Subject: [sidr] New Version: draft-ietf-sidr-bgpsec-protocol-12

From: Matthew Lepinski <[email-masked]>
Date: Mon, 15 Jun 2015 00:41:46 -0400

I have submitted a new version of the BGPsec protocol specification.

This version includes some minor fixes as well as all of the changes
discussed at IETF 92. (Minutes can be found here --
http://www.ietf.org/proceedings/92/minutes/minutes-92-sidr) I believe that
all open issues with this document have been addressed.

The only normative changes in the -12 version are the following:
-- BGPsec speakers MUST support the multi-protocol extension (RFC 4760)
-- BGPsec now signs the entire MP_REACH_NLRI attribute. (Recall that there
was an error previously where the AFI was not protected under the signature)

I believe that this document is now ready to ship to the IESG. If you
disagree, please let me know what still needs to be addressed.

- Matt Lepinski

---

From: Christopher Morrow <[email-masked]>
Date: Thu, 18 Jun 2015 05:15:19 -0400

I think this means you are asking for a WGLC, yes?
If so we can ship a note to the list (here) about that...

On Mon, Jun 15, 2015 at 12:41 AM, Matthew Lepinski
<[email-masked]> wrote:
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>

---

From: Sandra Murphy <[email-masked]>
Date: Fri, 19 Jun 2015 14:00:00 -0400

> I think this means you are asking for a WGLC, yes?

Not necessarily.  The draft went into wglc in January.  Matt discussed his planned response to the comments received at IETF92.  This version includes those changes.

>> disagree, please let me know what still needs to be addressed.

Anyone who commented on  draft-ietf-sidr-bgpsec-protocol-11.txt is encouraged to review this version and report if your comments have or have not been addressed.

The chairs will be reviewing this version as well.

--Sandy, speaking as a wg co-chair

---

From: David Mandelberg <[email-masked]>
Date: Mon, 22 Jun 2015 21:21:22 -0400

On 2015-06-19 14:00, Sandra Murphy wrote:
> Anyone who commented on  draft-ietf-sidr-bgpsec-protocol-11.txt is
> encouraged to review this version and report if your comments have or
> have not been addressed.

My comments have been addressed, but I have some questions about the 
way one of them was addressed:

Is the MP_REACH_NLRI encoded with or without the attribute flags and 
type code?

Don't the values of MP_REACH_NLRI's "Length of Next Hop Network 
Address" and "Network Address of Next Hop" change with each hop, making 
it infeasible for remote ASes to verify the origin's signature?

MP_REACH_NLRI has a reserved field that "MUST be set to 0, and SHOULD 
be ignored upon receipt". If a BGPsec speaker receives an update where 
reserved is non-zero, what should it do? With the current text, I could 
interpret "SHOULD be ignored upon receipt" as meaning either "calculate 
the signature using the reserved field as received" or "calculate the 
signature using all zeroes in place of the reserved field".

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/