Subject: Re: [Sidrops] [WGLC] draft-ietf-sidrops-rpkimaxlen-08 - ends 25/October/2021

From: Alexander Azimov <[email-masked]>
Date: Tue, 23 Nov 2021 16:43:26 +0300

I've read the latest version of the document,  it now sites the
de-aggregation scenario in response to a hijack.
The draft says:

   Nevertheless, this document recommends that where possible, network
   operators publish minimal ROAs even in the face of this risk.  This
   is because:

   *  Minimal ROAs offer the best possible protection against the
      immediate impact of such an attack, rendering the need for such a
      response less likely;
   *  Increasing ROV adoption by network operators will, over time,
      decrease the size of the neighborhoods in which this risk exists;
      and

   *  Other methods for reducing the size of such neighborhoods are
      available to potential victims, such as establishing direct eBGP
      adjacencies with networks from whom the defensive routes would
      otherwise be hidden.

In the world with high adoption rate of ROV I would have definitely
supported this document for publication.
Unfortunately, according to latest research by Geoff Huston - we are
living in a very different world. We have steady progress in signing
ROAs but far less progress in adopting ROV.
And you can't easily distinguish is it safe enough to start using
maximal ROA length or not. For the network that I'm responsible at the
moment - it is not safe.

Another complication may happen when ROV is done at egress (rfc8893).
In case of fast de-aggreagation you may need to turn it off, though
such issue is much easier to resolve.
To sum it up: I still have a feeling that the document is ahead of its
time, and in the imperfect world may itroduce new gaps between
routing-security-in-theory and operations.

вт, 26 окт. 2021 г. в 12:43, Nick Hilliard <[email-masked]>:

> Have read through thoroughly.  It looks fine and is definitely BCP
> material.  It could be improved by being slightly shorter, but this would
> require some refactoring.
>
> Nick
>
> Ties de Kock wrote on 26/10/2021 08:13:
>
> I agree! In my opinion it contains a well-motivated recommendation to
> reduce the
> risk of forged-orgin subprefix hijacks caused by loose ROAs, as well as a
> good
> suggestion that user interfaces should recommend this type of ROA.
>
> Kind regards,
> Ties
>
> On 25 Oct 2021, at 20:53, Borchert, Oliver (Fed) <
> oliver.borchert=[email-masked]> wrote:
>
>
> I read through the draft and believe it is ready to move on to the next
> step,
>
> Oliver
>
> -----------------------------------------------
> Oliver Borchert, Computer Scientist
> National Institute of Standards and Technology
> (Office) +1.301.975.4856
> (GVoice) +1.240.668.4117
>
>
> *From: *Sidrops <[email-masked]> on behalf of Keyur Patel <
> [email-masked]>
> *Date: *Monday, October 11, 2021 at 7:20 PM
> *To: *"[email-masked]" <[email-masked]>
> *Subject: *[Sidrops] [WGLC] draft-ietf-sidrops-rpkimaxlen-08 - ends
> 25/October/2021
>
> Hi Folks:
>
> A working group last call has been requested for
> draft-ietf-sidrops-rpkimaxlen-08, “The Use of Maxlength in the RPKI”.
> Please reply to the list with your comments. The WGLC will end on October
> 25th, 2021.
>
> The draft can be found at:
> https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpkimaxlen-08
> <https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-sidrops-rpkimaxlen-08&data=04%7C01%7Coliver.borchert%40nist.gov%7Cec8e8b19fd814e8e876f08d98d0da775%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637695912071940980%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=siwaghZqxNR5835kbYOBkcVElAbSmDyFyZC6wd2yvyE%3D&reserved=0>.
> Authors, please reply indicating whether you're aware of any relevant IPR
> that hasn't been disclosed.
>
> Regards,
> Nathalie, Chris & Keyur
>
>
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops
>
>
>
>
> _______________________________________________
> Sidrops mailing [email-masked]://www.ietf.org/mailman/listinfo/sidrops
>
>
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops
>

-- 
Best regards,
Alexander Azimov

---

From: Job Snijders <[email-masked]>
Date: Wed, 24 Nov 2021 11:42:57 +0100

On Tue, Nov 23, 2021 at 04:43:26PM +0300, Alexander Azimov wrote:
> living in a very different world.

Can you provide a reference for this 'latest research'?

> We have steady progress in signing ROAs but far less progress in
> adopting ROV.  And you can't easily distinguish is it safe enough to
> start using maximal ROA length or not. For the network that I'm
> responsible at the moment - it is not safe.

Can you elaborate? This seems a rather subjective statement. In any
regard, you are free to configure your own ROAs as you deem fit for
purpose. :-)

> routing-security-in-theory and operations.

I fail to see how this document introduces new gaps. It merely warns
about the potential pitfalls of using the maxlen macro functionality.

Kind regards,

Job