Re: [Sidrops] WGLC = draft-ietf-sidrops-aspa-verification - ENDS 03/22/2023 (Mar 22 2023)

[Martin Hoffmann <[e-mail]>]

Hi Sriram,

my apologies for continuously beating the same drum, but I am not sure
I can accept that the draft is quietly ignoring the different data
structure in RTR. Specifically, I just realized that I may or may not
have implemented the conversion from ASPA objects to RTR payload
wrongly in Routinator.

If for a given customer AS there are no provider AS for a requested
address family but there are for the other address family, the hop
function will result ‘no providers+’ rather than ‘no attestation.’
If the verification algorithm is implemented on individual per-family
provider sets, this means the provider set for that address family is
basically an AS0-only set.

Consequently, when transforming the provider set from an ASPA object
into its RTR payload, an AS0-only PDU should probably be added for a
customer AS that if the provider set for an address family turns out to
be empty. Otherwise a router keeping separate tables has to consult the
table for the other family any time there is no entry for a given
customer AS and that rather defeats the purpose.

Now, from the split into two documents, I conclude that as someone
implementing an RPKI relying party software, you aren’t expected to
read the verfication draft -- and will likely miss this subtlety. So,
presumably, the conversion rules should be in the profile draft.

But similarly, someone who only implements validation in a router and
starts out with the RTR payload data will be confused by the validation
algorithm working with something completely different. There’s a good
chance there are subtle and unexpected consequences there, too.

I feel that if we keep describing the validation algorithm in its
current form, the conversions should be addressed explicitly so that
it is clear how may ASPA RTR PDUs will there be for a given customer
AS, what will be in a provider AS set in each, and what that means for
the validation algorithm.

  -- Martin