Re: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-profile-15.txt

[Ties de Kock <[e-mail]>]

Hi all,

> On 29 Jun 2023, at 11:58, Martin Hoffmann <[e-mail]> wrote:
> 
> Job Snijders wrote:
>> On Wed, Jun 28, 2023 at 05:33:07PM +0200, Martin Hoffmann wrote:
>> 
>>> While we are at it, I would like to again raise the suggestion to
>>> not use a version 1 here but rather stick to 0 and use a different
>>> content type OID. The older and newer definitions are not
>>> compatible, so a new OID feels more appropriate than a version
>>> change.  
>> 
>> I can see your argument, but I'm not sure there is clear consensus to
>> request a fresh content-type OID, and there are counter-arguments too.
>> 
>> In the past the ASPA profile definition has been updated without
>> cranking the version or content-type OID. Some argue we are in a phase
>> of 'experimentation' (since the internet-draft isn't published as
>> RFC), where some incompatibility with older revisions of the draft is
>> to be expected and of no concern.
> 
> I’d be okay with leaving the version at 0 and using the current OID as
> well. The old-format objects will fail to be decoded either way, so it
> doesn’t really make a difference in practice. Depending on how the
> parser works, they may be rejected even before you get to the version
> check, too.

A benefit of a separate version is a cleaner way to support both profiles. There
is a nice natural experiment in this on how long it takes people to switch to
compliant implementations.

> 
> I’m a bit worried with having version 1 in a newly published
> standard. It’ll be the only one that does that and it is very easy to
> miss because it really is just a single digit in the text below the
> grammar. Ask me how I know ...

We have a number of test cases by now. The objects I use for interop testing are
currently in [0] (unfortunately the URL will not be stable after merging this).
By now we have covered quite a few variations :)

A benefit of a separate version is a cleaner way to support both profiles. There
is a nice natural experiment in this on how long it takes people to switch to
compliant implementations of CAs.

https://github.com/RIPE-NCC/rpki-commons/tree/feature/aspa-profile-15/src/test/resources/interop/aspa

If we move back to version 0, let’s do that with a new OID…

As a repository operator we parse _all_ objects in repositories for some
consistency checks, having multiple structures for the same version complicates
things more.

Kind regards,
Ties