Re: [Sidrops] draft-ietf-sidrops-rpki-has-no-identity-00

[Randy Bush <[e-mail]>]

hi job,

thanks for reading

> The current -00 title might distract from the substance of the memo.
> Perhaps: "Clarification on Opaqueness of Resource Public Key
> Infrastructure (RPKI) Identifiers"

in my dotage, i try to impress with words less and less

> Most of the document's content don't appear accessible to newcomers to
> the RPKI, it reads as if a lot of prior knowledge is required.

it's why we have references.  but indeed, we have woven a tangled web,
as we saw in the secdir review of draft-ietf-opsawg-finding-geofeeds.
sympathies to the reviewer.  but i doubt we can fix it here.

> The 'Discussion' section is somewhat hard to follow. For example,
> perhaps 'large operations' might be better as 'large corporations' or
> 'organizations'?

you really think this make it easier to understand?  but sure,
organizations it now is.

> The RFC 6480 and RFC 7382 references are useful, but overshadowed by a
> (to me) somewhat confusing story about sushi and taco.

you are not expected to remember bill's bait and sushi.  i assume you
would prefer examples use more erudite names.  sigh.

fyi, bb&s is an iconic internet org similar to foo widget company.  in
this case, bill was bill manning, a friend to many who died recently;
hence the bit of memoriam.  and roberto's taco stand is just up the
road.  i strongly recommend the carne asada burrito.

>> If so, how does one determine if the signature on the real world
>> document is still valid?
> 
> Would the EE certificates contained in the signed objects not
> be periodically validated, including the applicable CRLs?

you are referring to

   Then there is the temporal issue.  The owner of that AS may be BB&S
   today when some document was signed, and could be the Government of
   Elbonia tomorrow.  Or the resource could have been administratively
   moved from one CA to another, likely requiring a change of keys.  If
   so, how does one determine if the signature on the real world
   document is still valid?

are you suggesting automated periodic validation off a cron job or
whatever?

> I would suggest to keep the document in the queue, and enrich it based
> on some field experience with RSC. it shouldn't be too long before the
> first tests can be conducted with RSC objects.

clue or example on how this will help make this document better?

randy