Re: [Sidrops] 6486bis: Failed Fetches

[Stephen Kent <[e-mail]>]

Jay,
> ...
>
> To my point: if RP-implementers feel that the "bits and pieces of
> data" (to use your words) should be considered to best make those
> determinations, such input should be welcomed; conversely, if
> RP-implementers feel that strict publication rules and accompanying
> strict handling of retrieved records together create the best way to
> make those determinations, we all should listen to what they have to
> say.
Sorry, but I beg to differ on this point. My judgement of what is 
critical to the "best" operation of an ISP is not as valuable as that of 
an experienced network operator. On the other hand, my judgement on what 
constitutes secure operation in a PKI context, is, IMHO, more valued 
than that of most folks. We each have our strengths and limitations and 
these ought to be taken into account when valuing inputs to a standard 
like this. That's what I expect the WG chairs to do when reviewing 
comments on the list.
>   > Experience with X.509 cert extensions suggests that the approach I noted
>   > is preferable. Saying that older RPs can ignore objects they don't
>   > understand introduces ambiguity in RP behavior, which is precisely the
>   > concern that motivated the effort to generate 6486bis.
>
> Ambiguity is bad in any technical endeavor where precision is needed.
> And we're here discussing this now because there was ambiguity in
> rfc6486 (not assigning blame -- I missed it, too).  But I don't see
> how it follows that if/when ASPA (for example) is standardized, that
> older RPs should be required to throw away all records retrieved from
> PPs whose MFTs now cite ASPA records.

I quickly reviewed the ASPA ID. I didn't see a description of how the 
RPKI is used to validate these newly-proposed, signed objects.  Until 
that is made clear, it isn't clear why an ASPA even belongs in the RPKI 
repository system. So, your question seems premature.

Steve