Subject: [sidr] Why is covering match better than BOA?

From: Sam Weiler <[email-masked]>
Date: Thu, 8 Jan 2009 15:04:45 -0500 (EST)

Question two:

The validation draft proposes placing a higher level of trust in a 
"covering match" ROA than in a BOA.  Why?  What use case is served by 
that interpretation?

-- Sam

_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: Geoff Huston <[email-masked]>
Date: Mon, 12 Jan 2009 06:30:42 +1100

*WG Chair Hat OFF*

On 09/01/2009, at 7:04 AM, Sam Weiler wrote:

> "covering match" ROA than in a BOA.  Why?  What use case is served  
> by that interpretation?

The form of  use case I can envisage is one that involves some  
negligence on the part of the prefix holder in failing to issue a ROA  
that encompasses all advertised forms of the advertisement. Perhaps  
there are others.

What's your opinion Sam?

For example, if there is a valid ROA for 10.0.0.0/16, Origin AS 1,  
with a maximum prefix length of 16 (i.e. the ROA does not permit more  
specifics), and there is a valid BOA for 10.128.0.0/20, and this  
single ROA and single BOA are the only two rescert objects that have  
been published, then how should a relying party interpret the  
following advertisements:

1) aggregate, matching AS
     10.0.0.0/8, origin AS 1

2) aggregate, non-matching AS
     10.0.0.0/8, origin AS 2

3) exact match
     10.0.0.0/16, origin AS 1

4) exact mismatch
     10.0.0.0/16, origin AS 2

5) covering match
     10.128.0.0/17 origin AS 1

6) covering mismatch
     10.128.0.0/17 origin AS 2

7) ROA covering match, BOA match
     10.128.0.0/20 origin AS 1

8) ROA covering mismatch, BOA match
     10.128.0.0/20 origin AS 2

9) ROA covering match, BOA covering match
     10.128.0.0/24 origin AS 1

10) ROA covering mismatch, BOA covering match
     10.128.0.0/24 origin AS 2

For reference, the proposed algorithm in draft-ietf-roa-validation-01  
proposes that the BOA is used in cases 8 and 10 only.

regards,

     Geoff