Re: [Sidrops] WGLC for draft-ietf-sidrops-bgpsec-rollover-00 - ENDS: 04/21/2017 (April 21 2017)

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

Hi Brian, Keyur, Roque:

Thanks for all your efforts in authoring this document. 
I have carefully read the draft and have comments.
Some of my comments are listed here and I have also comments in the attached document
(marked in the MS word file using track changes).
My comments are aimed to help get the document into a good shape before advancing it to IESG review. 
The technical accuracy of the method described in not in question but 
still I feel that the draft needs a careful revision.

First, it needs to clear some English issues (grammatical errors, some difficult to parse sentence structures).
Some of these are pointed out below here, and the rest in the attached word file.

Second, the document needs to eliminate errors in terms of technical terms or phrases used.
For example:
s/BGPsec certificate/router certificate/g
(Note: It is the router that has a certificate, not the BGPsec protocol)
s/BGPsec rollover/router key rollover/g
s/BGPsec emergency rollover/Emergency key rollover/g
Generally, "BGPsec_Path attributes" needs replaced with "BGPsec updates"
throughout the document.
For example:  
s/...BGPsec_Path attributes signed with a new private key.../...BGPsec updates signed with a new private key.../
(Note: The current AS’s signature covers the prefix, previous BGPsec_Path attribute including all previous signatures, 
the current Secure_Path segment, and the Target AS.
So it is not correct to say “BGPsec_Path attribute is signed”; instead simply say “BGPsec update is singed”.)

The following comments pertain only to the Abstract and the Introduction section.
(Please see the attached MS word document for my comments on the other sections.)
Abstract: minor problem with phrasing

OLD>
This memo provides general recommendations for
   that process, as well as describing reasons why the rollover of
   BGPsec EE certificates might be necessary.

NEW>
This document provides general recommendations for
   the rollover process, while describing reasons why the rollover of
   BGPsec-router EE certificates might be necessary.

Section 2 (Introduction):

OLD>
   When a router receives or creates a new key pair (using a key
   provisioning mechanism), this key pair will be used to sign new
   BGPsec_Path attributes … 

NEW>
   When a router receives or creates a new key pair (using a key
   provisioning mechanism), this key pair will be used to sign new
   BGPsec updates … 

s/to include a signature using the new key (replacing the replaced key)./
include a signature using the new key (replacing the old key).

Note: “replacing the replaced key” sounds like a bad phrase

s/ the old BGPsec certificate (and its key) will not longer be valid,/
the old BGPsec certificate (and its key) will no longer be valid,/

s/ and thus any BGPsec Update that includes a BGPsec_Path attribute with a signature performed by/
and thus any BGPsec Update that includes a signature performed by/

OLD>
Consequently, if the router does not
   refresh its outbound BGPsec Update messages, routing information may
   be treated as unauthenticated …
NEW>
Consequently, if the router does not
   refresh its outbound BGPsec Update messages, previously sent routing information may be treated as unauthenticated …

OLD>
   It is therefore extremely important that the BGPsec router key
   rollover be performed in such a way that the probability of new
   router EE certificates have been distributed throughout the RPKI
   before the router begin signing BGPsec_Path attributes with a new
   private key.
(Note: sentence is structurally cumbersome)

NEW>
   It is therefore extremely important that NEW
   router EE certificates should have been distributed throughout the RPKI system
   before the router begins signing BGPsec updates with the NEW private key.

Please see comments on other sections in the attached MS word document.
Thank you.
Sriram