Re: [Sidrops] WG ADOPTION - draft-madi-sidrops-rush - ENDS 10/12/2020 (Oct 12th)

[Claudio Jeker <[e-mail]>]

On Wed, Nov 18, 2020 at 02:48:33PM +0800, Di Ma wrote:
> Job,
> 
> > 2020年11月17日 22:05，Job Snijders <[e-mail]> 写道：
> > 
> > On Tue, Nov 17, 2020 at 11:59:13AM +0000, Chris Morrow wrote:
> >> Can job speak up if their concerns are NOT met at this time?
> >> 
> >> If they don't speak up in an hour I think we can consider this adopted
> >> and ask the authors to submit the appropriately re-named draft :)
> > 
> > Eh.... a new IETF rule? :-)
> > 
> > I am not a fan of adopting this draft, I think the working this working
> > group's sparse resources should be allocated towards other work. In the
> > operational field, people have been transporting SLURM files for years
> > over HTTPS, SSH, whatever is suitable. It seems awkward to describe that
> > a SLURM file can be transported over HTTPS... it seems ...  obvious?
> 
> Happy to know people have been transporting SLURM files, which makes it necessary to standardize RUSH for inter-operation.
> 
> I think this argument of yours is a kinda support for adoption of RUSH not the other way around.
> 

Why is file transport an inter-op problem. If the file is copied with scp,
sftp, rcp, rsync, https, http, ftp, USB stick, floppy disk, or using any
combination of those methods is up to the operator and there is no need to
write an RFC about this. Especially since RUSH is not on the same level as
RPKI regarding authenticity validation.

> 
> > 
> > The security section of RFC 8416 already establishes "Additionally, each
> > RP using SLURM MUST ensure the authenticity and integrity of any SLURM
> > file that it uses." The described use-cases erode potential security,
> > specifically:
> > 
> >    "A small site or enterprise network MAY also use RUSH by
> >    synchronizing with a third-party RPKI cache provider over external
> >    networks."
> > 
> > Who are those small networks? Are the authors attempting to speak for a
> > silent majority? As far as I know small networks have just as much
> > access to tools to validate RPKI data as big networks. What even *is* a
> > 'small' network? Seems pedantic to a-priori diminish/downgrade a small
> > network's access to secure routing by suggesting they should use an
> > inferior substitute instead of the real thing, when everyone knows you
> > can run a RPKI validator on a raspberry pi or smaller.
> 
> We don’t make decision for operators but offer them a choice that they can outsource valiation if they have no problem with this fashion.

This is a very bad choice. There is no cryptographic signature in RUSH
that ensures that the provided data is actually authentic and unaltered.
There is no way to verify the data. All the trust is put in HTTPS.
A secure transport layer does not ensure that the file served was
not altered. 

I think this WG is responsible in helping operators to take the right
decision and to make sure that the promise of validated resource
authorization is not watered down.  Because of this I agree with Job that
this draft should not be adopted by this WG.

People should better spend the effort in making the rpki validators as
easy to use and deploy as possible.

> > 
> > Furthermore I do not believe that the SLURM format is optimal to
> > distribute Validated RPKI cache data. It is inefficient from a size
> > perspective. The SLURM format makes a lot of sense for describing 'Local
> > RPKI exceptions', but the datastructure seems less suitable as the RPKI
> > grows in size.
> 
> 
> I don’t agree in terms of SIZE.
> 
> The beauty of SLURM file is that it naturally supports incremental update.
> 
> > 
> > Many operators *already today* are using different formats, so why not
> > either look to standardize the format that actually is in use in the
> > wild, or optimize towards something that is better than what is already
> > used in the wild?
> > 
> 
> I am pleased to know those operators have *already today* used some
> other formats that works for their networking condition.
> 
> If they want a standardized format, it is fine and good.  But this won’t
> necessarily stop RUSH from being a WG item.  

-- 
:wq Claudio