Re: [Sidrops] WGLC = draft-ietf-sidrops-aspa-verification - ENDS 03/22/2023 (Mar 22 2023)

[Yangyang Wang <[e-mail]>]

Hi, all


I am reposting my comments in the WGLC thread :)


I have read through this draft v12
https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-verification/

Comments as follows.
1. a few typos.
In section 3, "The definition of Provider AS in given in Section 1" -->"The definition of Provider AS is given in Section 1"
Page 7, "If N = 1, then then the procedure" --> remove the extra "then"
Page 10, downstream path verification procedure, step 4 "lowest value of v
(2 <= u <= N)" --> " lowest value of u (2 <= u <= N)"

2. This draft claims that "An AS SHOULD NOT have more than one ASPA". 
If a Customer AS signs only one ASPA object including all its Provider ASes, it needs to resign and update it when any one of the provider ASes changes.
It may affect the validation.

3. In the algorithm for downstream paths, it says that if 1 <= N <=2, then the AS_PATH is trivially Valid.  
If N=2, assuming AS_PATH is (AS2, AS1), the path verification is just hop-check hop(AS(1), AS(2)) and may be one of "Provider", "Not Provider" and "no Attestation". 
If it is "Provider", the AS_PATH is Valid. 
If it is "Not Provider" or "no Attestation", I feel that the AS_PATH is actually unclear, which may be Valid, or forged link as the (AS(5), AS(2)) shown in Section 12.


4. It seems that the algorithms for path verification are not complete to cover all possible cases.

For example, shown in the figure below:

Receiving & validating AS 5 --  AS(4)
				 \
				   \
                                                          AS(3)     AS(1)
                                                              \        /
			 	      \     /
                                                                AS(2)
ASPAs: {AS(2), [AS(3), AS(1)]}

AS5 is the Receiving & Validating AS. And, only AS(2) register an ASPA object in RPKI. 
It assumes that AS5 receives an AS_PATH [AS(4), AS(3), AS(2), AS(1)], and there is a route leak from AS(3) to AS(1) by the customer AS(2) hop(AS(1), AS(2)) = "no attestation"
hop(AS(2), AS(3)) = "Provider"
hop(AS(3), AS(4)) = "no attestation"
According to the step 4 and 5 of the algorithm for upstream paths in section 6.1,  there is not an i for which hop(AS(i-1), AS(i)) = "not Provider". This path is invalid, but will be verified as "Unknown".

Maybe I'm missing something or make a mistake.


Best regards,
Yangyang
2023-03-08