[Sidrops] Re: Mahesh Jethanandani's No Objection on draft-ietf-sidrops-rpki-crl-numbers-04: (with COMMENT)

[Job Snijders <[e-mail]>]

Dear all,

On Tue, May 20, 2025 at 09:51:57PM -0700, Mahesh Jethanandani wrote:
> > On May 19, 2025, at 9:35 PM, Theo Buehler <[e-mail]> wrote:
> > 
> >>>      |  Per Section 5.2.3 of [RFC5280], CAs issue new CRLs using a
> >>>      |  monotonically increasing sequence number in the "CRL Number"
> >>>      |  extension.  It is RECOMMENDED that the "CRL Number" matches the
> >>>      |  "manifestNumber" of the manifest that will include this CRL
> >>>      |  (see Section 4.2.1 of [RFC9286]).
> >> 
> >> Maybe this is covered somewhere else, but reading the last sentence of the NEW
> >> I wonder what happens when the CRL Number does NOT match the manifestNumber. Is
> >> the session aborted? Does it fall back to previous behavior, i.e., checking the
> >> highest value of CRL Number. Some clarity would help.
> > 
> > The I-D specifies that the crlNumber be ignored. Checking whether it
> > matches the manifestNumber or not is not ignoring it :)
> 
> I think Deb had a similar comment …
> 
> The draft says “It is RECOMMENDED” that the ‘CRL Number’ matches the
> ‘manifestNumber’. The question was, what happens when “CRL Number”
> does not match the “manifestNumber”?

Nothing happens. As this document attempts to clarify: Relying Parties
ignore the CRL Number value. The RP discards the CRL Number value, the
value does not impact the decision making process on the RP side, it
simply is not considered (whether it matches the manifestNumber or not).

(For historical reasons,) RPKI Issuers must include _some_ CRL Number
(which can be any number); in turn Relying Parties merely check whether
the extension is present and validly encoded, but otherwise ignore it.

Seeing that multiple reasonable people now have gotten distracted by
this particular sentence, I see two paths forward:

Option 1) REMOVE this sentence: "It is RECOMMENDED that the "CRL Number"
	  matches the "manifestNumber" of the manifest that will include
	  this CRL (see Section 4.2.1 of [RFC9286])."

Option 2) REPHRASE ... but how? Its just a recommendation. "You *have*
	  to pick a color, we recommend picking the same color as this
	  other thing over there because it's implementation-wise
	  perhaps simpler."

However - in attempting to rephrase, we risk that our continued rubbing
makes this stain in the carpet worse and worse...

My preference is option 1 - just remove it, but if people know of a
sentence that conveys a recommendation what value to use without causing
confusion I'm all ears! Let me know

Kind regards,

Job