains superfluous information?

(That’s how it kinda works for ROAs when one ROA authorises AS0 and another
ROA for the same IP Prefix(ex) authorises some other ASN.)

Kind regards,

Job

>