Re: [Sidrops] Reason for Outage report (was: Re: ARIN RPKI Service Impact - 12 August 2020 - manifest issue - resolved)

[Job Snijders <[e-mail]>]

On Fri, Aug 28, 2020 at 02:10:42PM +0200, Tim Bruijnzeels wrote:
> > first, you may not know the prefix from the failed pp; it failed.
> > second, getting you to think that you do could be a nice attack.
> 
> You were looking at all the objects listed on a manifest you found for
> a valid CA certificate. You know which resources the valid CA
> certificate holds.

Suggested text, feedback welcome:

================

If a CA's publication point's RPKI data is invalid, a Relying Party MUST
add all IP address resources listed on the certificate's issuer to a
Prefix Filter. The Relying party MUST consider any VRPs derived from any
Trust Anchor to match with this Prefix Filter if the VRP prefix is equal
to or covered by any of the Prefix Filter prefix. The following prefixes
MUST NOT be added to the Prefix Filter: 0.0.0.0 and ::/0

================

In other words, if a valid current manifest at a publication point
demonstrates files are missing, the resources listed in the
AIA's sbgp-ipAddrBlock extension become an output filter.

If under RIPE's TA a CA delegates authority for 85.xx.0.0/16 to a
publication point, and a ROA file is missing, and 85.xx.0.0/16 also
exists somewhere under ARIN's TA, the RP should omit to produce VRPs
covering 85.xx.0.0/16 or more specific. This is the safest approach.

By excluding 0.0.0.0/0 and ::/0 we prevent one TA from taking down
another TA, and encourage a (hopefully) healthy approach to operational
intermediate certificates which exist to narrow the TA's blast radius.

Kind regards,

Job