Re: [Sidrops] I-D Action: draft-ietf-sidrops-signed-tal-01.txt

[Tom Harrison <[e-mail]>]

On Fri, Jun 08, 2018 at 06:30:41AM -0700, [e-mail] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the SIDR Operations WG of the IETF.
> 
>         Title           : RPKI signed object for TAL
>         Authors         : Tim Bruijnzeels
>                           Carlos Martinez
>         Filename        : draft-ietf-sidrops-signed-tal-01.txt
>         Pages           : 12
>         Date            : 2018-06-08

I've updated our proof-of-concept to match the new draft.  Some
questions and minor suggestions:

In section 3, there is:

   The ASN.1 syntax for the Signed TAL eContent defined in
   Section 3.2.  (This is the payload that specifies the AS being
   authorized to originate routes as well as the prefixes to which
   the AS may originate routes.)

The text in parentheses looks to be a cut-and-paste from the ROA
profile document (RFC 6482).

In section 4, there is "[t]his EE certificate MUST have a 'notAfter'
time that reflects the intended time that this Signed TAL will be
published", which on its face implies that the 'notAfter' should be
set to the time when the object is first published.  Changing it to
"reflects the intended time [or duration] for which this signed TAL
will be published" should make things clearer.

The SubjectPublicKeyInfo in the TAL structure has the type IA5String.
Is there some reason not to use the 'raw' SubjectPublicKeyInfo type
from RFC 5280?

Since activationTime is not needed for an in-protocol reason at the
moment, it would be good to add a note to the draft that it's there to
prompt discussion/feedback about future dating.

On future dating more generally, I think it's a good idea, since it
allows for in-band signalling about the rollover and would (hopefully)
encourage a wider set of users to test the new tree before it becomes
the 'official' tree.

-Tom