Re: [Sidrops] New Version Notification for draft-sriram-sidrops-drop-invalid-policy-00.txt

Hi all,

I believe something like this will be needed in case a DISR policy is used. As currently written the draft leaves any unannounced space vulnerable to hijacking. The only way really to counter this would be for the address holder to issue a ROA for their AS and do the public announcement - as Job pointed out there are operational reasons why this may not be possible / very undesired.

With regards to BOAs - my memory may fail me here because part of the discussion was from before even my time on this, but I thought it was concluded that the same could be communicated with an AS0 ROA, so there was no need for an explicit object type.

That said, If I can entertain the thought of a BOA or AS0 (as the only) ROA for address space.. then the intention would certainly be that an address holder can indicate that some of their address space should not appear in the global BGP. Implementing this is not super trivial - it’s not just another ROA for an AS that happens to be one that cannot be naturally found. In particular someone could do an announcement for a large prefix (say a /16 or something) that is less specific than any ROA issued. It would get RPKI validation state ‘not found’ and any otherwise unannounced space would be routed here. For BOAs / AS0 ROAs to work here the semantics would have to be changed to something like: if *any* of the address space in a prefix is covered by a BOA / AS0 ROA *only* then consider it *invalid* — or *forbidden* even if we want to recognise this as a different flavour of invalid.

Kind regards,

Tim

> On 11 Mar 2018, at 15:25, Job Snijders <job@ntt.net> wrote:
> 
> On Sun, Mar 11, 2018 at 10:14:45AM -0400, Geoff Huston wrote:
>>> On 11 Mar 2018, at 9:24 am, Job Snijders <job@ntt.net> wrote:
>>> 
>>> On Sun, 11 Mar 2018 at 14:21, Geoff Huston <gih@apnic.net> wrote:
>>>> 
>>>> Perhaps what is lacking in the semantics of RPKI is a "kill roa”.
>>> 
>>> https://datatracker.ietf.org/doc/draft-huston-sidr-bogons/
>>> 
>>> What happened to that draft?
>> 
>> It was unceremoniously killed due to extreme distaste on the part of
>> various folk who represented themselves as members of the crypto
>> zealotry group. I also suspect that the authors’ efforts to use the
>> term “boa constrictor" at least once the draft was seen as a juvenile
>> attempt at humour. :-) I guess you just had to be there! 
>> 
>> More seriously, the draft encountered fatal levels of criticism over
>> the concept of this form of validated negation.
> 
> Given that ~ 10 years have passed, and there are now give or take 5
> autonomous systems doing Origin Validation, perhaps some of the folks
> involved back then would be willing to reconsider their opinion? :)
> 
> Kind regards,
> 
> Job
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops