[Sidrops] Re: New Version Notification for draft-sriram-sidrops-spl-verification-00.txt

I have read this draft and support adoption.

I also feel that the application of SPL needs more discussion.

My comments and questions are as follows:

In Table 1, the stats of ROA-ROV-state=NotFound and SPL-ROV-state=Valid will
generate the state 'Eligible'. I feel that this 'Eligible' is not so
Eligible and SPL may introduce potential risk easily. An AS A may insert a
prefix not covered by a ROA into its SPL, but AS B is also announce this
prefix and include it in its SPL. Either A or B may make a (malicious)
mistake. Although the operators of AS A and B may find out what's wrong with
it after negotiation, the event could have happened for a while. 

I feel that the state SPL-ROV-state=Invalid is more credible than
SPL-ROV-state=valid, because any AS does not want the prefix  originated by
it legally to be validated as 'invalid' and blocked. The power of SPL is as
a 'invalid' filter for prefixes.

And, it seems that SPL cannot help save on ROA registration. If a prefix is
requested to be included in the SPL, the appropriate ROAs also need to be
registered in advance, as mentioned in 7.4, 7.2 and this recommendation
should be required in 7.1 (the prefix owner may decide to split its prefix,
it should register ROAs for more-specific prefixes). 

Best regards,
Yangyang

> -----Original Message-----
> From: forwardingalgorithm@ietf.org [mailto:forwardingalgorithm@ietf.org]
> On Behalf Of Sriram, Kotikalapudi (Fed)
> Sent: 2024年3月17日 23:39
> To: sidrops@ietf.org
> Cc: sidrops-chairs@ietf.org
> Subject: Re: [Sidrops] New Version Notification for
draft-sriram-sidrops-spl-
> verification-00.txt
> 
> A new draft on "Signed Prefix List (SPL) Based Route Origin Verification
and
> Operational Considerations" was just uploaded.
> Please see abstract and links below. Comments welcome.
> 
> Sriram
> 
> -----Original Message-----
> From: internet-drafts@ietf.org <internet-drafts@ietf.org>
> Sent: Sunday, March 17, 2024 11:21 AM
> To: Montgomery, Douglas C. (Fed) <dougm@nist.gov>; Job Snijders
> <job@fastly.com>; Sriram, Kotikalapudi (Fed)
<kotikalapudi.sriram@nist.gov>
> Subject: New Version Notification for
draft-sriram-sidrops-spl-verification-
> 00.txt
> 
> A new version of Internet-Draft
draft-sriram-sidrops-spl-verification-00.txt
> has been successfully submitted by Kotikalapudi Sriram and posted to the
> IETF repository.
> 
> Name:     draft-sriram-sidrops-spl-verification
> Revision: 00
> Title:    Signed Prefix List (SPL) Based Route Origin Verification and
> Operational Considerations
> Date:     2024-03-17
> Group:    Individual Submission
> Pages:    10
> URL:      https://www.ietf.org/archive/id/draft-sriram-sidrops-spl-
> verification-00.txt
> Status:   https://datatracker.ietf.org/doc/draft-sriram-sidrops-spl-
> verification/
> HTML:     https://www.ietf.org/archive/id/draft-sriram-sidrops-spl-
> verification-00.html
> HTMLized: https://datatracker.ietf.org/doc/html/draft-sriram-sidrops-spl-
> verification
> 
> Abstract:
> 
>    The Signed Prefix List (SPL) is an RPKI object that attests to the
>    complete list of prefixes which an Autonomous System (AS) may
>    originate in the Border Gateway Protocol (BGP).  This document
>    specifies an SPL-based Route Origin Verification (SPL-ROV)
>    methodology and combines it with the ROA-based ROV (ROA-ROV) to
>    facilitate an integrated mitigation strategy for prefix hijacks and
>    AS forgery.  The document also explains the various BGP security
>    threats that SPL can help address and provides operational
>    considerations associated with SPL-ROV deployment.
> 
> 
> The IETF Secretariat
> 
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops