Re: [Sidrops] draft-sidrops-rpkimaxlen

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

Hi Matthias,

>I read the (expired) draft draft-sidrops-rpkimaxlen.

It appears that a fork in the draft stream occurred inadvertently 
sometime ago when Job tried to upload a new version. 
You were looking at the "expired" branch. 
The draft is active:
https://tools.ietf.org/html/draft-ietf-sidrops-rpkimaxlen-01   

>The problem analysis in the draft is misleading.
>The problem is not the usage of the max length field. Even without a
>max length field, a "forged-origin subprefix hijack" may occur easily. 
>For example, a minimal, more specific ROA has been created, and the 
>prefix is currently not announced by the origin AS configured in the ROA.

IMO, the spirit and intention of the document is in complete alignment 
with what you are trying to covey. It is the *misuse* of maxlength that 
the draft cautions about. Adding the following wording (with some 
further refinement) in the document will help clarify:

A minimal ROA is one which includes prefixes that are currently 
announced or are intended to be announced. Use of maxlength 
can be avoided or it should be used judiciously so that 
more specific prefixes that are not intended to be announced 
are not covered by the ROA. The idea is to minimize the attack
surface corresponding to forged-origin subprefix hijacking.     

>The draft implicitly suggests: "Only create ROAs for prefixes that are 
>currently announced." I'm not sure whether the WG has consensus about 
>that.

This was not the intent in the draft. A better definition of minimal ROA as
outlined above will take care of the misunderstanding. 
The draft did recognize that the IP prefixes planned to be announced 
in the future or intermittently (when needed) may be included in the ROA.
Please see the following paragraph from Section 5.1:  

   "In this case, the ROA SHOULD include (1) the set of IP prefixes that
   are always originated in BGP, and (2) the set IP prefixes that are
   sometimes, but not always, originated in BGP.  The ROA SHOULD NOT
   include any IP prefixes that the operator knows will not be
   originated in BGP."

There is a use case described after that involving DDoS mitigation.

>The draft is expired. I suggest to leave it expired because it leads 
>to incorrect conclusions, see for example 
>https://github.com/DECIX/RPKI/wiki/RPKI-deployment-options 

I carefully went through the link you've provided. Nice work!
I do not see any inconsistency between your approach with ROAs 
and what is in the draft, especially with the better definition of ROA as
stated above (IMO). Please let us know if you still see it differently.
In fact, there is a similarity between your Blackhole use case
and the DDoS mitigation use case in the draft (except that 
the latter doesn't involve prefixes more specific than /24 IPv4  or /48 IPv6).

DDoS mitigation providers' needs are discussed in Section 5.1 
and network operators seem to have found that discussion and 
related recommendations quite useful. Please see this thread: 

https://lists.arin.net/pipermail/arin-tech-discuss/2018-August/000723.html   

It should be noted that the document is aimed to be a BCP, not standards track.

Thanks for your inputs.

Regards,
Sriram