Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-12-06 Thread Christopher Morrow
On Fri, Nov 30, 2012 at 6:37 PM, Randy Bush ra...@psg.com wrote: The counter tends to be viewed as quite amateurish. personally, i would be professionally embarrassed to have my name on such wild assed cabbage throwing as that document. I would point out to all folks on this list, and

Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-12-06 Thread Christopher Morrow
On Thu, Dec 6, 2012 at 2:42 PM, Russ White ru...@riw.us wrote: Aren't we just adding to the total attack surface available against the routing system by allowing users to go into a web page and change what's advertised into the ROA system? could be, but so are ssl cert things from thawte, or

Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-11-30 Thread Christopher Morrow
On Fri, Nov 30, 2012 at 11:50 AM, Russ White ru...@riw.us wrote: So the routing system is being secured by information that is at least several minutes behind actual topology changes. What impact will this have on the overall number of updates, speed of reachability, etc. --and what's the

Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-11-30 Thread Christopher Morrow
On Fri, Nov 30, 2012 at 11:50 AM, Russ White ru...@riw.us wrote: Of course, SIDR has never cared about what happens ten years from now, since that's beyond the time horizon for the actual goals at hand. this isn't a particularly useful line of commentary, could we stick with the problem we're

Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-11-30 Thread Christopher Morrow
On Fri, Nov 30, 2012 at 2:37 PM, Arturo Servin arturo.ser...@gmail.com wrote: If you only have one cache, and this fails, and you need to restore the whole repository(ies): then yes. You have a problem. But if you have two cache servers, perhaps you would not even notice

Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-11-30 Thread Christopher Morrow
On Fri, Nov 30, 2012 at 3:11 PM, Danny McPherson da...@tcb.net wrote: limits on its reaction time. Certainly from my perspective, more suited to pre-publishing preventative data, then creating reactionary data. And the state of the art in DDoS mitigation doesn't allow this, period. it sure

Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-11-19 Thread Christopher Morrow
On Sat, Nov 17, 2012 at 4:20 PM, Eric Osterweil eosterw...@verisign.com wrote: On Nov 17, 2012, at 9:48 AM, Randy Bush wrote: if an AS is to run its own SIA (which I believe is envisioned to be far and away be the common case) quite the opposite. the vast majority of ASs will likely use

Re: [sidr] additions and changes to agenda on Friday

2012-11-14 Thread Christopher Morrow
On Fri, Nov 9, 2012 at 9:35 AM, Tim Bruijnzeels t...@ripe.net wrote: Good. On that note I think it's worthwhile thinking about different complementary ways to deal with this. I.e. make the server side more scalable as well as considering flooding protocols and other ways to share data between

Re: [sidr] Scaling properties of caching in a globally deployed RPKI / BGPSEC system

2012-11-14 Thread Christopher Morrow
1 quick note on the numbers below (I've not read the paper, just the commentary) also, thanks to eric for making some work available, and taking a stab at the numbers/sizing/speeding. On Wed, Nov 14, 2012 at 11:36 PM, Arturo Servin arturo.ser...@gmail.com wrote: Erick Very interesting

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 10:25 AM, Danny McPherson da...@tcb.net wrote: On Nov 7, 2012, at 10:13 AM, Christopher Morrow wrote: On Wed, Nov 7, 2012 at 9:11 AM, Dan York dan-i...@danyork.org wrote: Agreed, sadly... but the good news is that this whole thing did get more people thinking about

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 11:33 AM, Danny McPherson da...@tcb.net wrote: take that up with the secretariat? I'm not sure how 'sidr chairs have a conflict with grow chairs, since they are the same person' isn't a clear signal to: do not schedule these at the sametime. Telling, indeed..

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 11:33 AM, Danny McPherson da...@tcb.net wrote: I'm not convinced that is the right approach, I don't think it needs to be IN BGP. Hence the original route leak draft, which we just updated, mind you:

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 11:33 AM, Danny McPherson da...@tcb.net wrote: Not on my last read, e.g.: (These behaviors are not precluded by the specification for BGP, and might be the result of a local policy that is not publicly disclosed. As a result, they are not considered attacks. See

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 1:39 PM, Shane Amante sh...@castlepoint.net wrote: Chris, On Nov 7, 2012, at 11:11 AM, Christopher Morrow morrowc.li...@gmail.com wrote: there isn't data in bgp today data which tells you 'this path is a leak'. Even at the immediately-leaked-to peer there isn't data

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 1:39 PM, Danny McPherson da...@tcb.net wrote: On Nov 7, 2012, at 1:37 PM, Christopher Morrow wrote: where to send comments/questions? Fine question, apparently out of the scope of _S_I_D_R. Perhaps GROW, we should ask the chairs :-) frankly I'm happy to add

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
(aside: ugh, your mail client doesn't wrap lines properly... or gmail isn't re-wrapping properly) On Wed, Nov 7, 2012 at 2:02 PM, Danny McPherson da...@tcb.net wrote: On Nov 7, 2012, at 1:42 PM, Christopher Morrow wrote: The draft you reference up-thread isn't actually helpful, it doesn't

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 2:04 PM, Danny McPherson da...@tcb.net wrote: On Nov 7, 2012, at 1:49 PM, Christopher Morrow wrote: frankly I'm happy to add comments on the sidr list, or grow list or you directly... my question perhaps was mis-phrased, I'll try again: Where would you like me

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 2:06 PM, Danny McPherson da...@tcb.net wrote: On Nov 7, 2012, at 1:48 PM, Christopher Morrow wrote: 1) show/agree that this is a problem (route leaks) Do you believe this is a problem? When describing events such as this as of late, what did you call it? sure

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
(also, your mail client is not wrapping properly) On Wed, Nov 7, 2012 at 2:15 PM, Shane Amante sh...@castlepoint.net wrote: On Nov 7, 2012, at 1:48 PM, Christopher Morrow morrowc.li...@gmail.com wrote: On Wed, Nov 7, 2012 at 1:39 PM, Shane Amante sh...@castlepoint.net wrote: Chris, On Nov

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 3:04 PM, Jakob Heitz jakob.he...@ericsson.com wrote: Wasn't there a proposal along the lines of: Create an attribute that says: I authorize you to announce this route to your provider I think it was some form of 'bit for transit' and 'bit for customer' ... but sure.

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 4:37 PM, Danny McPherson da...@tcb.net wrote: On Nov 7, 2012, at 3:56 PM, Christopher Morrow wrote: I'm not presupposing, I'm saying that today you CAN do what you want with IRR data, some folks do this with varying degrees of success/failure. you could improve

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 5:47 PM, Eric Osterweil eosterw...@verisign.com wrote: On Nov 7, 2012, at 4:11 PM, Christopher Morrow wrote: (also, your mail client is not wrapping properly) How's my client treatin' ya? :-P just as broke, bug lodged (I hope) for a fix. On Wed, Nov 7, 2012 at 2:15

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 6:08 PM, Eric Osterweil eosterw...@verisign.com wrote: Right, but did anyone who was involved in remediating that Moratel leak say, ``we're all set, I can see the path of the leak, it's miller time!''? I'm pretty sure verifying the leak is not the same as remediating

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 6:38 PM, Eric Osterweil eosterw...@verisign.com wrote: On Nov 7, 2012, at 6:10 PM, Christopher Morrow wrote: On Wed, Nov 7, 2012 at 5:47 PM, Eric Osterweil eosterw...@verisign.com wrote: On Nov 7, 2012, at 4:11 PM, Christopher Morrow wrote: just as broke, bug

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 6:17 PM, Shane Amante sh...@castlepoint.net wrote: I can't, nor do I believe can anyone else. I refer you to the following: i don't know what your first sentence means. http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-threats-03#section-5 ---snip--- o Route leaks

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 10:22 PM, Randy Bush ra...@psg.com wrote: pedantry 'Route leaks are viewed as a routing security problem... route leaks, as we anecdotally know them, are an operational problem. sure, I was actually mostly quoting the draft, probably that comment belongs to the

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-11-07 Thread Christopher Morrow
, Byron On 13/10/2012, at 12:53 AM, Christopher Morrow morrowc.li...@gmail.com wrote: Helo, Since we've been through this for a while (originally) and this has been quiet for ~1 month... let's call this done and move to the next step. 1) there was lots of discussion on the topic at hand 2

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-11-07 Thread Christopher Morrow
On Mon, Oct 15, 2012 at 9:21 AM, Andy Newton a...@arin.net wrote: On 10/12/12 10:53 AM, Christopher Morrow morrowc.li...@gmail.com wrote: I think if, in the end, the wg decides to abandon the work that's also fine, but we should have a more structured chat about the topic, that happens around

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Thu, Nov 8, 2012 at 12:00 AM, Shane Amante sh...@castlepoint.net wrote: Nice try; however, you didn't address the crux of the matter, which are these statements in the threats document: ugh, i keep trying to be polite and point out that: 1) no one said you can't discuss this 2) no one

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-07 Thread Christopher Morrow
On Thu, Nov 8, 2012 at 12:00 AM, Shane Amante sh...@castlepoint.net wrote: Second, there is this sentence: BGP itself ***does not include semantics*** that preclude what many perceive as route leaks. ... That statement reads to me as stating that _because_ BGP does include semantics to

[sidr] BGPSEC Threats Doc updates + comment handling

2012-11-07 Thread Christopher Morrow
The threats document: http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-threats-03 was updated September 14, 2012, the idea being it captured the comments made on -02, a primary author of comments was Danny (copied), had the commentors gotten time to review whether or not the comments met

Re: [sidr] additions and changes to agenda on Friday

2012-11-07 Thread Christopher Morrow
On Wed, Nov 7, 2012 at 10:55 PM, John Curran jcur...@arin.net wrote: a lot of fun, but the semantics behind the PKIX certificates are actually there for good reason. While I'm sure you can make the bits syntactically fit, it is equally important that there is an actual meeting of the minds

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-11-07 Thread Christopher Morrow
On Thu, Nov 8, 2012 at 12:53 AM, Byron Ellacott b...@apnic.net wrote: Hi Chris, On 08/11/2012, at 3:04 PM, Christopher Morrow morrowc.li...@gmail.com wrote: On Mon, Oct 15, 2012 at 1:36 AM, Byron Ellacott b...@apnic.net wrote: Hi Chris, When did the WG reach consensus on adopting

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-11-07 Thread Christopher Morrow
On Thu, Nov 8, 2012 at 1:26 AM, Byron Ellacott b...@apnic.net wrote: Hi Chris, On 08/11/2012, at 4:00 PM, Christopher Morrow morrowc.li...@gmail.com wrote: ok, i suppose my point here is that there's a bunch of discussion, there's a draft that got chattered about quite a bit. having the wg

Re: [sidr] The need for SIDR - Google limited outage today due to bogus route announcement

2012-11-06 Thread Christopher Morrow
note I do want to see rpki/sidr deployment move forward, but... On Tue, Nov 6, 2012 at 1:45 PM, Dan York dan-i...@danyork.org wrote: Here, in one easy-to-read article, is a great example of why we need RPKI and/or other secure routing technologies that verify the origins of route

Re: [sidr] [fixed] Confirming that the last interim reflects working group consensus

2012-10-12 Thread Christopher Morrow
On Thu, Oct 11, 2012 at 2:06 PM, Eric Osterweil eosterw...@verisign.com wrote: On Oct 11, 2012, at 12:24 PM, Arturo Servin wrote: Chris, I think that you and Sandy mentioned that draft-ietf-sidr-bgpsec-threats and draft-ietf-sidr-bgpsec-threats should be done before

Re: [sidr] I-D Action: draft-ietf-sidr-rpki-grandparenting-00.txt

2012-10-12 Thread Christopher Morrow
thanks author. On Fri, Oct 12, 2012 at 11:10 PM, internet-dra...@ietf.org wrote: A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : Responsible

Re: [sidr] [fixed] Confirming that the last interim reflects working group consensus

2012-10-11 Thread Christopher Morrow
On Thu, Oct 11, 2012 at 9:51 AM, Danny McPherson da...@tcb.net wrote: On Oct 9, 2012, at 11:36 PM, Matthew Lepinski wrote: I would like to confirm on the list that the discussions at the last interim reflect the consensus of the working group. In this message, I list for each open issue, my

Re: [sidr] WGLC for draft-ietf-sidr-bgpsec-protocol-05

2012-09-21 Thread Christopher Morrow
On Fri, Sep 21, 2012 at 8:18 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: I don't believe it is at all appropriate to WGLC a document prior to substantive review and maturity. it's on it's 5th revision, with substantive discussion along the way...

Re: [sidr] WGLC for draft-ietf-sidr-bgpsec-protocol-05

2012-09-21 Thread Christopher Morrow
I think your objection was noted... no need to belabour the point (or become uncivil) thanks for your opinion. -chris ___ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr

Re: [sidr] RPKI - allocation consistency

2012-08-31 Thread Christopher Morrow
On Fri, Aug 31, 2012 at 8:34 AM, Brian Dickson brian.peter.dick...@gmail.com wrote: So, does it not make sense that the RPKI, meaning its design, architecture, procedures, etc., should actually enforce exclulsivity? see tim's note. ___ sidr mailing

Re: [sidr] RPKI - allocation consistency

2012-08-30 Thread Christopher Morrow
On Thu, Aug 30, 2012 at 10:59 AM, Eric Osterweil eosterw...@verisign.com wrote: On Aug 28, 2012, at 2:55 PM, Stephen Kent wrote: Eric, Perhaps what you are looking for is some text in an operations doc, suggesting what an RP can expect, depending on how it elects to interact with the

[sidr] WGLC: draft-ietf-sidr-origin-ops-

2012-08-17 Thread Christopher Morrow
Hello WG folk, This draft has undergone 9 revisions since the last WGLC, which seemed to end with requests for changes by the authors. Can we now have a final-final-please-let's-progress WGLC for this draft now? Let's end the call: 08/31/2012 (Aug 31 2012). Htmlized version available at:

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-08-13 Thread Christopher Morrow
On Mon, Aug 13, 2012 at 12:56 AM, Byron Ellacott b...@apnic.net wrote: Hi Chris, On 11/08/2012, at 12:00 AM, Christopher Morrow wrote: On Fri, Aug 10, 2012 at 1:18 AM, Byron Ellacott b...@apnic.net wrote: (But this is sort of my point, the RPKI system's verification of right of use breaks

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-08-10 Thread Christopher Morrow
On Fri, Aug 10, 2012 at 1:18 AM, Byron Ellacott b...@apnic.net wrote: (But this is sort of my point, the RPKI system's verification of right of use breaks down if you start certifying multiple people as having a simultaneous right to use resources :-) but that model has to exist as you have

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-08-10 Thread Christopher Morrow
On Fri, Aug 10, 2012 at 7:02 AM, Terry Manderson te...@terrym.net wrote: I'm sorry Chris, I think this concern about having to 'avoid' LEA actions is FUD worthy. Regardless if it occurs at the peak of the hierarchy or any level underneath. lots of words elided hrm, so... LEA folk figuring

Re: [sidr] WG acceptance call for draft-ymbk-rpki-grandparenting

2012-08-09 Thread Christopher Morrow
an interesting outgrowth of the grandparenting could be the ability to 'avoid' LEA actions at middle tiers of the address allocation heirarchy... that's something to consider, i'd say. On Thu, Aug 9, 2012 at 10:50 AM, Randy Bush ra...@psg.com wrote: tim, i see where some confusion might come

Re: [sidr] sidr participation in the LIM scheduled for 29 Sep in Amsterday

2012-08-03 Thread Christopher Morrow
On Fri, Aug 3, 2012 at 9:54 PM, Ed Kern ejk...@gmail.com wrote: Ill be happy to host the webex for the meeting to decide if future confirmations on the list are necessary. I'm sorry, we certainly need to confirm on list the need for a webex, and of course for a meeting to talk about the

Re: [sidr] request for agenda items for interim meeting 6 Jun

2012-05-24 Thread Christopher Morrow
On Thu, May 24, 2012 at 9:19 AM, George, Wes wesley.geo...@twcable.com wrote: However, in order to gain any benefit from the location, we probably need to publicize the interim on the NANOG list, though the window for doing it before travel plans are made is probably closing/closed. Wasn't

Re: [sidr] [INTERIM MEETING 6/6] Agenda update

2012-05-24 Thread Christopher Morrow
An astute reader notes that the original message: http://www.ietf.org/mail-archive/web/sidr/current/msg04563.html (additionally, until a moment ago the wiki doc for the meeting had this text copied/pasted into it...) Had the original timing data (full-day), the space and other constraints

Re: [sidr] sidrSlides for RPKI Over BitTorrent presentation

2012-05-24 Thread Christopher Morrow
On Thu, May 24, 2012 at 4:13 PM, John G. Scudder j...@juniper.net wrote: Wes, On May 23, 2012, at 9:22 PM, Wes Hardaker wrote: Bittorrent works well for sharing the load, but either requires a lot of bittorrent start files (whatever they're called), which then becomes hard to syncronize; or

Re: [sidr] [INTERIM MEETING 6/6] Agenda update

2012-05-24 Thread Christopher Morrow
On Thu, May 24, 2012 at 7:05 PM, Randy Bush ra...@psg.com wrote:   * aspath not present - implications?     - scudder's notes at previous meeting       perhaps not all the bugs worked out/considerations made       (not just tools, re-figuring the aspath on entrance/exit,        are there

Re: [sidr] Keys and algorithms for Updates - feasibility analysis? (was Re: RPKI and private keys)

2012-05-14 Thread Christopher Morrow
, Christopher Morrow morrowc.li...@gmail.com wrote: On Fri, May 11, 2012 at 5:27 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: The argument that we can't do the crypto without HW i didn't see anyone say that though. ___ sidr mailing list sidr

Re: [sidr] Keys and algorithms for Updates - feasibility analysis? (was Re: RPKI and private keys)

2012-05-14 Thread Christopher Morrow
like to help? :) ^^^ - probably others as well, but he's been a voice so far, as has mr turner. -chris Ross On 14/05/2012, Christopher Morrow morrowc.li...@gmail.com wrote: On Mon, May 14, 2012 at 10:27 AM, Brian Dickson brian.peter.dick...@gmail.com wrote: We can't do the crypto without

Re: [sidr] WG Adoption: draft-ymbk-bgpsec-rtr-rekeying-00.txt

2012-05-14 Thread Christopher Morrow
oh, for reasons I can't explain we already did this, yay! (mar 26 or so) even better I think we said it concluded successfully... and it someone (me) should fix the document location/train in the tools interface. so, hopefully people didn't read too much of this version already :) -chris On

Re: [sidr] RPKI and private keys (was RE: Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)))

2012-05-11 Thread Christopher Morrow
On Fri, May 11, 2012 at 12:35 AM, Randy Bush ra...@psg.com wrote: would be interestd to hear from other ops if they believe they could get the folk managing spares to pre-key in a useful way. no way that'll happen 'reliably'. though I contend you have time between 'card fail' and 'router back

Re: [sidr] RPKI and private keys (was RE: Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)))

2012-05-11 Thread Christopher Morrow
On Fri, May 11, 2012 at 2:43 PM, Randy Bush ra...@psg.com wrote: though I contend you have time between 'card fail' and 'router back to normal' to ship a key in the ether/ssh to the device too. by the time the replacement re is sufficiently on net to create and send a public key to the noc

Re: [sidr] Keys and algorithms for Updates - feasibility analysis? (was Re: RPKI and private keys)

2012-05-11 Thread Christopher Morrow
On Fri, May 11, 2012 at 3:44 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: It has been proposed that a roadmap timeframe of 5-7 years is acceptable, in order that vendors provide hardware-based implementations. No justification for this has been offered, beyond well, it is common

Re: [sidr] Keys and algorithms for Updates - feasibility analysis? (was Re: RPKI and private keys)

2012-05-11 Thread Christopher Morrow
On Fri, May 11, 2012 at 5:27 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: The argument that we can't do the crypto without HW i didn't see anyone say that though. ___ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr

Re: [sidr] Keys and algorithms for Updates - feasibility analysis? (was Re: RPKI and private keys)

2012-05-07 Thread Christopher Morrow
I'm probably confused, or the example has been simplified.. but On Mon, May 7, 2012 at 2:58 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: Scenario 2: perform basic pseudo-signature once, repeat for routing table of 400,000 in size.   pseudo-signature operation: use N distinct

Re: [sidr] Keys and algorithms for Updates - feasibility analysis? (was Re: RPKI and private keys)

2012-05-07 Thread Christopher Morrow
On Mon, May 7, 2012 at 2:58 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: And given that current generation hardware has CPUs at least an order of magnitude slower, or possibly two orders of magnitude, suggests that software-based bgpsec can never work. for clarity, I think a

Re: [sidr] Interim Meeting (Apr 30, 2012) fallout/lessons/room-foo

2012-05-03 Thread Christopher Morrow
On Thu, May 3, 2012 at 3:34 AM, Randy Bush ra...@psg.com wrote:   1) late start/technology fail with the webex (probably webex       operations failures more than anything - my fault) http://en.wikipedia.org/wiki/Sound_check   6) microphone discipline for in-room vs external folks, often the

Re: [sidr] Invitation to Web seminar: firstinterimbeforeVancouver

2012-04-30 Thread Christopher Morrow
and hopefully we'll get the webex started, I apparently don't have the 'event host email address' :( On Mon, Apr 30, 2012 at 7:35 AM, Murphy, Sandra sandra.mur...@sparta.comwrote: The link below looks specific to the first invitee (me), so the link on the wiki page might serve for a general

Re: [sidr] Invitation to Web seminar: firstinterimbeforeVancouver

2012-04-30 Thread Christopher Morrow
...@jabber.ietf.org -chris On Mon, Apr 30, 2012 at 9:02 AM, Christopher Morrow morrowc.li...@gmail.com wrote: and hopefully we'll get the webex started, I apparently don't have the 'event host email address' :( On Mon, Apr 30, 2012 at 7:35 AM, Murphy, Sandra sandra.mur...@sparta.comwrote: The link

[sidr] Apr 30 Interim Meeting final pre-meeting-info

2012-04-29 Thread Christopher Morrow
Folks that are arriving on-site: 1) please bring a usb-headset (or whatever flavor you think works for you, remember this is supposed to be fully virtual a meeting) 2) webex details are on the WIKI [0] 3) arrival at ~-08:45am should be good, I ought to be on-site about then as well 4) we

[sidr] Notes for Monday Interim meeting

2012-04-27 Thread Christopher Morrow
Howdy sidr folk, especially those attending in person: 1) no more space is available, all people post 04/27/2012 16:13 EDT are going to have to be actually virtual (see webex details on wiki) 2) if you are on the agenda to present please send slides NOW... or very soon to NOW. 3) see you all there

[sidr] WGLC: draft-ietf-sidr-bgpsec-pki-profiles

2012-04-13 Thread Christopher Morrow
Helo WG peoples, The following update posted today. Sean and Tom have come to agreement on their differences, I believe this closes the last open items on this document. Let's start a WGLC for this, ending: 4/27/2012 or 27/4/2012 Thanks! -Chris co-chair On Fri, Apr 13, 2012 at 3:03 PM,

Re: [sidr] iBGP, BGPSEC and incremental deployment (was No BGPSEC intradomain ?)

2012-04-12 Thread Christopher Morrow
On Thu, Apr 12, 2012 at 10:52 AM, Jeffrey Haas jh...@pfrc.org wrote: On Wed, Apr 11, 2012 at 03:53:29PM -0400, Christopher Morrow wrote: Functionally, confed segments are stripped prior to the global AS being added to the path. ?The box performing this function is the one that needs

Re: [sidr] Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)

2012-04-11 Thread Christopher Morrow
On Wed, Apr 11, 2012 at 5:09 AM, Arturo Servin aser...@lacnic.net wrote:        May be is somewhere and I could not find it, but, what is the timezone? wait, not everyone is in Hawaii time? :) EDT is the TZ, I should have added that, it IS on the wiki page now. thanks! -chris Thanks! .as

Re: [sidr] [Idr] No BGPSEC intradomain ?

2012-04-11 Thread Christopher Morrow
On Wed, Apr 11, 2012 at 10:12 AM, Paul Jakma p...@jakma.org wrote: On Tue, 10 Apr 2012, Jakob Heitz wrote: I agree with Robert. Today, there are many tools that interact with BGP messages. If the AS_PATH disappears, they will all break. Indeed. If mandatory, well-known attributes are

Re: [sidr] Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)

2012-04-11 Thread Christopher Morrow
On Tue, Apr 10, 2012 at 9:15 PM, Danny McPherson da...@tcb.net wrote: On Apr 10, 2012, at 8:56 PM, Christopher Morrow wrote: yes, my goal was to have updated the wiki today at the office, work intruded... tomorrow I'll do that with some more content for each item, and hopefully better

Re: [sidr] Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)

2012-04-11 Thread Christopher Morrow
On Wed, Apr 11, 2012 at 1:45 PM, Danny McPherson da...@tcb.net wrote: On Apr 11, 2012, at 1:35 PM, Christopher Morrow wrote: From there, we can discuss the issue of, for example, HOW TO onboard and purge signing and validating certificates to routers from the RPKI -- [I suspect

Re: [sidr] Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)

2012-04-11 Thread Christopher Morrow
(-home-email ... never should have started that:( ) On Wed, Apr 11, 2012 at 2:08 PM, Chris Morrow morr...@ops-netman.net wrote: On 04/11/2012 01:57 PM, Danny McPherson wrote: I suppose, to me this looks like any other configuration thing you do today on routers... beating the vendor over

Re: [sidr] Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)

2012-04-11 Thread Christopher Morrow
(if the ads want off this train, speak up) On Wed, Apr 11, 2012 at 2:23 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: My understanding is, that at least for the origination aspect, the freshness argument is that the keys get rolled periodically. they can get rolled periodically, sure.

Re: [sidr] iBGP, BGPSEC and incremental deployment (was No BGPSEC intradomain ?)

2012-04-11 Thread Christopher Morrow
On Wed, Apr 11, 2012 at 3:48 PM, Jeffrey Haas jh...@pfrc.org wrote: On Wed, Apr 11, 2012 at 12:28:32PM -0400, Christopher Morrow wrote: On Wed, Apr 11, 2012 at 12:17 PM, Jakob Heitz jakob.he...@ericsson.com wrote: Confeds are out of scope. how are confeds out of scope? if you want path

Re: [sidr] Interim Meeting Notes / Participation modes / wiki updated

2012-04-11 Thread Christopher Morrow
On Wed, Apr 11, 2012 at 5:25 PM, Arturo Servin aser...@lacnic.net wrote: Chris,        For the agenda item: Deployment Discussion - Discuss the need, and publication location/method, for documentation that details rollout of SIDR technologies in an operational network. Are we going to

Re: [sidr] [Idr] No BGPSEC intradomain ?

2012-04-10 Thread Christopher Morrow
On Tue, Apr 10, 2012 at 12:34 PM, Robert Raszuk rob...@raszuk.net wrote: Anyhow my doubt has been answered and I stay by my opinion that not sending AS_PATH and AS4_PATH is a terrible idea. So... we can send the data along, but in the case of BGPSEC speakers the data isn't used (it's replicated

Re: [sidr] [Idr] No BGPSEC intradomain ?

2012-04-10 Thread Christopher Morrow
On Tue, Apr 10, 2012 at 1:00 PM, Robert Raszuk rob...@raszuk.net wrote: So... we can send the data along, but in the case of BGPSEC speakers the data isn't used (it's replicated in the BGPSEC_SIGNED_PATH). So far I have always heard that BGPSEC is just providing the hint to the operator and

Re: [sidr] [Idr] No BGPSEC intradomain ?

2012-04-10 Thread Christopher Morrow
On Tue, Apr 10, 2012 at 1:49 PM, Robert Raszuk rob...@raszuk.net wrote: In my view we should do all BGP processing based on legacy attributes and BGPSEC should be a hint to the local operator on how to treat the update. i think that's the point of the current spec though... inbound updates (on

Re: [sidr] [Idr] No BGPSEC intradomain ?

2012-04-10 Thread Christopher Morrow
On Tue, Apr 10, 2012 at 1:57 PM, Robert Raszuk rob...@raszuk.net wrote: All BGP monitoring tools need to be upgraded to now understand BGPSEC attribute too. And surprise .. here BMP will not convert it like it will to legacy speakers. sure, they'd have to do that anyway, or they just are

Re: [sidr] [Idr] No BGPSEC intradomain ?

2012-04-10 Thread Christopher Morrow
On Tue, Apr 10, 2012 at 2:22 PM, Jakob Heitz jakob.he...@ericsson.com wrote: On Tuesday, April 10, 2012 9:53 AM, Christopher Morrow wrote: On Tue, Apr 10, 2012 at 12:34 PM, Robert Raszuk rob...@raszuk.net wrote: Anyhow my doubt has been answered and I stay by my opinion that not sending

Re: [sidr] Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)

2012-04-10 Thread Christopher Morrow
On Tue, Apr 10, 2012 at 8:48 PM, Danny McPherson da...@tcb.net wrote: Chris, Can you expand on these, I'm not sure I know what to read or propose in order to prepare.. yes, my goal was to have updated the wiki today at the office, work intruded... tomorrow I'll do that with some more content

Re: [sidr] [Idr] No BGPSEC intradomain ?

2012-04-09 Thread Christopher Morrow
On Mon, Apr 9, 2012 at 2:50 PM, Robert Raszuk rob...@raszuk.net wrote: Hi, And intradomain BGP speakers do not use bgpsec (ebgp sessions only). I do not understand. How a BGP Update will transit via an AS where each router is a real BGP speaker and where as some proposed BGP mandatory

Re: [sidr] Slides for RPKI Over BitTorrent presentation

2012-03-29 Thread Christopher Morrow
On Wed, Mar 28, 2012 at 8:33 PM, Danny McPherson da...@tcb.net wrote: i don't think the rsync scale issues surprise anyone that was paying attention.  If we're already considering new architectures, substrates, et al., here perhaps we shouldn't be so quick on the trigger for Standards Track

Re: [sidr] Injecting idea of freshness of repository data into BGP

2012-03-29 Thread Christopher Morrow
On Thu, Mar 29, 2012 at 4:16 AM, Jeffrey Haas jh...@pfrc.org wrote: Jakob, On Thu, Mar 29, 2012 at 03:51:10AM -0400, Jakob Heitz wrote: Could we not put a freshness indication into the BGP update? Then everyone that receives the new update would know to invalidate the less fresh paths.

Re: [sidr] SIDR Interim meeting 4/30/2012 (April 30, 2012) - IAD

2012-03-29 Thread Christopher Morrow
-secretary We needed to send the announcement for the first date, in order to hit it, depending on attendence numbers we would be either in Reston for ~20 people or Arlington for 'more' (30). If the number of remote possibles is higher than in-person we should take the opportunity to run a fully

Re: [sidr] I-D Action: draft-ietf-sidr-usecases-03.txt

2012-03-29 Thread Christopher Morrow
Alright, I'll tackle that tomorrow morning. -chris (cochair) On Fri, Dec 9, 2011 at 9:03 AM, Sriram, Kotikalapudi kotikalapudi.sri...@nist.gov wrote: Sandy, Chris, The WGLC on this doc ended 09/22/2011. We (the authors) submitted a substantially revised version on October 31, 2011,

Re: [sidr] I-D Action: draft-ietf-sidr-usecases-03.txt

2012-03-29 Thread Christopher Morrow
On Thu, Mar 29, 2012 at 3:11 PM, Brian Dickson brian.peter.dick...@gmail.com wrote: I think the use cases are likely to be informed by protocol design, so even s/informed by protocol design/altered if the protocol design changes/ I'm not sure if the protocol design's going to change the

[sidr] webex for today's meeting (INPROGRESS NOW)

2012-03-28 Thread Christopher Morrow
details for the webex: Topic: IETF83 SIDR wg meeting Date and Time: Wednesday, March 28, 2012 9:00 am,Europe Summer Time (Paris, GMT+02:00) Event number: 646 631 463 Event password: wgmeeting Event address for attendees: https://ietf.webex.com/ietf/onstage/g.php?d=646631463t=a

Re: [sidr] Interim Meeting Dates/Locations (Proposed)

2012-03-28 Thread Christopher Morrow
On Tue, Mar 27, 2012 at 6:20 PM, Matt Lepinski mlepin...@bbn.com wrote: Terry, On 3/27/2012 4:22 PM, Terry Manderson wrote: I feel like the Monday meeting was a bit of a lost opportunity. I appreciate see previous gzip compression message :( I think we tried to stuff 8hrs of content into

Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-algs-01.txt

2012-03-28 Thread Christopher Morrow
Sean, This document seems settled, should we WGLC this in the near future? -chris cochair On Mon, Dec 5, 2011 at 1:21 PM, internet-dra...@ietf.org wrote: A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain

[sidr] activity!! ACHTUNG!

2012-03-28 Thread Christopher Morrow
howdy WG folk: yes, some emails are coming out (now), perhaps I'll double-count/mis-count on a document, please speak up if you think that is the case :) The purpose here is to get status updated on docs and move things along if they are in the right place for said movement. thanks! -chris

Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-overview-01.txt

2012-03-28 Thread Christopher Morrow
Matt/Sean, This document hasn't changed in a while, Wes (copied) had some comments which I believe were addressed in the October/2011 update? Is this document ready to move forward? Wes, did you review the changes sent? -Chris cochair On Mon, Oct 31, 2011 at 2:02 PM, internet-dra...@ietf.org

Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-01.txt

2012-03-28 Thread Christopher Morrow
Sean/Tom, Tom had some comments on the previous (I believe) version of this draft, are they addressed to your satisfaction Tom? Sean, if Tom's ok with the changes, should we move this along? -Chris cochair On Mon, Dec 5, 2011 at 1:20 PM, internet-dra...@ietf.org wrote: A New Internet-Draft

Re: [sidr] I-D Action: draft-ietf-sidr-ltamgmt-04.txt

2012-03-28 Thread Christopher Morrow
Hello authors, What is your intent with this document? moving along the process? delaying on other references? holiday-for-document in sweden? Inquiring minds would like to be informed! :) Thanks! -Chris cochair On Sun, Dec 4, 2011 at 3:32 PM, internet-dra...@ietf.org wrote: A New

Re: [sidr] WGLC: draft-ietf-sidr-origin-ops

2012-03-28 Thread Christopher Morrow
Reviving a zombie thread... So, Where does this set of comments end us? Are the updates put in between 11/11 and 03/12 taking care of the discussion? or are there still things to wrangle? I think, given the length and breadth of discussion here we'd all do to re-read and re-WGLC this doc once

Re: [sidr] draft-ietf-sidr-bgpsec-ops - Ready for WGLC?

2012-03-28 Thread Christopher Morrow
On Wed, Mar 28, 2012 at 9:29 AM, Randy Bush ra...@psg.com wrote: Is this document prepared/ready/willing for WGLC in the near future? imiho, no I believe there were some outstanding document comments still to be handled by your edit-buffer? it is matt's edit buffer which gives me pause

Re: [sidr] sidr drafts link broken

2012-03-28 Thread Christopher Morrow
On Sat, Mar 24, 2012 at 4:34 PM, Jakob Heitz jakob.he...@ericsson.com wrote: https://datatracker.ietf.org/meeting/83/agenda/sidr-drafts.pdf link on agenda page is broken maybe someone reported this to the HD already, but ... working now! :) (or worked for me at least) -chris

Re: [sidr] [Idr] AS_SET depreciation (RFC6472) and BGP multipath

2012-03-28 Thread Christopher Morrow
On Wed, Mar 28, 2012 at 12:01 PM, Paul Jakma p...@jakma.org wrote: On Wed, 28 Mar 2012, Jakob Heitz wrote: The issue is SIDR can not aggregate multiple paths. Should SIDR work on path aggregation? If we ever want to make routing state scale sub-linearly (i.e. make IDR compact) in the

Re: [sidr] [Idr] AS_SET depreciation (RFC6472) and BGP multipath

2012-03-28 Thread Christopher Morrow
On Wed, Mar 28, 2012 at 12:29 PM, Robert Raszuk rob...@raszuk.net wrote: Are we going to freeze any AS_PATH modifications by operator's policy too ? I mentioned replace-as which all major vendors support. There can be more knobs like this coming in the future. replace as i think is dealt with

<    1   2   3   4   >