Subject: [sidr] Stephen Farrell's No Objection on draft-ietf-sidr-rpki-rtr-rfc6810-bis-08: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Wed, 15 Feb 2017 15:45:27 -0800

Stephen Farrell has entered the following ballot position for
draft-ietf-sidr-rpki-rtr-rfc6810-bis-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-rfc6810-bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Review based on diff. [1]

[1]
https://tools.ietf.org/rfcdiff?url1=rfc6810&url2=draft-ietf-sidr-rpki-rtr-rfc6810-bis-08.txt

- 5.1: To get around the hard-coded-sha1 thing could we do the
same with the 20 byte SKI value as we did on some other recent
RPKI spec? (IIRC, that was to say that if actual SKI is longer
truncate left, and if shorter pad left with zero, but please
check.)

- section 9: What's the background to removing the statement
that one of TCP-AO ssh etc SHOULD be used? What is the reality
of deployments here? I assume it is not TCP-AO anyway but does
TLS or SSH get used? 

- various places: I think 6810 was correct in using "that" and
not "which" in many places. I realise that's a fairly frequent
style thing that gets toggled though, but I bet the RFC editor
sets a load of those back to "that" :-)

---

From: Randy Bush <[email-masked]>
Date: Thu, 16 Feb 2017 09:28:53 +0900

> of deployments here? I assume it is not TCP-AO anyway but does

TCP-AO never maaterialized.

off-hand, i can not think of a way to measure who is using what, but i
have this horrible suspicion it's all "it's all inside our domain of
control, so let's just run nekkid."

> sets a load of those back to "that" :-)

chicago style.  the rfced and we amuse ourselves over that one.  which
is why rfced gets the big bucks.

randy

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 16 Feb 2017 00:45:03 +0000

> control, so let's just run nekkid."

Yeah that's the concern. If the answer was "seems mostly folks
use ssh" (or tls, or ipsec, whatever), I'd have asked if we
could get away with at least a SHOULD-use for that.

Such encouragement would be good IMO, if it's non-fiction.

Cheers,
S.

---

From: Randy Bush <[email-masked]>
Date: Thu, 16 Feb 2017 10:04:57 +0900

> Such encouragement would be good IMO, if it's non-fiction.

i hack routers and servers daily to keep from becoming a complete bs
artiste.  so of course i tried setting up and running each transport.
ssh was painful; key-based did not work for many platforms, ...  no AO
on any platform i could find.  no TLS client side support.  and there is
a special hell where you have to do a device-diverse deployment of ipsec
once a day ( smb has a student who did a good paper on this).

luckily, ipv6 comes with secure transport built in.  oh wait.

i fear we are in yet another case of security software is not easy to
use so we shift the blame to the user.  we've gotten good at that.

i think that all this is designed to make me happy to go back to hacking
on a paper in latex.

randy