Re: [Sidrops] WGLC for draft-ietf-sidrops-bgpsec-rollover-00 - ENDS: 04/21/2017 (April 21 2017)

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

Brian,

Thanks for letting me know. 
There was also a marked-up MS word file attachment in the same sidrops post -- I hope you've noted that.
https://www.ietf.org/mail-archive/web/sidrops/current/msg00115.html 

Sriram


________________________________________
From: Brian Weis (bew) <[e-mail]>
Sent: Monday, July 17, 2017 11:04 AM
To: Sriram, Kotikalapudi (Fed)
Subject: Re: [Sidrops] WGLC for draft-ietf-sidrops-bgpsec-rollover-00 - ENDS: 04/21/2017 (April 21 2017)

Hi Sriram,

Found your comments … somehow I missed them earlier. I’ll address them ASAP.

> On Apr 23, 2017, at 6:53 AM, Sriram, Kotikalapudi (Fed) <[e-mail]> wrote:
>
> Hi Brian, Keyur, Roque:
>
> Thanks for all your efforts in authoring this document.
> I have carefully read the draft and have comments.
> Some of my comments are listed here and I have also comments in the attached document
> (marked in the MS word file using track changes).
> My comments are aimed to help get the document into a good shape before advancing it to IESG review.
> The technical accuracy of the method described in not in question but
> still I feel that the draft needs a careful revision.
>
> First, it needs to clear some English issues (grammatical errors, some difficult to parse sentence structures).
> Some of these are pointed out below here, and the rest in the attached word file.

Good. I tried in the last version to address many of these (which originated from an author where English was not the first language), but no doubt missed some

>
> Second, the document needs to eliminate errors in terms of technical terms or phrases used.

Precision is good — thanks.

Many thanks,
Brian

> For example:
> s/BGPsec certificate/router certificate/g
> (Note: It is the router that has a certificate, not the BGPsec protocol)
> s/BGPsec rollover/router key rollover/g
> s/BGPsec emergency rollover/Emergency key rollover/g
> Generally, "BGPsec_Path attributes" needs replaced with "BGPsec updates"
> throughout the document.
> For example:
> s/...BGPsec_Path attributes signed with a new private key.../...BGPsec updates signed with a new private key.../
> (Note: The current AS’s signature covers the prefix, previous BGPsec_Path attribute including all previous signatures,
> the current Secure_Path segment, and the Target AS.
> So it is not correct to say “BGPsec_Path attribute is signed”; instead simply say “BGPsec update is singed”.)
>
> The following comments pertain only to the Abstract and the Introduction section.
> (Please see the attached MS word document for my comments on the other sections.)
> Abstract: minor problem with phrasing
>
> OLD>
> This memo provides general recommendations for
>   that process, as well as describing reasons why the rollover of
>   BGPsec EE certificates might be necessary.
>
> NEW>
> This document provides general recommendations for
>   the rollover process, while describing reasons why the rollover of
>   BGPsec-router EE certificates might be necessary.
>
> Section 2 (Introduction):
>
> OLD>
>   When a router receives or creates a new key pair (using a key
>   provisioning mechanism), this key pair will be used to sign new
>   BGPsec_Path attributes …
>
> NEW>
>   When a router receives or creates a new key pair (using a key
>   provisioning mechanism), this key pair will be used to sign new
>   BGPsec updates …
>
> s/to include a signature using the new key (replacing the replaced key)./
> include a signature using the new key (replacing the old key).
>
> Note: “replacing the replaced key” sounds like a bad phrase
>
> s/ the old BGPsec certificate (and its key) will not longer be valid,/
> the old BGPsec certificate (and its key) will no longer be valid,/
>
> s/ and thus any BGPsec Update that includes a BGPsec_Path attribute with a signature performed by/
> and thus any BGPsec Update that includes a signature performed by/
>
> OLD>
> Consequently, if the router does not
>   refresh its outbound BGPsec Update messages, routing information may
>   be treated as unauthenticated …
> NEW>
> Consequently, if the router does not
>   refresh its outbound BGPsec Update messages, previously sent routing information may be treated as unauthenticated …
>
> OLD>
>   It is therefore extremely important that the BGPsec router key
>   rollover be performed in such a way that the probability of new
>   router EE certificates have been distributed throughout the RPKI
>   before the router begin signing BGPsec_Path attributes with a new
>   private key.
> (Note: sentence is structurally cumbersome)
>
> NEW>
>   It is therefore extremely important that NEW
>   router EE certificates should have been distributed throughout the RPKI system
>   before the router begins signing BGPsec updates with the NEW private key.
>
> Please see comments on other sections in the attached MS word document.
> Thank you.
> Sriram
>
>
>
>
> <draft-ietf-sidrops-bgpsec-rollover-00-ks.docx>

--
Brian Weis
Security, CSG, Cisco Systems
Telephone: [phone]
Email: [e-mail]