Re: [Sidrops] AD Review of: draft-ietf-sidrops-rpki-has-no-identity

[Warren Kumari <[e-mail]>]

On Thu, Mar 3, 2022 at 10:52 AM Russ Housley <[e-mail]> wrote:

> Warren:
>
> Thanks for the review.
>
> > Firstly, thank you very much for this document, and apologies it has
> taken a while for me to review it.
> >
> > I must admit that I *wanted* to / felt I should be able to use the RPKI
> to do things like sign LOAs and similar "the RIR says I'm the 'owner', seem
> mah cert!" type things, and so, even though the document makes me sad, it's
> useful and needed.
> >
> > I do have a number of editorial comments / nits. Addressing these
> > before IETF LC and IESG review should make progressing the document
> > easier and smoother, as well as being politer to the RFC Editor.
> >
> > Please let me know LOUDLY once you'd had a chance to address them, and
> I'll start IETF LC.
> >
> > Issues / comments:
> > Sec 1:
> > O: "Though since, it has grown to include..."
> > C: I don't have suggested text, but "Though since" is difficult to
> > parse -- it's not clear from the prior sentence what the "though" or
> > "since" refer to. Perhaps "Since publication of [RFC6480], the term has
> grown
> > to include ..."? Actually, I'm not really sure what the sentence was
> trying to
> > say though, so I have no idea if my suggestion works...
>
> I suggest: "Since initial deployment, the RPKI has grown to include ..."
>

Perfect.


>
> > Nits:
> > Sec 1:
> > O: "In security terms the phrase "Public Key"... "
> > P: "In security terms, the phrase "Public Key"  ..."
> > C: Comma.
> >
> > O: "But in reality, the RPKI certificate is only an
> >    authorization to speak for for the explicitly identified INRs;"
> > P: "But in reality, the RPKI certificate is only an
> >    authorization to speak for the explicitly identified INRs;"
> > C: Repeated 'for'
> >
> > Sec 2:
> > O: "Registries such as the Regional Internet Resistries (RIRs)"
> > P: "Registries such as the Regional Internet Registries (RIRs)"
> > C: Typo
> >
> > O: "That the RPKI does not authenticate real world identity is a feature
> >    not a bug."
> > P: "That the RPKI does not authenticate real world identity is a feature,
> >    not a bug "
> > C: Comma
>
> The above suggestions seem fine to me.
>

Thanks!


>
> > O: "Note that, if there is sufficient external, i.e. non-RPKI,
> >    verifcation of authority"
> > P: Note that, if there is sufficient external, i.e. non-RPKI,
> >    verification of authority"
> > C: Typo
>
> Suggestion for the whole paragraph:
>
>    Given sufficient external, i.e. non-RPKI, verification of authority,
>    the use of RPKI-based credentials seems superfluous.
>

Grteat!


>
> > Sec 4:
> > O: "When a document is signed with the private key associated with a RPKI
> >    certificate"
> > P: "When a document is signed with the private key associated with a RPKI
> >    certificate"
> > C: s/a/an/ - grammar
>
> I can see this one either way.
>

Me too; I don't really care / whatever you want...


>
> >
> >  Misc:
> >  s/real world/real-world/g -- I think?
>
> If you mean in Sec 2:
>         s/real world identity/real-world identity/
>         s/real world documents/real-world documents/


There are 12 "real world" instances -- I think that the hyphenated version
is cleaner (and some random grammar tool seems to agree), but again, I
don't really care. Whatever y'all think.
W


>
> Russ
>
>

-- 
The computing scientist’s main challenge is not to get confused by the
complexities of his own making.
  -- E. W. Dijkstra