Re: [Sidrops] Reason for Outage report (was: Re: ARIN RPKI Service Impact - 12 August 2020 - manifest issue - resolved)

[Randy Bush <[e-mail]>]

> If a CA's publication point's RPKI data is invalid

"invalid" is already an overloaded magic word in this space; not
cryptographically validatable up to a TA, and bgp announcement not
finding a matching roa.

can we come up with another term for a failed (for many reasons) fetch
of a PP's data?

> a Relying Party MUST add all IP address resources listed on the
> certificate's issuer

what certificate?

> to a Prefix Filter

what is a prefix filter?

> The Relying party MUST consider any VRPs

an RP cache knows if a PP was not fetchable, but does not have any VRPs
(yet), just ROAs.  a router has VRPs, but has no idea what happened
between the RP cache and the PPs it tried to fetch.

i suspect this whole thing is a capybara hole we just do not want to
explore, especially when we have software out there which is <bleep>.

though i would not mind looking at a concise and simple statement of
what it is you're trying to do here.

but do consider the PPs of a CA whose INRs are delegated from multiple
parents, and which, in turn, delegates to other CA(s).

randy