Re: [Sidrops] Distributing RPKI Validated Cache in JSON over HTTPS

George,

Thanks for your comments.

I comprehend your concern is about the authenticity of the SLURM file provider.

In RUSH exchange, SLURM file receiver chooses SLURM file sender as its Local Trust Anchor at its discretion.

I agree with your statement that RUSH can work well within IGP as this document says:

"The primary use of RUSH is to distribute RPKI validated cache within an ISP or an ICP composed of a number of ASes.  "

And maybe there is a usecase as described in this document:

"A small site or enterprise network MAY also use RUSH by synchronizing with a third-party RPKI cache provider over networks.”

In short RUSH is intended to make use of SLURM Filters to do subtraction and SLURM Assertions to do addition, in order to keep two cache synchronized.

And the trust in SLURM file sender is configured by  SLURM file receiver out-of-band and can be verified during HTTPS exchange.

I think  RUSH can work well for 'SLURM for AS0 from the RIR’  :-)

Di

> 2020年5月25日 08:18，George Michaelson <ggm@algebras.org> 写道：
> 
> I think its useful to document use of secured transport to fetch data.
> 
> The problem I retain in this, is the lack of strong cryptographic
> validity checks on the semantic intent of the assertions themselves.
> 
> The beauty of RPKI was always the ability to demonstrate the binding
> of authority (delegated) to say what was to be done with some
> resource.
> 
> SLURM doesn't honour that behaviour. Inside your own IGP, its a
> representation of your 'must-haves' including other peoples things,
> but between IGPs, transferred over the external boundary, I worry a
> LOT about "what it means"
> 
> And that goes for 'SLURM for AS0 from the RIR too' btw.
> 
> -G
> 
> On Wed, May 20, 2020 at 3:32 PM Di Ma <madi@rpstir.net> wrote:
>> 
>> Hi, folks
>> 
>> I briefed a method for RPKI inter-cache synchronization called Distributing RPKI Validated Cache in JSON over HTTPS and our implementation with RPSTIR2 in IETF 106 Singapore meeting.
>> 
>> After that we were drafting a document that tries to specify the standardized way to do so, as I promised :-)
>> 
>> We realized that the document should focus on the necessary minimum information for data exchange not the detailed interaction and signaling which I believe can leave to different private implementations.
>> 
>> This document is therefore intended to define a method for transferring RPKI validated cache by making use of SLURM.
>> 
>> Looking forwards to your comments.
>> 
>> https://datatracker.ietf.org/doc/draft-madi-sidrops-rush/
>> 
>> Di
>> 
>> 
>> _______________________________________________
>> Sidrops mailing list
>> Sidrops@ietf.org
>> https://www.ietf.org/mailman/listinfo/sidrops
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops