Re: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-profile-15.txt

[Ties de Kock <[e-mail]>]

Hi all,

> On 13 Jun 2023, at 20:04, Ties de Kock <[e-mail]> wrote:
> 
> Hi Job,
> 
>> On 13 Jun 2023, at 10:55, Job Snijders <job=[e-mail]> wrote:
>> 
>> On Tue, Jun 13, 2023 at 03:01:56PM +0200, Martin Hoffmann wrote:
>>> Russ Housley wrote:
>>>> I do not think we want to have decode failures if the INTEGERS are
>>>> not in sort order.
>>> 
>>> I agree, but in the past the consensus in this group has been to
>>> rigorously reject objects that have something wrong with them. By that
>>> consensus, an ASPA with unsorted provider ASNs would be rejected on
>>> grounds of violating the MUST further down. In which case it might as
>>> well be rejected during decoding.
> 
> I agree with Martin's perception of the opinion of the group. Having the SET
> may get us a little bit more implementation resiliency here.
> 
>> 
>> It seems not every deserializer implementation rejects DER during
>> decoding if the DER contains a SET OF (unsorted, duplicate) INTEGERS.
>> 
>> Example:
>> 
>> $ echo 310f020107020102020109020107020103 | xxd -r -ps | openssl asn1parse -inform DER
>>   0:d=0  hl=2 l=  15 cons: SET
>>   2:d=1  hl=2 l=   1 prim: INTEGER           :07
>>   5:d=1  hl=2 l=   1 prim: INTEGER           :02
>>   8:d=1  hl=2 l=   1 prim: INTEGER           :09
>>  11:d=1  hl=2 l=   1 prim: INTEGER           :07
>>  14:d=1  hl=2 l=   1 prim: INTEGER           :03
>> $ echo $?
>> 0
>> 
>> I suspect the trouble for the deserializer in the above example is that
>> there is ambiguity in the input data: what encoding rules apply?
>> 
>> With relying parties being unable to rely on (potentially missing)
>> implicit behaviour of decoders, it seems better to me to specify the
>> structure of the ASPA eContent data using a SEQUENCE OF, and be explicit
>> in describing the canonical form. This will help avoid potential
>> inconsistencies between implementations.
> 
> I have implemented the current (draft 15) ASN.1 and requirements that yield a
> deterministic form  for both validation and in a signer, but I do not mind
> changing this to a SET.

I realised that I did not share an object for interoperability testing. I have
included a sample that is generated by a property test (so values are random) by
rpki-commons below.

rpki-commons generates and checks for version 1 with tag 0.

MIIH0gYJKoZIhvcNAQcCoIIHwzCCB78CAQMxDTALBglghkgBZQMEAgEwggI8BgsqhkiG9w0B
CRABMaCCAisEggInMIICI6ADAgEBAgUA22uphDCCAhMCBBLLjmkCBBM0KMUCBBQDTlACBBYS
wkICBBaLOgwCBBgIAwkCBBxiVfACBB1W1wMCBCGtbUACBCU9c7UCBCWLQIcCBCcbyEICBCgl
3KMCBCiNWVICBClHPycCBCyBirYCBC2cM1cCBDM1bW4CBDtkCkECBD3Q4xwCBD8P22gCBD84
ZegCBEIx7P8CBEVorCUCBEjds1wCBEvlKBUCBE2FKvcCBE+JT40CBFDs6dkCBFETVU0CBFbY
h+ACBFb+OnECBFdM7oECBFdZrPsCBFdnDeUCBFfbOqQCBGH1yK8CBGRuxFICBGXpHWoCBGp1
OMwCBG+7ux8CBHgLi+kCBH9sBgICBQCAvD4YAgUAg87arAIFAIauG1kCBQCHiWtVAgUAi0NQ
egIFAI7mzisCBQCS9urkAgUAk2S6rgIFAJSIyy8CBQCVPP64AgUAleRxYQIFAJppUM8CBQCe
xdguAgUAny2q/wIFAKDEEBUCBQCk897PAgUAplbcqgIFAKbytCcCBQCs5EAFAgUAsQTQqQIF
ALG4LJwCBQCzkNoJAgUAvndK1wIFAL8swCwCBQDAdnZrAgUAzANViwIFAM6/vggCBQDQ5x4B
AgUA1Bn0RAIFANTBpxECBQDU5XZxAgUA1n5sEgIFANdAC9QCBQDcmdFGAgUA4mt9BAIFAOKP
8fECBQDyuV2SAgUA+8ZdhQIFAP2bO1KgggO7MIIDtzCCAp+gAwIBAgIBCjANBgkqhkiG9w0B
AQsFADARMQ8wDQYDVQQDEwZpc3N1ZXIwHhcNMjMwNjIzMTIyNjA4WhcNMjQwNjIzMTIyNzA4
WjARMQ8wDQYDVQQDEwZpc3N1ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCW
4EmbnsI5HeM/77rXydenLBAO8b6DMmIHj4CqWCK01MLtgOY+H+N7sR8/GoHutqthn3Le4zsg
ihxzaScytN1GtDm2U85PhopPVvOIhQK1k4yX4WdgaNQoN48tL52rZ9wGlaWFRU7Va8sfAGBH
xvq4bTYGyqdmQzZgmX8lcswOZ6M7G//qC+vI99qPMsDdER0TVmdmYR6Y45s8Nvp5IKA5GTxM
qiaVICSLkN464523VW6T/KvPNaFWpvfNX9mPVkKgHcui1fn2UxqtVI9SpjH3zghj+6mxK9i2
nLit3qJVzCeRIGxb26CsBtzwT2T20LbVXfB73ivINipBiq98d9mXAgMBAAGjggEYMIIBFDAd
BgNVHQ4EFgQUI+YroGMCUZAa0z52cVb6xpibzqAwHwYDVR0jBBgwFoAUI+YroGMCUZAa0z52
cVb6xpibzqAwDgYDVR0PAQH/BAQDAgeAMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcwAoYl
cnN5bmM6Ly9jZXJ0aWZpY2F0ZS9yZXBvc2l0b3J5L2NhLmNlcjBHBggrBgEFBQcBCwQ7MDkw
NwYIKwYBBQUHMAuGK3JzeW5jOi8vY2VydGlmaWNhdGUvcmVwb3NpdG9yeS9maWxlbmFtZS5h
c2EwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAcBggrBgEFBQcBCAEB/wQNMAugCTAHAgUA
22uphDANBgkqhkiG9w0BAQsFAAOCAQEAITO1OeskMD5zzdW109vwt7Jat4CzRr0LaRP21bZA
IOvFdvs3nfvK0uz3dglT7+S4OrUWc0L4lYo1JynWI42FRGzJ6PcSMVywcX1fr+kspWZjhDAP
gApNTa2Bxv35Zql6gMp7lUDMB5LxIjRuW+p+OikWF4knJvWr+l4ei0DrBX8DIDyXqB5b7qUw
HUtCJ6Attd20a1iNp0Kcl6PVsM2LQ0Q0j1lr88tB3rHExtPBASjl56amyU9OBKBZJ0fRwVcI
7e/w1p3Tcfti8oG7kSmRIsqDP8brjFad6b9sM9xjDLKUwFW6TDz6DmPiLfXK6y5DdFYpR8eR
Y0ufZUdTkttc0DGCAaowggGmAgEDgBQj5iugYwJRkBrTPnZxVvrGmJvOoDALBglghkgBZQME
AgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQATEwHAYJKoZIhvcNAQkFMQ8XDTIzMDYy
MzEyMjYwOFowLwYJKoZIhvcNAQkEMSIEIN8st7ktc0jTBvMBnu3e9tCWXdsIzz97l3TaSXPj
m5lfMA0GCSqGSIb3DQEBCwUABIIBACHTBpiD4lkzjYsBRxZKZ7BpECnr14DGidTK0/2tgd63
VIvpdeOT7NKyOm8tbx7HJUEOqKet3uutzQ0n2mzg5z31WGJvRpPgorZ/qXMnN7FgY/bXofvV
mpwaaFfLzDNHFpc2n7Cg7H+qA/UomV5S7QZZmDMqtSl2H/EQJa6xRhK3uaPVPWoAOKUCQC1F
D5pLfhhUmES9ZWVl7K5b/CAWFFmFpdfkvnJWN6elJ59m0ytkS1CKnWKLdVFQVxUGnnQOiBZV
uU9uI09Z9rfQlOXjipH0cVeSF98+kbtkTxltKrCBNdBXQOFOSWg7r3nh8IbiZih9+fAAoPHQ
We2cmYPK888=

Kind regards,
Ties