Session Date/Time: 23 Jul 2024 22:30

sidrops

Summary

This session covered a wide range of topics related to secure inter-domain routing, including updates to existing drafts and presentations on new proposals. Discussions included best current practices for publication servers, ASPA updates, the NRO RPKI program, handling CRL serial numbers, tie-breaking trust anchor certificates, synchronizing RPKI data, consistency in inter-domain routing, MOA profiles, FCPGP, and signed MOS groups.

Key Discussion Points

BCP for Publication Servers: Discussed the latest draft and its adoption. Focus was on handling publication server restores, quota enforcement, and guidance for publishing at RIR publication points.
ASPA Updates: Reviewed recent updates to the ASPA profile, verification, and RTR documents, including the removal of the address family flag and the definition of invalid/unknown paths. Discussion focused on the provider AS count field and improving the RTR documents.
NRO RPKI Program: Introduced the NRO RPKI program aimed at providing a more consistent, secure, resilient, and reliable RPKI service. Sought community input, particularly regarding obstacles to RPKI adoption and expectations for a single global RPKI system.
CRL Serial Numbers: Addressed discrepancies in relying party implementations regarding CRL serial number handling. Proposed that relying parties ignore the contents of the serial number extension. Debated whether to simply ignore the field entirely, or to check that it is present and non-critical, but not process its contents.
Tie-Breaking Trust Anchor Certificates: Presented a tie-breaking scheme for choosing between multiple valid TA certificates, prioritizing recent certificates fetched from the network.
RPKI Data Synchronization: Discussed the desire of some networks (IPv6-only) to filter RPKI data based on data type (e.g., only IPv6 prefixes). Proposed extending existing mechanisms (e.g. RTR) or developing a new package filtering feature.
Inter-Domain Routing Consistency: Defined the problem of inconsistency in inter-domain routing and forwarding due to load balancing, DDoS mitigation, and route aggregation. Proposed checking for path deviations and advertising them to other ASs.
MOA Profile: Presented a profile for mapping origin authorizations (MOAs) for IPV4 address block in IPVC only networks, which are verified by RPKI architecture.
FCPGP: Presented a recap of the FCPGP proposal for BGP update validation and discussion of recent draft updates, with a focus on deployment benefits when partially deployed.
Signed MOS Groups: Proposed a signed MOS group (SMG) object to enable multiple ASs to announce an IP prefix collaboratively. Claimed SMG could complement ROV and support various scenarios.
Baconsau: Highlighted proposed updates and introduced ProvidCon. Aim is to enhance network robustness, prevent improper blocking, and works with other block list solutions.

Decisions and Action Items

BCP for Publication Servers: Authors to consider feedback on publication server restores and quotas for the next revision.
ASPA Updates: Authors to address comments regarding the RTR document, particularly the provider AS count field, and prepare for working group last call.
CRL Serial Numbers: Chairs to consider a call for working group adoption of the draft. The working group will then further discuss whether to check for the field or not.
Tie-Breaking Trust Anchor Certificates: Seek feedback on the mailing list regarding the proposed tie-breaking scheme. Implementation options to consider are BIS or industry submission.
RPKI Data Synchronization: Further discussion needed to select the best option for data filtering.
MOA Profile: Discuss this document on the mail list. Authors would like to ask for working group adoption of this document.
FCPGP: Request working group adoption by sending an email to the list.
Baconsau: Send a request for working group adoption to the main list.

Next Steps

Authors to incorporate feedback and update drafts as discussed.
Chairs to initiate working group last calls for documents nearing completion.
Continued discussion on the mailing lists for open issues and new proposals.
Allocate a longer time slot for the next sidrops meeting.