Re: [Sidrops] trying to limit RP processing variability

[Tim Bruijnzeels <[e-mail]>]

> On 16 Apr 2020, at 10:50, Robert Kisteleki <[e-mail]> wrote:
> 
> 
>>> 1.Manifest present, valid, current
>> 
>> If there is a present, valid, and current manifest, the CRL can safely
>> be ignored for all objects.
> 
> While I see the benefits on reducing code complexity, I believe there
> have been arguments before against ignoring the CRL.
> 
>> In order to avoid using partial sets of information, the entire content
>> of the PP is ignored if any object is missing, corrupted, or invalid.
> 
> Doing so will, in the presence bit flips or non-atomic PP updates or an
> attacker hiding/modifying files, invalidate whole subtrees of the
> hierarchy. If this happens high enough in the chain, the result is
> invalidation a significant portion of the RPKI space.

With RRDP CAs can publish consistent atomic deltas. This was one of its design goals.
A bit flip on an HTTPS connection seems highly unlikely, if not impossible, to me as well.

Also RPs that have previous copies of files (and know their URI and hash) do not need to be affected by intermittent issues.

While I understand that it's scary to exclude all VRPs from near the apex of the tree, the alternative is that you will need to accept that announcements can be marked as invalid - because you *know* you do not have the full picture.

> We can do better.

How?



> 
> Robert
> 
> _______________________________________________
> Sidrops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sidrops