Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-01.txt

From: t.petch <[email-masked]>
Date: Fri, 13 Apr 2012 12:33:46 +0200

----- Original Message -----
From: "Christopher Morrow" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; "Sean Turner" <[email-masked]>;
"t.petch" <[email-masked]>
Sent: Wednesday, March 28, 2012 2:33 PM
Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-01.txt

Sean/Tom,
Tom had some comments on the previous (I believe) version of this
draft, are they addressed to your satisfaction Tom?

<tp>
Not really; it still says

"    o BGPSEC Router Certificates MUST include the BGPSEC EKU defined in
      Section 3.9.5."
but the I-D has no section 3.9.5 so it is unclear what is meant.

And I [still] find it hard to parse
' The validation procedure used for BGPSEC Router Certificates is
   identical to the validation procedure described in Section 7 of
   [RFC6487] except that where "this specification" refers to [RFC6487]
   in that profile in this profile "this specification" is this
   document.'
{a bit like those brain teasers where a single sentence has 13 consecutive
'and's but lacks punctuation}

Tom Petch
</tp>

Sean, if Tom's ok with the changes, should we move this along?

-Chris
<cochair>

On Mon, Dec 5, 2011 at 1:20 PM,  <[email-masked]> wrote:
>
> A New Internet-Draft is available from the on-line Internet-Drafts
directories. This draft is a work item of the Secure Inter-Domain Routing
Working Group of the IETF.
>
> Title : A Profile for BGPSEC Router Certificates, Certificate Revocation
Lists, and Certification Requests
> Author(s) : Mark Reynolds
> Sean Turner
> Steve Kent
> Filename : draft-ietf-sidr-bgpsec-pki-profiles-01.txt
> Pages : 11
> Date : 2011-12-05
>
> This document defines a standard profile for X.509 certificates for
> the purposes of supporting validation of Autonomous System (AS) paths
> in the Border Gateway Protocol (BGP), as part of an extension to that
> protocol known as BGPSEC. BGP is a critical component for the proper
> operation of the Internet as a whole. The BGPSEC protocol is under
> development as a component to address the requirement to provide
> security for the BGP protocol. The goal of BGPSEC is to design a
> protocol for full AS path validation based on the use of strong
> cryptographic primitives. The end-entity (EE) certificates specified
> by this profile are issued under Resource Public Key Infrastructure
> (RPKI) Certification Authority (CA) certificates, containing the AS
> Identifier Delegation extension, to routers within the Autonomous
> System (AS). The certificate asserts that the router(s) holding the
> private key are authorized to send out secure route advertisements on
> behalf of the specified AS. This document also profiles the
> Certificate Revocation List (CRL), profiles the format of
> certification requests, and specifies Relying Party certificate path
> validation procedures. The document extends the RPKI; therefore,
> this documents updates the RPKI Resource Certificates Profile (draft-
> ietf-sidr-res-cert-profile).
>
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-01.txt
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> This Internet-Draft can be retrieved at:
> ftp://ftp.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-01.txt
>
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Sean Turner <[email-masked]>
Date: Fri, 13 Apr 2012 08:19:17 -0400

Tom,

Responses inline.

spt

On 4/13/12 6:33 AM, t.petch wrote:
> From: "Christopher Morrow"<[email-masked]>
> To:<[email-masked]>;<[email-masked]>; "Sean Turner"<[email-masked]>;
> "t.petch"<[email-masked]>

So this has been there for a while :(  It should be pointing to the EKU 
defined in s3.1.3.1.  It's an just an OID you stick in the EKU extension.

> 'and's but lacks punctuation}

I'm trying to avoid copying all the text from 6487 over in to this 
draft.  I would just point there, but I can see somebody doing something 
silly like not understanding that the restrictions on the validation 
procedure are in bgpsec-pki-profiles draft.  So how about this:

   The validation procedure used for BGPSEC Router Certificates is
   identical to the validation procedure described in Section 7 of
   [RFC6487].  The exception is that the constraints applied come
   from this specification (e.g., in step 3: the certificate
   contains all the field that must be present - refers to the
   fields that are required by this specification).

> On Mon, Dec 5, 2011 at 1:20 PM,<[email-masked]>  wrote:
>>

---

From: t.petch <[email-masked]>
Date: Fri, 13 Apr 2012 19:32:48 +0200

----- Original Message -----
From: "Sean Turner" <[email-masked]>
To: "t.petch" <[email-masked]>
Cc: "Christopher Morrow" <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Friday, April 13, 2012 2:19 PM

> Responses inline.

Sean

yes, that looks fine

Tom

---

From: Sean Turner <[email-masked]>
Date: Fri, 13 Apr 2012 14:49:35 -0400

Tom,

Okay posting new version shortly.

spt

On 4/13/12 1:32 PM, t.petch wrote:
> From: "Sean Turner"<[email-masked]>
> To: "t.petch"<[email-masked]>
> Cc: "Christopher Morrow"<[email-masked]>;<[email-masked]>;
> <[email-masked]>