Re: [Sidrops] ASPA Validation section in draft-ietf-sidrops-aspa-profile-07

[Job Snijders <[e-mail]>]

Hi Ties,

Thanks for reviewing

On Thu, Mar 31, 2022 at 02:32:28PM +0200, Ties de Kock wrote:
> I just reviewed a parser/generator for the ASPA object profile, and I
> realised that the ASPA validation section currently only includes a
> single ASPA-specific validation step. I want to propose expanding this
> section.
> 
> At a minimum, I would recommend that this section (also) lists checks
> that ensure that:
>
>   * The version is 0

I think this already is covered in the draft: § 3.1 states "The version
number of the ASProviderAttestation MUST be v0."

The above type of text triggers RP developers to implement checks like
these: https://github.com/openbsd/src/blob/326af693966ccfc600796f445a88b37549ae3e64/usr.sbin/rpki-client/roa.c#L276-L294

>   * The eContentType and content-type signed attribute contain the
>   correct OID.

I think those aspects are covered through RFC 6488, specially § 2.1.3.1

   "The eContentType is an OID specifying the type of payload in this
    signed object and MUST be specified by the Internet Standards Track
    document that defines the object.

> Please let me know what you think.

Section 4 of draft-ietf-sidrops-aspa-profile seems to have taken
inspiration from RFC 6493 (GBRs) and RFC 6482 (ROAs)'s section on
validation, by referencing to RFC 6488. This makes for concise text.

Personally I think there is an advantage to making it very clear the
RPKI signed object template model is followed, rather than (redundantly)
outlining (a subset of) the full decision tree.

On the other hand, perhaps this type of section historically has
suffered from brevity, and more elaboration is useful? I'm somewhat
undecided.

Kind regards,

Job