Re: [Sidrops] feedback on draft-michaelson-rpki-rta

[Martin Hoffmann <[e-mail]>]

Ben Maddison wrote:
> 
> This was kinda the point I was making when I said that I couldn't
> think of any use-cases for which multiple RTAs wouldn't work:
> 
> The above logic works just the same if you instead have N RTAs over
> the same signed data, and require that the union of `resources` from
> each be the same as the set described in the signed data.
> 
> Doing it this way seems to present the advantage of decoupling the
> rpki-validation of the CMS blob from the
> application-specific-validation of the underlying data.

A drawback of this is, however, that you cannot decide anymore whether
your document is truly "RTA invalid" or if you are just missing some
of the data. Or, turned around, somehow loosing an RTA from the set
makes the underlying data seem invalid even though it isn’t.

This is quite similar to the situation we have in origin validation
where loosing a ROA from the set may make a route invalid.

Forcing all relevant data into a single object avoids this problem and
makes an invalid a definitive invalid.

> Every use case for this will require tooling to perform additional
> validation of the signed data against the RTA (at least verifying the
> digest, probably more), so this doesn't introduce a new step in the
> process, it just moves responsibility for it out of the RTA spec.

I’m not sure that is a desirable outcome. In its currently proposed
form, RTA processing in its generic, application independent form
handles all of the processing related to resources. You give it an RTA
and a hash and it returns either a set of valid resources or a validation
error. All of the application specific processing can be easily built
around that.

If RTAs are split, the application has to call into this interface
multiple times and then has to decide how to merge the multiple results.
That means each application has to define how to do that and both ends
have to correctly do that.

The work of dealing with resources under multiple parents has to be
done. I think doing it once in a well-defined way is a better approach.

 - Martin