Subject: [secdir] Secdir review of draft-ietf-sidr-rpki-algs-04

From: Brian Weis <[email-masked]>
Date: Sun, 27 Mar 2011 13:37:15 -0700

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

This document describes the algorithm suite used as part of the RPKI. The suite specifies a single signature algorithm (RSA) with a single key size, a single hashing algorithm (SHA-256), a single signature format, and formats for describing the public key. Section 5 indicates that this profile will be updated when the RPKI needs to adapt different choices. I was glad to see such an algorithm agility plan, but this implies that this will in fact never have a peer document describing another profile. In such a case I would expect the document title to be more inclusive (e.g., drop the first three words of the title). Alternatively, it might be helpful to describe in Section 5 under what circumstance another profile would be published instead of updating this one.

The Security Considerations document refers the reader to the security considerations described in several other documents. After reading those sections, I agree this is appropriate.

Brian

-- 
Brian Weis
Security Standards and Technology, SRTG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

---

From: Stephen Kent <[email-masked]>
Date: Mon, 28 Mar 2011 03:47:29 -0400

At 1:37 PM -0700 3/27/11, Brian Weis wrote:
>I have reviewed this document as part of the security directorate's 
>ongoing effort to review all IETF documents being processed by the 
>IESG. These comments were written primarily for the benefit of the 
>security area directors. Document editors and WG chairs should treat 
>these comments just like any other last call comments.
>
>This document describes the algorithm suite used as part of the 
>RPKI. The suite specifies a single signature algorithm (RSA) with a 
>single key size, a single hashing algorithm (SHA-256), a single 
>signature format, and formats for describing the public key. Section 
>5 indicates that this profile will be updated when the RPKI needs to 
>adapt different choices. I was glad to see such an algorithm agility 
>plan, but this implies that this will in fact never have a peer 
>document describing another profile. In such a case I would expect 
>the document title to be more inclusive (e.g., drop the first three 
>words of the title). Alternatively, it might be helpful to describe 
>in Section 5 under what circumstance another profile would be 
>published instead of updating this one.
>
>The Security Considerations document refers the reader to the 
>security considerations described in several other documents. After 
>reading those sections, I agree this is appropriate.
>
>Brian

Brian,

There will be another profile that will define two sets of algs, 
current and next.  See daft-sidr-algorithm-agility-00.txt for the 
description of how alg migration is anticipated to work. I hesitate 
to put a (normative) reference to that doc in here, because it is not 
yet approved and might slow down the
set of SIDR docs that rely, normatively, on the doc that you reviewed.

Steve

---

From: Brian Weis <[email-masked]>
Date: Mon, 28 Mar 2011 01:38:23 -0700

Hi Steve,

On Mar 28, 2011, at 12:47 AM, Stephen Kent wrote:

> There will be another profile that will define two sets of algs, current and next.  See daft-sidr-algorithm-agility-00.txt for the description of how alg migration is anticipated to work.

I had looked through the algorithm-agility document before commenting but didn't see that it declared that a new profile would be generated. Your description of ("two sets of algs, current and next") seems to match the intent of Section 5, such that it would be an update to this same profile. Here's the text in question:

  "It is anticipated that the RPKI will require the adoption of updated
   key sizes and a different set of signature and hash algorithms over
   time, in order to maintain an acceptable level of cryptographic
   security to protect the integrity of signed products in the RPKI.
   This profile should be updated to specify such future requirements,
   as and when appropriate."

When I read 'updated' I assume it means it adds to the same profile, and the subsequent 'update' will be published under the same name as the original. Is that your intent?

> I hesitate to put a (normative) reference to that doc in here, because it is not yet approved and might slow down the

Understood, and I didn't mean to imply a normative reference was needed -- just an informational explanation of why a different profile might be needed rather than an update to this one. But if that isn't actually expected, then I was questioning why the title implied there would in fact be independent profiles.

Thanks,
Brian

---

From: Stephen Kent <[email-masked]>
Date: Mon, 28 Mar 2011 12:19:55 -0400

At 1:38 AM -0700 3/28/11, Brian Weis wrote:
>....
>description of how alg migration is anticipated to work.
>
>I had looked through the algorithm-agility document before 
>commenting but didn't see that it declared that a new profile would 
>be generated. Your description of ("two sets of algs, current and 
>next") seems to match the intent of Section 5, such that it would be 
>an update to this same profile. Here's the text in question:
>
>When I read 'updated' I assume it means it adds to the same profile, 
>and the subsequent 'update' will be published under the same name as 
>the original. Is that your intent?

yes, although "update" is the wrong RFC term. It should say 
"replace."  we shoud make that change, to the text.

>  > I hesitate to put a (normative) reference to that doc in here, 
>because it is not yet approved and might slow down the
>Understood, and I didn't mean to imply a normative reference was 
>needed -- just an informational explanation of why a different 
>profile might be needed rather than an update to this one. But if 
>that isn't actually expected, then I was questioning why the title 
>implied there would in fact be independent profiles.

OK.  And I agree that we probably should change the name to be "The 
Profile for Algorithms and Key Sizes ..." since we anticipate a 
replacement for this doc when we adopt new algs.

Steve

---

From: Brian Weis <[email-masked]>
Date: Mon, 28 Mar 2011 14:20:09 -0700

On Mar 28, 2011, at 9:19 AM, Stephen Kent wrote:

> yes, although "update" is the wrong RFC term. It should say "replace."  we shoud make that change, to the text.
> 
> OK.  And I agree that we probably should change the name to be "The Profile for Algorithms and Key Sizes ..." since we anticipate a replacement for this doc when we adopt new algs.

Sounds great. I had no other concerns.

Thanks,
Brian