Re: [Sidrops] RtgDir review: draft-ietf-sidrops-bgpsec-rollover-02

["Brian Weis (bew)" <[e-mail]>]

Hi Daniele,

Thanks for your review.

On Oct 26, 2017, at 3:12 AM, Daniele Ceccarelli <[e-mail]<mailto:[e-mail]>> wrote:

Hello,

I have been selected as the Routing Directorate reviewer for this draft. The Routing Directorate seeks to review all routing or routing-related drafts as they pass through IETF last call and IESG review, and sometimes on special request. The purpose of the review is to provide assistance to the Routing ADs. For more information about the Routing Directorate, please see ​http://trac.tools.ietf.org/area/rtg/trac/wiki/RtgDir

Although these comments are primarily for the use of the Routing ADs, it would be helpful if you could consider them along with any other IETF Last Call comments that you receive, and strive to resolve them through discussion or by updating the draft.

Document: draft-ietf-sidrops-bgpsec-rollover-02
Reviewer: Daniele Ceccarelli
Review Date: 25/10/2017
IETF LC End Date: On agenda of 2017-11-30 IESG telechat
Intended Status: Standard Track

Summary:

I have some minor concerns about this document that I think should be resolved before publication.

Comments:

The draft is sometimes hard to read, mostly the abstract (which should be clear on the scope of the draft), what is being defined and above all the intended status. In some parts the draft seems to be a recommendation, in some others a standard track. Which one?

It’s intended to be standards-track.  We’ll change the tone of the document to match that (i.e., not describe “recommendations”). Also I’ve again reviewed the use of requirements language and made some appropriate changes to reflect a standards-track document.


Major Issues:
- None

Minor Issues  and nits:
- The abstract is a bit hard to read. E.g. the usage of "will also manage" might become obsolete sooner or later and this sentence "But the rollover
  of CA and EE certificates BGPsec router certificates have..." doesn't make much sense. -
- Moreover the abstract says: "This document provides general recommendations for the rollover process". How can it be a standard track then?

Thanks for pointing out that the Abstract is hard to read — it’s old text that should have been updated to match the current state of BGPSEC.  I have simplified the Abstract and addressed both of these points. Let me know if you believe it does not clearly describe the scope of the  draft.

   Certification Authorities (CAs) within the Resource Public Key
   Infrastructure (RPKI) manage BGPsec router certificates as well as
   RPKI certificates.  The rollover of BGPsec router certificates must
   be carefully performed in order to synchronize the distribution of
   router public keys with BGPsec Update messages verified with those
   router public keys.  This document describes a safe rollover process,
   as well as discussing when and why the rollover of BGPsec router
   certificates are necessary.  When this rollover process is followed
   the rollover will be performed without routing information being
   lost.

- Intro: "Additionally, the BGP speaker MUST refresh its outbound BGPsec Update messages to include a signature using the new  key (replacing the old key)." I wouldn't expect a MUST in the intro. I understand this is something defined in other documents, hence should not be in capital letters and probably added a reference.

The normative language has been moved until a later section. There isn’t really a reference that can be given in this sentence though — it’s stating logically what needs to happen.

- Section 3 ditto. "A BGPsec router certificate SHOULD be replaced when the following events occur" is this something new defined in this document?

Yes, a description of when a key rollover should happen is a new topic for BGPsec. So this SHOULD is needed.

- Typo/Punctuation/wrong usage of capital letters: there is a number of them all over the document. Why OLD key is always used with old in capital letters?

Fixed.

Thanks,
Brian


Thanks
Daniele


--
Brian Weis
Security, CSG, Cisco Systems
Telephone: [phone]
Email: [e-mail]<mailto:[e-mail]>