Re: [Sidrops] what to do when the CRL is hosed?

[Job Snijders <[e-mail]>]

Dear Louis, group,

On Tue, Feb 25, 2020 at 06:02:05PM -0800, Louis Poinsignon wrote:
> My opinion on an operational standpoint.
> I don't think I'd like having our routers suddenly reprocessing the million
> routes associated with 78000 ROAs leaving us with an increased surface of
> attack and potential reroutings. 

It differs from BGP implementation to BGP implementation whether a
milion routes in their concept of the RIBs need to be reprocessed, or
only the routes covered by the (now invalid) ROAs / VRP removal. I
believe there are high performant BGP/ROV implementations out there.

> The outage lasted 8 hours as well.  Even with a replayed certificate,
> I don't believe the impact would be as critical. And it would leave
> traces.  If the impact of a mistake is more punitive than a proper
> misuse, it's bad.
>
> While I believe Job is right on the discrepancy between validators, I agree
> with the point of Martin on the added complexity.

The only punitive effect I observe is towards the CA operators (a small
group, appears not too often to make mistakes), but at the same time
there are continuous benefits going to the relying parties (a large
group, the internet). I see opportunity for a movement to motivate CA
operators to the strictest possible interpretation of how their RPKI CA
& publication process works and how the data distributed will be
validated.

> Even though browsers and RPKI are different, I think we can learn from
> the experience. Which is to get away from CRLs.

I agree this is worthwhile exploring.

Kind regards,

Job