Subject: [sidr] Supporting 'no resources' in res-cert draft?

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 16 Sep 2010 16:04:03 +0200

Hi all,

I wanted to ask how others feel about having resource certificates that
say: "no resources certified."

We have a use case for this at the RIPE NCC. It may happen (for various
reasons) that a member who formerly had a resource certificate issued by
us no longer holds any certifiable resources.

We can of course revoke all existing resource certificate and not issue
a new one. But.. I feel this is confusing to RPs. In particular RPs may
assume, wrongly, that we just forgot to issue a new cert. It's a much
more clear to have a new certificate that says "no resources".

But it seems this is not allowed by the res-cert draft:

We MUST include at least one of "an IP Resources extension, an AS
Resources extension", as described here:
http://tools.ietf.org/html/draft-ietf-sidr-res-certs-18#section-4.9.10

And that inclusion of an "IPAddressFamily" only gives us the option to
either: (1) include a specific resource(range) of that type, or (2)
inherit from the issuer, as described here:
http://tools.ietf.org/html/rfc3779#section-2.2.3

So, we can not legally issue a new resource certificate that says: "no
resources". As far as I can tell this is perfectly legal to do under
rfc3779: just don't include any "IPAddressFamily"; use a "SEQUENCE OF"
with length 0.

So, to re-state my question: do others also see a use-case for resource
certs that have no resources? And if so, could section 4.9.10 of the
res-cert draft be reworded: MUST -> MAY.

Regards,

Tim Bruijnzeels

Senior Software Developer
RIPE NCC

---

From: Christopher Morrow <[email-masked]>
Date: Thu, 16 Sep 2010 10:28:54 -0400

(co-chair toe socks off)

> more clear to have a new certificate that says "no resources".

For a bgp/routing persp
In either case on the routing device the routes are 'invalid' or
'uncool' or whatever the selected term is... So folks in the routing
system will accept/deny the routes

> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: Rob Austein <[email-masked]>
Date: Thu, 16 Sep 2010 10:44:45 -0400

> us no longer holds any certifiable resources.

And relying parties need to know about this why?  Serious question.
The whole RPKI system is designed to obfuscate the identities of
resource holders, so, absent the proposed ghostbusters record, all one
ever really knows is that the holder of key X holds resource Y.  What
is a relying party going to do about key X no longer holding resource
Y other than clean up?  Even in the presence of ghostbuster records,
what is an RP meant to do with the information that RIPE has certified
no resources to Foo Ltd?

As far as I can tell, all that these tombstone certificates would do
is clutter up the system, creating more work for relying parties, with
no clear benefit.  YMMV.

> more clear to have a new certificate that says "no resources".

Maybe I've been drinking the RPKI Kool-Aid for too long, but that
doesn't seem clearer to me.  Resource classes come and go at the whim
of the parent.  When resources in a class shrink to the null set, the
resource class goes away, taking its certificates with it.  When all
of a child's resource classes go away, the child has no resources.
Art is not eternal. :)

> But it seems this is not allowed by the res-cert draft:

I believe that the prohibition was deliberate, and that the person who
feels most vehemently about this is on this list, so I'll let him
speak for himself.

---

From: Roque Gagliano <[email-masked]>
Date: Thu, 16 Sep 2010 16:46:37 +0200

Hi Tim,

> more clear to have a new certificate that says "no resources".

(Roque) 
In the RPKI context, a certificate without resources would be an attestation of what exactly? How can you validate it ? (see section 7.1 of the same document)

I do not think we should model bizarre RP behaviors. What I believe you are trying to do is similar to the idea of using CRL reason code, a debate we already had. 

Regards,
Roque

---

From: Tim Bruijnzeels <[email-masked]>
Date: Thu, 16 Sep 2010 17:03:01 +0200

> what is an RP meant to do with the information that RIPE has certified

It was not the intention to attest that some 'identity' has no
resources. My reason re-stated below..

> of a child's resource classes go away, the child has no resources.

Even though "only revoked certs" and "revoked certs, plus one cert that
says no resources" are semantically similar, the latter will not cause
RPs to suspect race conditions (between looking and publication), or
other problems affecting publication.

But... looking at the reactions to my post it seems that this may not be
an issue. And changing this would cause problems.

I meant to raise it as an open question in the first place, so I have no
problems in standing corrected ;)

---

From: Andrew Chi <[email-masked]>
Date: Thu, 16 Sep 2010 11:37:16 -0400

> rfc3779: just don't include any "IPAddressFamily"; use a "SEQUENCE OF"

True.  Currently, draft-ietf-sidr-res-certs-18 leaves the loophole that 
even if an IP Resources extension is present, it can have length 0.

If we decide to disallow certs with no resources, we should eliminate 
this loophole by rewording the appropriate sentences in 4.9.10 and 
4.9.11 to something like: "All Resource Certificates MUST include a 
non-empty IP Resources extension, a non-empty AS Resource extension, or 
both."

---

From: Sean Turner <[email-masked]>
Date: Mon, 20 Sep 2010 21:15:57 -0400

> non-empty IP Resources extension, a non-empty AS Resource extension, or 

This made me go and look at what draft-ietf-sidr-roa-format says about 
how many need to be present.  What it says is that "one or more IP 
address prefixes that will be advertised".  Should we make the ASN.1 
match this?  That is:

OLD:

  ipAddrBlocks SEQUENCE OF ROAIPAddressFamily }

NEW:

  ipAddrBlocks SEQUENCE (SIZE(1..MAX)) OF ROAIPAddressFamily }

and

OLD:

  addresses SEQUENCE OF ROAIPAddress }

NEW:

  addresses SEQUENCE (SIZE(1..MAX)) OF ROAIPAddress }

spt

---

From: Stephen Kent <[email-masked]>
Date: Tue, 21 Sep 2010 10:51:55 -0400

At 9:15 PM -0400 9/20/10, Sean Turner wrote:
>>True.  Currently, draft-ietf-sidr-res-certs-18 leaves the loophole 
>>that even if an IP Resources extension is present, it can have 
>>length 0.
>>
>>If we decide to disallow certs with no resources, we should 
>>eliminate this loophole by rewording the appropriate sentences in 
>>4.9.10 and 4.9.11 to something like: "All Resource Certificates 
>>MUST include a non-empty IP Resources extension, a non-empty AS 
>>Resource extension, or both."
>
>This made me go and look at what draft-ietf-sidr-roa-format says 
>about how many need to be present.  What it says is that "one or 
>more IP address prefixes that will be advertised".  Should we make 
>the ASN.1 match this?  That is:
>
>OLD:
>

Good catch.  Yes, let's change the ROA ASN.1 to match the text.

Steve