Re: [Sidrops] WG-ADOPTION: draft-borchert-sidrops-rpki-state-unverified-01 - ENDS: 2019-03-12 (mar 12)

[Jeffrey Haas <[e-mail]>]

On Wed, Feb 27, 2019 at 05:09:14PM -0500, Russ Housley wrote:
> >> This seems to be a proposal for documenting why the marking is something other that valid or invalid.  I can see why a researcher might care about those differences, but I cannot see how an operator would make use of it.  I do not think we should add complexity.
> > 
> > I likely should write more text, but very simply some operators want easy
> > ways to mark that a system that should be expected to do validation has not
> > done so.  The existing tri-state (valid, invalid, not-found) doesn't cover
> > this.
> 
> Please write a little bit more.  What action would be taken in the unverified state that is different from the action taken in the not-found state?

Among other things, not draconically drop things if that's your policy.

not-found says the prefix isn't in the db.
unverified means that the db might be outright down.

How you feel about such things will wildly vary depending on your network
and how much you wear a security hat for your day job.

-- Jeff