Subject: [sidr] RIR's moving to all resources (0/0) RPKI TA's

From: John Curran <[email-masked]>
Date: Wed, 12 Jul 2017 00:01:40 +0000

Sidr Folks -

FYI.   While excellent progress is ongoing with the alternative algorithm
specified in draft-ietf-sidr-rpki-validation-reconsidered, it is worth noting
that the RIRs will presently be moving to all resource RPKI TA’s to help
mitigate the risk of massive downstream invalidation that would occur in
the case of inconsistencies under present validation algorithm:

Per <https://www.nro.net/regional-internet-registries-are-preparing-to-deploy-all-resources-rpki-service/> –
"By 30 September 2017, each RIR will have moved from an RPKI Trust Anchor that reflects their current holdings to one that reflects all holdings (0/0), as further detailed in the “All Resources Applicability Statement” dated 21 January 2017:  https://www.ietf.org/archive/id/draft-rir-rpki-allres-ta-app-statement-01.txt  … “

FYI,
/John

John Curran
Chair, Number Resource Organization (NRO)

---

From: Randy Bush <[email-masked]>
Date: Wed, 12 Jul 2017 11:00:53 +0200

> FYI.  While excellent progress is ongoing with the alternative
> algorithm specified in draft-ietf-sidr-rpki-validation-reconsidered,
> it is worth noting that the RIRs will presently be moving to all
> resource RPKI TA’s to help mitigate the risk of massive downstream
> invalidation that would occur in the case of inconsistencies under
> present validation algorithm:

what continues to amuse me is that all these contortions address rir
failures we have not seen; while the failures we have seen (ee cert in
manifest expiration timing, etc.) have not been systematically
addressed.

randy

---

From: John Curran <[email-masked]>
Date: Wed, 12 Jul 2017 11:03:24 +0000

> manifest expiration timing, etc.) have not been systematically

Randy - 

While your amusement is not the primary goal of the system, it does
serve as a good reminder that there is more work to be done.  This
change shouldn’t be viewed as anything other than one small step in 
the journey of making RPKI services more robust. 

Thanks,
/John