An Out-of-Band Setup Protocol for Resource Public Key Infrastructure (RPKI) Production Services
draft-ietf-sidr-rpki-oob-setup-09

[Ballot comment]
Thanks for addressing my DISCUSS points, keeping COMMENTs below for posterity.

5.2.4: Per my comment on  draft-ietf-sidr-publication, it would be good if service_uri accommodated either HTTPS or HTTP URLs, if HTTP URLs must be supported.

5.4: If it becomes obvious that a new reason code needs to be added to the  element in the future, will that require a new version of the protocol? That seems like a bit of a heavy lift as compared to, say, creating a registry for these with an appropriate registration policy.

[Ballot comment]
The title is misleading with "setup protocol".

From RFC 2026:
3.1  Technical Specification (TS)
  A Technical Specification is any description of a protocol, service,
  procedure, convention, or format

We deal with a "format" here or maybe messages definition.
Thankfully, the abstract is rather clear that is the protocol is unspecified. So it's not THAT bad.

[Ballot comment]

- abstract: would it be better to replace "agreeable secure
means" here with "agreeable means that provides acceptable
data integrity and authentication" ? Just a suggestion.

- all examples: the xmlns attribute value gets me a 404.  (I
mean for "http://www.hactrn.net/uris/rpki/rpki-setup/") While
that's ok since we don't want folks to de-reference that at
run-time, it might be better if it returned the schema or
something useful. And would https be even better there?  (Not
sure, been a while since I've xml'd;-)

- examples would be better with Figure numbers and brief
captions.

- 5.2.1: Do we really want references to mathematical deities
in examples? Real keys would be better, but that said, I do
like the whimsical content of those I decoded;-)

- As it happens I disagree with Alissa's discuss.  This seems
clear enough to me, same as any sneakernet protocol.

[Ballot discuss]
(1) I agree with Mirja that this document seems to be missing the actual protocol specification, unless Section 6 is meant to provide the normative specification of how the messages are to be exchanged. Is it? If so, I would expect that to be explicit in the document.

(2) If there is in fact supposed to be a protocol specified here, I have the same question as I had on draft-ietf-sidr-publication, which is how do the entities migrate from one version to another and do version negotiation?

[Ballot comment]
5.2.4: Per my comment on  draft-ietf-sidr-publication, it would be good if service_uri accommodated either HTTPS or HTTP URLs, if HTTP URLs must be supported.

5.4: If it becomes obvious that a new reason code needs to be added to the  element in the future, will that require a new version of the protocol? That seems like a bit of a heavy lift as compared to, say, creating a registry for these with an appropriate registration policy.

[Ballot comment]
High level comment:
I'm not sure if 'protocol' is the right term for this spec. For me this doc rather defines a set of messages, however given it does  not specify any action that must follow as a reaction to a message (as well as no choice of the publication nor BPKI protocol), I find the term 'protocol' here rather confusing.

Smaller comments:
- Some more abbreviations could be spelled out, e.g. CMS
- section 2 is not needed
- sec 5: "Appendix A is a [RelaxNG] schema for this protocol.  The schema is
  normative: in the event of a disagreement between the schema and the
  following textual description, the schema is authoritative."
  I guess in this case the schema should not be in the appendix. And would it be possible to make sure the schema does not disagree with the text...?

[Ballot comment]
High level comment:
I'm not sure if 'protocol' is the right term for this spec. For me this doc rather defines a set of messages, however given it does  not specify any action that must follow as a reaction to a message (as well as no choice of the publication nor BPKI protocol), I find the term 'protocol' here rather confusing.

Smaller comments:
- Some more abbreviations could be spelled out, e.g. CMS
- sec 5: "Appendix A is a [RelaxNG] schema for this protocol.  The schema is
  normative: in the event of a disagreement between the schema and the
  following textual description, the schema is authoritative."
  I guess in this case the schema should not be in the appendix. And would it be possible to make sure the schema does not disagree with the text...?

[Ballot comment]
I have a small list of minor issues that should be addressed before this document is approved:

Base64 needs a normative reference (including the section number, as there are 2 variants).

HTTP URI need a normative reference.

Are HTTPS URIs allowed where HTTP URIs are mentioned in the document?

In 5.3: id-ct-xml needs a reference.

(Via drafts-lastcall-comment@iana.org): IESG/Authors/WG Chairs:

The IANA Services Operator has reviewed draft-ietf-sidr-rpki-oob-setup-04.txt, which is currently in Last Call, and has the following comments:

We understand that this document doesn't require any registry actions.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, we do not object.

If this assessment is not accurate, please respond as soon as possible.

Thank you,

Sabrina Tanamal
IANA Services Specialist
PTI

The following Last Call announcement was sent out:

From: The IESG
To: "IETF-Announce"
CC: morrowc@ops-netman.net, sidr-chairs@ietf.org, "Chris Morrow" , sidr@ietf.org, aretana@cisco.com, draft-ietf-sidr-rpki-oob-setup@ietf.org
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (An Out-Of-Band Setup Protocol For RPKI Production Services) to Proposed Standard


The IESG has received a request from the Secure Inter-Domain Routing WG
(sidr) to consider the following document:
- 'An Out-Of-Band Setup Protocol For RPKI Production Services'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2017-01-10. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  This note describes a simple out-of-band protocol to ease setup of
  the RPKI provisioning and publication protocols between two parties.
  The protocol is encoded in a small number of XML messages, which can
  be passed back and forth by any mutually agreeable secure means.

  This setup protocol is not part of the provisioning or publication
  protocol, rather, it is intended to simplify configuration of these
  protocols by setting up relationships and exchanging BPKI keying
  material.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-oob-setup/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-oob-setup/ballot/


No IPR declarations have been submitted directly on this I-D.

=== AD Review of draft-ietf-sidr-rpki-oob-setup-04 ===

I have some comments (below) that should be easy to address.  I think the major one is about the ordering of the XML attributes (C2); I’ll start the IETF Last Call once (at least) that point is resolved.

Thanks!

Alvaro.


C1. Why isn’t an IETF namespace [RFC3688] used in the XML schema?  I would strongly suggest that you use one and request it in the IANA Considerations Section.  Unlike the publication protocol, this document specifies version 1 – which of course doesn’t mean there isn’t a longer history behind it, so I’m open to keeping a non-IETF namespace if that is the case.

C2. Section 4.1. (Common Protocol Elements) says that “The first XML attribute in each message is a version field.”, and Appendix A. (RelaxNG Schema) reflects that.  However, the examples (throughout the document) don’t reflect the same ordering.

C2.1. It would be very nice if the description of the fields was in the same order as what the schema defines.  For example, the schema says that for a child_request the order is: version, child_handle, tag and child_bpki_ta, but the text in 4.2.1. () reverses the tag and child_handle.

C3. In 4.2.2. (), are the offer and referral elements mutually exclusive?  What happens if the client receives a parent_response with both?  If it is an error, is it considered a syntax-error or something else?  Section 5. (Protocol Walk-Through) offers a hint (“Bob doesn't have to accept Alice's offer, but may choose to do so.”), but the specification is still not clear.

C4. The Shepherd’s write-up doesn’t mention any XML checks done, but I suspect this step has in fact happened.  Please provide details so the Shepherd can complete the writeup.

C5. The example in Section 4.4. () doesn’t include the complete child_request message which presumably caused the error.

C6. I think the following references can be made Informative: RFC5280, RFC5652.

As required by RFC 4858, this is the current template for the Document
Shepherd Write-Up.

Changes are expected over time. This version is dated 24 February 2012.

(1) What type of RFC is being requested (BCP, Proposed Standard,
Internet Standard, Informational, Experimental, or Historic)?  Why
is this the proper type of RFC?  Is this type of RFC indicated in the
title page header?

Proposed Standard


(2) The IESG approval announcement includes a Document Announcement
Write-Up. Please provide such a Document Announcement Write-Up. Recent
examples can be found in the "Action" announcements for approved
documents. The approval announcement contains the following sections:

Technical Summary
This note describes a simple out-of-band protocol to ease setup of
  the RPKI provisioning and publication protocols between two parties.
  The protocol is encoded in a small number of XML messages, which can
  be passed back and forth by any mutually agreeable secure means.

  This setup protocol is not part of the provisioning or publication
  protocol, rather, it is intended to simplify configuration of these
  protocols by setting up relationships and exchanging BPKI keying
  material.


Working Group Summary
Working group discussion was as interested and full of consensus as ever in SIDR.
no large disagreements or sticking points, and no one protesting.

Document Quality

  Are there existing implementations of the protocol? Have a
  significant number of vendors indicated their plan to
  implement the specification? Are there any reviewers that
  merit special mention as having done a thorough review,
  e.g., one that resulted in important changes or a
  conclusion that the document had no substantive issues? If
  there was a MIB Doctor, Media Type or other expert review,
  what was its course (briefly)? In the case of a Media Type
  review, on what date was the request posted?

There is a working implementation for this, there are no mib/etc items which need expert review.


Personnel

  Who is the Document Shepherd? Who is the Responsible Area
  Director?

Shepherd: morrowc@ops-netman.net (me: Chris Morrow)
AD: aretana@cisco.com (Alvaro Retana)

(3) Briefly describe the review of this document that was performed by
the Document Shepherd.  If this version of the document is not ready
for publication, please explain why the document is being forwarded to
the IESG.

I've read through the document as it progressed, seems ready for publication.

(4) Does the document Shepherd have any concerns about the depth or
breadth of the reviews that have been performed?

no concerns

(5) Do portions of the document need review from a particular or from
broader perspective, e.g., security, operational complexity, AAA, DNS,
DHCP, XML, or internationalization? If so, describe the review that
took place.

I don't believe there are parts of the document which require such review.

(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.


no concerns

(7) Has each author confirmed that any and all appropriate IPR
disclosures required for full conformance with the provisions of BCP 78
and BCP 79 have already been filed. If not, explain why.

yes, no IPR concerns

(8) Has an IPR disclosure been filed that references this document?
If so, summarize any WG discussion and conclusion regarding the IPR
disclosures.

No IPR disclosures are warranted.

(9) How solid is the WG consensus behind this document? Does it
represent the strong concurrence of a few individuals, with others
being silent, or does the WG as a whole understand and agree with it? 


solidly SIDR-riffic.

(10) Has anyone threatened an appeal or otherwise indicated extreme
discontent? If so, please summarise the areas of conflict in separate
email messages to the Responsible Area Director. (It should be in a
separate email because this questionnaire is publicly available.)

no threats, not even any raised eyebrows or winked eyes.

(11) Identify any ID nits the Document Shepherd has found in this
document. (See https://www.ietf.org/tools/idnits/ and the Internet-Drafts
Checklist). Boilerplate checks are not enough; this check needs to be
thorough.

There are no significant nits, some reference updates will come when we get to the end of the process.

(12) Describe how the document meets any required formal review
criteria, such as the MIB Doctor, media type, and URI type reviews.

no reviews necessary

(13) Have all references within this document been identified as
either normative or informative?

yes

(14) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state? If such normative
references exist, what is the plan for their completion?

yes, sidr-delta-protocol && sidr-publication
both of these should be showing up on the church door shortly.

(15) Are there downward normative references references (see RFC 3967)?
If so, list these downward references to support the Area Director in
the Last Call procedure.

no.

(16) Will publication of this document change the status of any
existing RFCs? Are those RFCs listed on the title page header, listed
in the abstract, and discussed in the introduction? If the RFCs are not
listed in the Abstract and Introduction, explain why, and point to the
part of the document where the relationship of this document to the
other RFCs is discussed. If this information is not in the document,
explain why the WG considers it unnecessary.

no

(17) Describe the Document Shepherd's review of the IANA considerations
section, especially with regard to its consistency with the body of the
document. Confirm that all protocol extensions that the document makes
are associated with the appropriate reservations in IANA registries.
Confirm that any referenced IANA registries have been clearly
identified. Confirm that newly created IANA registries include a
detailed specification of the initial contents for the registry, that
allocations procedures for future registrations are defined, and a
reasonable name for the new registry has been suggested (see RFC 5226).

no requests being made of IANA

(18) List any new IANA registries that require Expert Review for future
allocations. Provide any public guidance that the IESG would find
useful in selecting the IANA Experts for these new registries.

none

(19) Describe reviews and automated checks performed by the Document
Shepherd to validate sections of the document written in a formal
language, such as XML code, BNF rules, MIB definitions, etc.


none.