[Sidrops] Re: Ketan Talaulikar's No Objection on draft-ietf-sidrops-rpki-ccr-09: (with COMMENT)

Job Snijders <job@bsd.nl> Fri, 26 June 2026 09:07 UTC

Return-Path: <job@bsd.nl>
X-Original-To: sidrops@mail2.ietf.org
Delivered-To: sidrops@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id A1F22107D6F77; Fri, 26 Jun 2026 02:07:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1782464875; bh=OmkhX9e46VuPaC/P++/LW/9jyF2IzyLtGserLqS1GJE=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=jVHdOEEu/fADk7FTF12ssoY4be0+WPbQXlGUqnUlUlhO8aQwd/v6vANk7kjaoDII6 81zwtyPQbhuGNVwoiVVk9OFOgf6970NiD+zaWrqCUONqhWuzLV+ETMmnQs1Tx2Xt1S M31Bbu1NZVkRCGC356FGjCBqiIXgslHT8jp2Io5I=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.798
X-Spam-Level:
X-Spam-Status: No, score=-2.798 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=bsd.nl
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UWUPXF0CHCUS; Fri, 26 Jun 2026 02:07:53 -0700 (PDT)
Received: from dane.soverin.net (dane.soverin.net [185.233.34.157]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 5AC97107D6F07; Fri, 26 Jun 2026 02:07:50 -0700 (PDT)
Received: from smtp.soverin.net (unknown [10.10.4.99]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dane.soverin.net (Postfix) with ESMTPS id 4gmqZR1mz0zlV; Fri, 26 Jun 2026 09:07:43 +0000 (UTC)
Received: from smtp.soverin.net (smtp.soverin.net [10.10.4.99]) by soverin.net (Postfix) with ESMTPSA id 4gmqZQ63bfz5k; Fri, 26 Jun 2026 09:07:42 +0000 (UTC)
Authentication-Results: smtp.soverin.net; dkim=pass (2048-bit key; unprotected) header.d=bsd.nl header.i=@bsd.nl header.a=rsa-sha256 header.s=soverin1 header.b=E2GZummG; dkim-atps=neutral
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bsd.nl; s=soverin1; t=1782464863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=dSt2WMnALaNqif2td7wzArY7FXZ5FqYnJbY53ygveKY=; b=E2GZummG4hFFJEJl17/wl9C5NCsVMbbY+XA2jRaf0U/T2b4or1b+ViipzISQ+i20Wn8WzN t9vbsWf/CbU7l5Ypfoe8SrMBfTsBY3vhu//Z3KBmLz8ffjslSVpzxbZYOZMvHsz1lWh+a/ 3CZjmY6mLFnWG3Q7ooZbznZHPA+Ox7JyvY3fkgX6NFfvJkp5aPAGbNnix5Z8PtQbWnfJzI NlN5uAqsQ+GiNY3MKtLEb6zp4lLEUig9b3awLhFQ/JHgzsOPBq1pZCAxnWuvGJ+rCTOD8v JAI96SUBsSamRoFAD6GjHR5VBM8jUXPqAnJDIKr8VysoxCzWMhZ3WkxRktfbzQ==
X-CM-Envelope: MS4xfBIP/lzz+1AKSXvLHvfeEie2ioBdsWp/k8S7C7D1t5aai0qrsXHTAxtOqDdXARLlBSYG74F7I8tIvfpNqN6cLLqFQ2rf8+DFYhByK2ZYYZdcXZKlo3Kj aJvWJ2zjZFkZLNlGR8Nnb6/HdVp7aQALs0UNnAjNO9MGhCAZbk41istqbHsnKPOqq9hMo47M9tu17nyisEQmAxsDimAWqXi7ONTc0Bb9OG/7ET5kzLMfQ8cq fpd0bpnHCVyYjR5sI4CIlt34o1pX+mv9+z5J0KANhHeTG0+qQBmRuJlDf4Yrj1P4JmD4YMn3uSsvpvQmYtaRjs1IoT2zn1D07Pn9GtMN5MJGnXTD2qS8tCdM DGNydP835ixLX0tzJfeSLRIzERaBWA==
X-Soverin-Id: 019f032f-5b18-7fe6-8888-baae665bb602
Date: Fri, 26 Jun 2026 09:07:41 +0000
From: Job Snijders <job@bsd.nl>
To: Ketan Talaulikar <ketant.ietf@gmail.com>
Message-ID: <aj5BXWODjFuSbfNw@feather.sobornost.net>
References: <178246407398.1809941.16627242987522813771@dt-datatracker-f9b87776f-8pmmg>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <178246407398.1809941.16627242987522813771@dt-datatracker-f9b87776f-8pmmg>
X-Clacks-Overhead: GNU Erik Bais
X-Spampanel-Class: ham
Message-ID-Hash: KVBLPLQEZQ3TWEWPZILRPW373XZBWL24
X-Message-ID-Hash: KVBLPLQEZQ3TWEWPZILRPW373XZBWL24
X-MailFrom: job@bsd.nl
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-sidrops.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: The IESG <iesg@ietf.org>, draft-ietf-sidrops-rpki-ccr@ietf.org, housley@vigilsec.com, sidrops-chairs@ietf.org, sidrops@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Sidrops] Re: Ketan Talaulikar's No Objection on draft-ietf-sidrops-rpki-ccr-09: (with COMMENT)
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/OnKDlpWtWTf6gI2PM9xd7JDm134>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Owner: <mailto:sidrops-owner@ietf.org>
List-Post: <mailto:sidrops@ietf.org>
List-Subscribe: <mailto:sidrops-join@ietf.org>
List-Unsubscribe: <mailto:sidrops-leave@ietf.org>

Dear Ketan,

Many thanks for your careful review of this specification!

On Fri, Jun 26, 2026 at 01:54:33AM -0700, Ketan Talaulikar via Datatracker wrote:
> Ketan Talaulikar has entered the following ballot position for
> draft-ietf-sidrops-rpki-ccr-09: No Objection
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thanks to the authors and the WG for their work on this document.
> 
> I have a few comments, questions, and suggestions for consideration by the
> authors and the WG:
> 
> 1) Section 3: Is the hard lower limit size of 1000 fully thought out ... for
> today, tomorrow (e.g., something changes to reduce/compress?)
> 
> ManifestInstance ::= SEQUENCE {
>   hash              Digest,
>   size              INTEGER (1000..MAX), <<<< this one!
>   aki               KeyIdentifier,
>   manifestNumber    INTEGER (0..MAX),
>   thisUpdate        GeneralizedTime,
>   locations         SEQUENCE (SIZE(1..MAX)) OF AccessDescription,
>   subordinates      SEQUENCE (SIZE(1..MAX)) OF SubjectKeyIdentifier
>                       OPTIONAL }

Yes, even when the signing algorithm changes and produces smaller
signatures this is an appropriate minimum. If the _structure_ of
RPKI Manifests changes, the CCR specification will have to change
accordingly.

> 2) Section 3 - not an expert on ASN.1 nor this particular feature/technology
> ... but CertificateSerialNumber FROM PKIX1Explicit-2009 is unused. Please
> cross-check if there hasn't been an error or remove unused.

Good catch!

> 3) section 3.1
> 
> "In this version of the specification, it MUST be 0." seems a bit odd.
> 
> Perhaps: Version MUST be set to 0 for the CCR content specified in this
> document.

Sure!

> 4) section 5.3 ... a nit
> 
> "CCRs compress very well due to its data layout characteristics"
> 
> Perhaps: "CCRs compress very well due to their data layout characteristics" or
> "A CCR file compresses very well due to its data layout characteristics"

Thank you, that reads better.

The changes have been incorporated: https://github.com/job/draft-sidrops-rpki-ccr/commit/3919a61d4435f283ba274c2e2a2420c2f1726381

Kind regards,

Job