Re: [Sidrops] what to do when the CRL is hosed?

[Christopher Morrow <[e-mail]>]

first, apologies for getting back around to this so late :(

On Thu, Mar 26, 2020 at 10:57 AM Stephen Kent
<stkent=[e-mail]> wrote:

> So, I think discussing MITM attacks is a distraction, unless we have examples of how
> such attacks can affect RPs in ways different from attacks on repositories. Maybe re-reading
> RFC 8211 would be useful, as it tries to analyze a range of possible "adverse actions"  by CAs or
> repository managers in the RPKI context, and discusses how RPKI mechanisms are intended to
> detect/counter these actions.

In the case of the incident which started this thread we ended up
publishing part of the content a
repository needs to publish such that the relying parties can verify
properly that the content in the
repository is correct/valid/usable. The discussion then went along a path like:
   1) "well... maybe we shouldn't have belt and suspenders?" (manifest AND crl)
   2) "what happens if we don't publish this pesky CRL? and rely only
on the manifest?"
   3) "what if we don't publish the manifest and only rely on the CRL?"
   4) "CRL + Manifest has made 'rp software' hard/buggy"

In the world where the protections specified for RPKI exist:
  1) self contained content protection (roa / ee-certs / etc are
packaged securely)
  2) crl signed and available in the repository for revocation actions
on objects in the repository
  3) manifest signed and listing all objects of interest in the repository

Steve (kent!) is right mitm is harder to see as a threat.
  "All objects you get are signed by a ca-cert which is signed by the
root.. which is in the list of TAL you have. You can't have missing
objects and you cant' remove objects without affecting the signed
manifest"

In a world where we remove one/some of the protections:
   A) no more manifest
   B) no more crl
   C) both

I think mitm problems are much harder to detect/deal with :(
It sounds like WG folk (RP users and RP/CA software authors) are
asking for guidance on handling the problem(s) discussed here.
It sounds, to me, like a chat at the upcoming interim meeting would be
a great place to start that with some slideware and a proposal to use
as kindling.

I think the shape of the conversation is roughly:
  "What would be the effect (on the routing system) for RelyingParties
if we decided to be less strict about CRL existence?"
  "What would be the effect (on the routing system) for Relying
Parties if we decided to be less strict about repository contents vs
Manifest contents?"
  "What happens to the routing system if the manifest and crl are
either/both 'broken' in a repository?"

I don't think it matters much to the routing system where the breakage
occurs (my repository or RIPE/ARIN/etc) certainly there's more fallout
from ARIN/RIPE/etc, but... you can't get to me either way :)
(possibly) until repair and propogation.

Thoughts on some slideware and discussion?
Did I about capture the meat of the sandwich here?

-chris
co-chair but asking as a regular chemical engineer at this party.