Subject: Re: [Sidrops] MaxLength Considered Harmful to the RPKI?

From: Tim Bruijnzeels <[email-masked]>
Date: Wed, 8 Feb 2017 15:25:39 +0100

Hi,

> On 13 Jan 2017, at 19:58, Job Snijders <[email-masked]> wrote:
> 
> On Thu, Nov 17, 2016 at 02:01:50PM +0900, Tim Bruijnzeels wrote:
>> First of all: good read. And I actually agree that the MaxLength
>> attribute should be eliminated.
> 
> So how do we go about that?

Not sure.. but thinking more about this again I am inclined to look at this as a best practices or operational problem. Just because the ROA specification allows the use of 'max length' as a 'macro' so that one doesn't have to create many different ROAs, doesn't mean that one SHOULD..

And reading RFC7115 "RPKI-Based Origin Validation Op" again, there is already fairly strong advice against the over-use of max length. Specifically it has this:

   One advantage of minimal ROA length is that the forged origin attack
   does not work for sub-prefixes that are not covered by overly long
   max length.  For example, if, instead of 10.0.0.0/16-24, one issues
   10.0.0.0/16 and 10.0.42.0/24, a forged origin attack cannot succeed
   against 10.0.666.0/24.  They must attack the whole /16, which is more
   likely to be noticed because of its size.

I think it would be worth discussing in sidr-ops whether this is enough warning or more is needed.

Practically speaking as an implementer of RPKI as a service to RIPE NCC members, I would be happy to take out the option of using a max length in our interface if there is strong advice against its use. FWIW we have had people asking about a use case where they 'sometimes' need to do more specific announcements and therefore they were thinking of using a wildcard 'maxlength', but after discussion they have decided to use the API that we have for our (hosted) service instead - so they can automate issuing more specific ROAs when needed.

Tim

> 
> Kind regards,
> 
> Job
> 
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops

---

From: Randy Bush <[email-masked]>
Date: Thu, 09 Feb 2017 04:05:00 +0900

> thinking more about this again I am inclined to look at this as a best
> practices or operational problem. Just because the ROA specification
> allows the use of 'max length' as a 'macro' so that one doesn't have
> to create many different ROAs, doesn't mean that one SHOULD..
> 
> And reading RFC7115 "RPKI-Based Origin Validation Op" again, there is
> already fairly strong advice against the over-use of max
> length. Specifically it has this:
> 

wfm