Re: [Sidrops] request for call for Working Group adoption draft-spaghetti-sidrops-rpki-validation-update

[Job Snijders <[e-mail]>]

On Thu, Apr 22, 2021 at 11:14:04AM -0700, Randy Bush wrote:
> while i suspect that idr will not be overly excited, i am fairly sure
> the security community, especially the pki folk, will be *very*
> interested

The 'security community' is most welcome to provide review! Please
invite them. They should be interested! I look forward to read actual
arguments for- or against- the proposal (which is to apply the RFC 8360
validation algorithm to today's most popular policy OID). The SIDROPS
working group definitely would benefit from more scrutiny. :-)

The purpose of the internet-draft is to have a actual proposal in hand
for discussion. The draft in its current form should be suitable for
this purpose, it points at a problem, and it describes a solution.

I am not exactly thrilled to go pound sand via a decades long
'requirements' -> 'evaluation' -> 'solutions' dance, especially since
this exact discussion already is 10+ years old. From what I understand,
no IETF tool was left unused to prevent this validation algorithm from
actually being deployed.

A call for working group adoption will make it clear whether the working
group is interested to continue discussion of the problem at hand and
the potential solution. If the working group does not wish to adopt this
document, so be it.

Even if the working group does adopt the internet-draft, I am not
certain it'll make it to the RFC publication queue. Some study and
testing is warranted. WG adoption does not equate RFC publication.

The proposal *is* complicated (just like the current algorithm actually
is quite complicated), and there are additional complications related to
whether technical debt exists (or not exists) in 'libcrypto'. At the
same time all validators already have a bunch of workarounds for
rfc3779 'libcrypto' quirks, and the APIs are diverging as years go by.

It would be my preference to focus discussion on the technical merits of
RFC 8360-algorithm and any potential positive or negative implications,
rather than focus on bureaucratic process.

Kind regards,

Job