Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Stephane Bortzmeyer
On Fri, Jan 11, 2013 at 08:48:06AM +0100, Mikael Abrahamsson swm...@swm.pp.se wrote a message of 37 lines which said: If secure BGP verification doesn't work, nothing will work. [...] The RPKI infrastructure needs to be done with same reisiliancy or better it seems. Resiliency of the

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread SM
Hi Mikael, At 23:48 10-01-2013, Mikael Abrahamsson wrote: So trusting SIDR-WG and others to do the protocol standardisation, what needs to be done on the operational side to get this running at a level of quality needed to be 99.999% available and correct, both from the RIR side and documents

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Roque Gagliano (rogaglia)
Wrong Reference. Mikael, have you looked at: http://tools.ietf.org/html/draft-ietf-sidr-origin-ops-19 That could be a starting point to look for missing pieces from an OPS perspective. Roque On Jan 11, 2013, at 11:27 AM, SM s...@resistor.net wrote: Hi Mikael, At 23:48 10-01-2013, Mikael

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Mikael Abrahamsson
On Fri, 11 Jan 2013, SM wrote: draft-ietf-sidr-bgpsec-threats-03 discusses about the threat model. It could be used as a starting point to identify the points of failures. Some of the failure scenarios I have heard from the dns TLD world: Zone file was truncated due to lack of disk space.

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Arturo Servin
Mikael, Do you think that http://tools.ietf.org/html/draft-ietf-sidr-origin-ops-19 covers your concerns? If not, do you recommend to add text to this draft or to focus in a new document describing the operation of a CA? Regards, as On 11/01/2013 09:12, Mikael Abrahamsson wrote:

Re: [sidr] I-D ACTION:draft-ietf-sidr-cps-00.txt

2013-01-11 Thread Christopher Morrow
Hey there SIDR folk, This draft seemed to expire, yesterday, oops! I think we need a CPS describing document, so I bet the authors will refresh this in time. That said: 1) does the current version need work still? Was the combination of the previous 2 documents:

Re: [sidr] I-D ACTION:draft-ietf-sidr-cps-00.txt

2013-01-11 Thread Karen Seo
Chris, Yes, we'll submit a new version. We have not received any feedback since presenting this at the July IETF (6 months ago) so WGLC seems appropriate (to me at least :-)). Thank you, Karen Hey there SIDR folk, This draft seemed to expire, yesterday, oops! I think we need a CPS

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Mikael Abrahamsson
On Fri, 11 Jan 2013, Arturo Servin wrote: Mikael, Do you think that http://tools.ietf.org/html/draft-ietf-sidr-origin-ops-19 covers your concerns? I don't understand enough, but this document isn't even close when it comes to giving hands-on operational advice. What I am talking

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Arturo Servin
Mikael, I have thinking about a how-to document, however, would be the IETF a place to publish something like that? *NOGs document seems more appropiate to me. Regards, as On 11/01/2013 15:57, Mikael Abrahamsson wrote: On Fri, 11 Jan 2013, Arturo Servin wrote: Mikael,

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread SM
Hi Mikael, At 03:12 11-01-2013, Mikael Abrahamsson wrote: Some of the failure scenarios I have heard from the dns TLD world: Zone file was truncated due to lack of disk space. Insufficient checks was in place to notice the truncated zone file before it was replicated out to the public-facing

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Mikael Abrahamsson
On Fri, 11 Jan 2013, SM wrote: You seem to be asking about failures by entities outside your control and an off switch to avoid it from affecting your organization. draft-ietf-sidr-bgpsec-threats-03 doesn't get into that. Well, both for me and for the other organisation. If they find out

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread SM
Hi Arturo, At 10:09 11-01-2013, Arturo Servin wrote: I have thinking about a how-to document, however, would be the IETF a place to publish something like that? I don't think that the IETF publishes how-to documents as RFCs. Regards, -sm

Re: [sidr] current state of BGP origin verification

2013-01-11 Thread Joel jaeggli
On 1/11/13 14:39 , SM wrote: Hi Arturo, At 10:09 11-01-2013, Arturo Servin wrote: I have thinking about a how-to document, however, would be the IETF a place to publish something like that? I don't think that the IETF publishes how-to documents as RFCs. if you're thinking