Re: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-verification-16.txt

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

Hello WG members,

Some of the authors of the aspa-verification draft (Keyur, Job, Sriram) joined by Ben M. and Oliver B. met in San Francisco (IETF 117) to bring closure on some loose ends in the draft. Later we received inputs from Doug Montgomery, Russ Housley, and Claudio also.

The discussion converged to carrying out the following actions with the draft and then uploading v-16 (which is uploaded now):

(1) Eliminate the v-15 Section 7.2 (Verification and Mitigation at Egress eBGP Router). 
Reasons: Avoid unnecessary complexity. See slide 8 of the IETF 117 presentation: https://datatracker.ietf.org/meeting/117/materials/slides-117-sidrops-aspa-draft-update . 
The OTC Attribute sufficiently helps to prevent route leaks from occurring at the local AS (see #3 below).

(2) Do not include ASPA path verification in IBGP either. 
Reasons: Performing ASPA path verification and rejection of routes with Invalid AS path at eBGP ingress is sufficient. The AS is expected to maintain a consistent view of RPKI data across all its border routers.

(3) Add the following (new Section 7.2 in v-16):

7.2.  Only to Customer (OTC) Attribute

   While the ASPA-based AS_PATH verification method (Section 7.1)
   detects and mitigates route leaks that were created by preceding ASes
   listed in the AS_PATH, it lacks the ability to prevent route leaks
   from occurring at the local AS.  The use of the Only to Customer (OTC)
   Attribute [RFC9234] fills in that gap.  The procedures utilizing the
   OTC Attribute set out in [RFC9234] complement those described in this
   document.  Implementation of those procedures in addition to ASPA-
   based AS_PATH verification is encouraged.

Comments welcome.

Thank you.

Sriram