Re: [Sidrops] WGLC = draft-ietf-sidrops-aspa-verification - ENDS 03/22/2023 (Mar 22 2023)

[Tim Bruijnzeels <[e-mail]>]

Hi,

> On 25 Mar 2023, at 23:41, Job Snijders <job=[e-mail]> wrote:
> 
> Hi Igor,
> 
> On Sat, 25 Mar 2023 at 12:29, Lubashev, Igor <ilubashe=[e-mail]> wrote:
> An alternative to a special 'AS 0 ASPA' would be allowing a zero-length Provider AS list. Then there are no special rules at all. 
> 
> 
> Please take a moment to appreciate Section 7 of 
> https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-profile
> 
> At this point in time a very strong justification would be required in order to change the ASPA object profile.
> 
> Changing to “zero-length” requires a non-trivial update to the ASN.1 profile in the internet-draft, and requires a number of implementers to change their code. Are you maintaining a Relying Party or Signer implementation yourself?
> 
> 
> But if 'AS 0 ASPA' is used, a further special rule is needed to describe how a 'union' is taken when both 'AS 0 ASPA' and a 'normal' ASAP are present (maybe from different RPKI registries).
> 
> 
> A sentence to clarify that if two valid ASPA objects are present, AND their respective ProviderSets are different, AND one contains a ProviderSet that contains a single entry listing AS 0 as provider, the latter object might as well not exist, because it contains superfluous information?
> 
> (That’s how it kinda works for ROAs when one ROA authorises AS0 and another ROA for the same IP Prefix(ex) authorises some other ASN.)
> 

That could work, and perhaps it's appealing because it feels clean.

On the other hand, you could also just merge the object VAPs. The result would be a ProviderSet that includes AS0, but it would no longer have length 1.

If you do not want to see AS0 in multi-elements ProviderSets in routers then you should also remove surplus surplus AS0 from any 'normal' VAPs where you did not need to do any merging.

But, as with ROAs, it doesn't matter really if the router sees a surplus AS0 - it would not affect the outcome of validation - or am I missing something here? So, to conclude.. I think we should just accept that surplus AS0 can exist and does nothing - similar to ROAs.

Tim


> Kind regards,
> 
> Job
> _______________________________________________
> Sidrops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sidrops