Internet Engineering Task Force 105, 23 Jul 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF105-SIDROPS-20190723-1520

Description

SIDROPS meeting session at IETF105
2019/07/23 1520

https://datatracker.ietf.org/meeting/105/proceedings/

A

B

A

B

C

Take in their current.

D

Laser frequency.

B

Much and most of these huge.

A

E

You a minute taker.

E

No fear helps friend of ours. First, an idea. It.

F

Immediately becomes.

E

Part of the machine yeah.

A

E

Half of your cooking.

E

Some of your money.

G

Good afternoon welcome to the cider ops meeting at IETF 105 we're in Montreal, it's not even cold. Okay. Is it okay? That's right! It's cold inside not outside okay, I'm Chris! That's care! That's Joe! Over there helping out yeoman's work. We have a.

G

We have a note-taker. We also have the watch more collet note. Well, note-taker. We I think we need a jabber scribe still does somebody want to jabber and I don't meet at the mic? Gary I thought you not it. No.

G

Aha, okay, Warren, we'll Jever all right! So before we go through the a Obi and I know, somebody's gonna stand up and get off my business for those people that speak at the mic. Please.

G

Thank you very much good example. The thingy has a pointy pointy on it. You can point like this there's a thing in front of you, so you don't have to do this because also this is rude. All right, Oh is there any other business that you would like to discuss that we can add to the agenda.

H

May I add one item, certainly depending on the item. The item is about diversity, diversity, diversity, diver, I'm, sorry about my.

I

Boom Tish, what's.

G

The only other half the internet we care about. Yes, why don't we do that as soon as mr. Bush is done with his time? Fantastic. Thank you. Thank you very much. Okay. We have these four other presenters and mr. mandersohn will be a little squeezed on time. I think so everybody should keep it short draft status as it says the documentation. All these slides by the way are in the meeting material. So you can go down to that and could go to town.

G

A couple of things were moved from the IHC processing to editors queue, that's the towel and the router King draft, and we added some ASPA stuff and the valve editing, BGP speaker that we're still working on all right, yeah sigh, it's awesome! Okay! So go back Alexander!

G

Oh, you should also feel free to either hold the mic or use the little thingy stand.

J

Not smile, slides, oh this is my slits okay, my name is a reason. Does enough work for Yandex and today I'm going to provide you a very short update on his PA trots, so just to quickly remind remind you what our ASP, so this day is also a system provider authorization so but it's P is much shorter, so it's a new application object-- then it can be used to detect leaks and hijacks, malicious and mistakes.

J

It is it works outside of BGP itself, so it doesn't change the protocol and of course it can be optimized with bgp roles, but it's out of scope. So.

J

J

Here is the change log. First of all, good news. The drafts were adopted by these working group and I hope that it will boost the process of working on this document, and it seems this. I was right so since recent discussion, in the main at least, was quite fruitful, and previously we were stated that SBA can be used to verify ice paths that are received from customers and peers. So now we have extended the way SP can be used, and so you can now also verify paths that are received from customers.

J

We are not speaking here about forged ice part, but we are speaking about mistake, mistake, root leaks and it is quite useful feature, since all other drafts that are targeted around leak detection are not capable to detect leaks on an customer side which also made a universe rule for what we should do with.

K

Anomalies, so it must be all.

J

Anomalies, hijacks root leaks must be rejected, I will go in the intro details further later sorry, and so let's get some details.

J

So there is a some text there, I, which I will go over with youth, and so it will not look such complicated. So if s speaking about the prefixes that I received from customer or by customer from provider or exam from Ike's, it may have to subpaths the down the upstream part when prefix is traveling from customer to provide and so on so on and downstream path, when prefix is traveling down from provider to customer and so on, the connection can be a single autonomous system number.

J

It can be appearing link, it can be a transparent eyes, but anyway, the first downstream link will will have invalid outcome according to ASP a verification procedure. So in this exact example, example, r3 is leaking as one is taking. Transit from ice to s3, taking transit from both eyes to and I is for ice five straight, a contrasting from ice form, so I hope it will be clear.

J

So, according to his be verification procedure, the outcome from verification of ice 2 and R 3 is invalid. As soon as we are going through. First downstream link, all concern downstream leaks. The links that we can find after that in the path will must be also provided to customers. Otherwise, it's a leak so to verify this, but we found that is to in ice.

J

3 is invalid, and after this we check is for in the ice 3 it's very important to check as find ice 3 instead of ice 3 and is for because otherwise we are eaten in problems with siblings, and so, if we have these two in reddit the result is that the in the downstream sub path there is some supper.

J

There is a sequence which goes up so it surrounded so I understand it may sound a bit difficult, but in reality it's a very easy to code and I have already already dropped a piece of code in the main, at least you can take a look at it, so maybe in words it's harder to understand, then in the piece of code. So the second thing is universe policy for anomalies.

J

Previously we try to treat different layer, hijacks and root leaks. We had good intent. We believed that it's in some cases, root leaks, may pass by, because maybe it's a good thing, maybe it's the only path to the originator, but since we're talking not only about mistakes, we're also talking about forged a cubes of the malicious activity.

J

The receiver cannot distinguish if it was, it is receiving a prefix that was leaked by a mistake or if it's a receiving F forged eyes party, which is a hijack but I spats. Most of us modified to look like a leak. So with this in mind, we we cannot distinguish leaks and ice and hijacks from the receiver side, and the only policy that can be applicable here is draw all anomalies that can be detected with ASP.

J

So what do we learn? Next we're planning to make some proof of concept in the lab. We haven't yet decided how to do it. We are still in discussion at this moment point we need to bomb the version of our TR protocol.

J

Unfortunately, it's not extendable to it, be Jews without increasing the version number, and it seems this if we don't find any great security flaws in the design, we need nearly ready for working group Moscow. Any questions.

J

I see rue Daguerre, it is nearly going to ask a question job.

E

Snyder's entity, why did you put the deprecated asset configuration set reference on this slide? It's.

J

A good question: it's a my question to you to the working group so because it's for a proper ice path of diversification, we cannot verify hiset segments because they are unordered and if we want to get rid of malicious activity that may happen in BGP, we need to get rid of Isis and that's why it's here and that's. Why I'm like to another to learn, what's happening with this draft and if there is anybody willing to push it forward to finally get reach of the highest sets?

J

Because, from the security perspective, we are relying on this piece of the document.

J

And I know that the authors of these dolphins are here.

B

I mean that's been sitting around for a long time. That document and mainly Shri Rama, had been bumping. The version number every now and then what we decided at some point was, and Randy and I had started working on this and then I got sidetracked again, but we'd started another document which deprecates ASX and atomic aggregate from BGP v4. We hadn't hadn't actually got as far as publishing a version of that, but that seemed like would be a much better thing to actually do. It turns out doing that requires all sorts of updates to BGP.

B

Like lots of remove this text, add this text marry this text. Add this text and then yeah I got a little sidetracked. I mean if it's really a useful, we could look at it again and Randy might have more to say, but.

J

From a state perspective, if it will have something that will already a little state that ice I said are deprecated we'll be able to say that if we see an I said, for example, apply the same policies for the hijacks it leaks and just drop it I.

B

Believe the current version is basically like ready if somebody wanted to adopt it and do something with it. But honestly, I haven't touched it and, like you know a year or something two years.

J

Yeah I see fear on either life through.

L

Damp mist I just want to add that there's a version of it, which is already a BCP, and then we wanted to convert it to a standards track. So hopefully the BCP is helpful somewhat in the meantime, but we can work on it to see if we can push it through instant extract as well. Wait.

J

I will be glad to see if these piece of work will be finally adopted and to end up with our sisters. If.

M

Nothing else happens as far as I can tell. The interesting construct only occurs at the very end of a path you're speaking about this thing. No, no, no, no, no, no! The is set, and the way it usually is constructed is not relevant here at all, and if nothing else happens, one would need to check that. Yes, it only can happen at the end, and then you could essentially just use the regular path, for whatever is happening here.

M

Assume assume that the first regular AAS that shows up in the path and the set is hidden behind it to be the origin, and you are fine, because all all the tricky stuff that is happening inside the AAS set doesn't well. Okay does absolutely not fit into this model anyway, and it doesn't matter yes.

J

I do agree with you, but there's.

M

J

Sure that the certification doesn't say anything about if we can, if I said in the middle of this ice, bath is well, it are invented so to walk or to fight forged ice path. We should avoid at least I set in the middle of middle I. Do agree.

M

Ok and I've, as far as I have observed them. They never were somewhere in the middle and there is a good reason for that: yeah! Yes, well: okay, yeah, all okay! Unfortunately I don't have I'd. Well, okay! Yes, let me let me put it into a question.

M

What it's improve the understanding of the old thing if we did a part in the documents that essentially.

M

Reveals the concept of what is signed in the in VA in VA SBA's.

M

The complex asn.1 use typically typically confuses people who don't need to work with it, and I think I think that the conceptual data structure that is transmitted there and what what it's supposed semantics are, could be exposed much better and I somewhat assume actually the structure will, after the will, the the encoding might actually change to adapt it closer to a concept. That's being that's being used, are you speaking about? Is zero, no yeah? Well, okay, what what is the concept that is being used?

M

You are coding a sets of a SS, and you are doing some strange trick in case. You want to code an empty set and kind of why? Why not? Why not actually explain this and then code, like it I.

J

Remember that we had this question discussed, we discussed privately. So my idea when I was writing. Its introducing ic0 was I, was taking a look, it's raw document and just taking its design to look similar, so obvious row 0 and we have a space here. Oh I'm, not saying the edge is yeah.

M

J

M

But the qualifier.

J

The final solution, but anyway it's it's very simple and from perspective of the coding tools, it doesn't really matter, you know. Do you have sets or do you have separate records from the implementation side? It's nearly the same kind of going to configure it by yourself all.

M

All metals all met all small matters of coding agreed for.

M

Making people understand what they are supposed to do and why things work well kind of coding. Complications can be an obstacle, and yes, I also I also have another now unhidden agenda. If we actually are coding sets of a SS. That means that, during the time the standard is de is being developed and codes. An implementation and deployment follows over a couple of months.

M

Actually, the concept could be used by people who agree on how to code in other ways that are already available. The sets of a SS to actually to actually use the the technique kind of essentially immediately yeah.

J

But anyway, generating, for example, using ice pass filtering using wildcards. You will anyway end up with some generator of your configuration I'm, pretty sure that you will not use.

J

Click, it you can click on generate, and so it doesn't should not really matter if you are working with a set Vaughn a set of tuples the.

M

The issue here is much less the coding which may be slightly easier or while, okay, it doesn't matter and I completely agree that, yes completely hand coding stuff is out of the question, but making making the concept that is used transparent to users actually actually is valuable, because ok, of course, with a little bit of coding, the user interface can also present concepts that are kind of hidden in what's happening underneath. But that does not. That does not really help.

J

M

Kind of kind of kind of for details- offline discussion quite obviously make sense. So.

J

Thank you really good for our comments. A.

N

Really quick question: sorry about him. If you take es conflicts out.

N

Do you want to propose what should be done if an es conferred is encounter.

O

N

Is it simply ignore it and go to the next AAS in this a sequence if.

J

We're speaking about protection against malicious activity, approached I said in the middle of the path, just nibble eighths all kinds of protection, because it will end up that you are able to create a forged ice bath in certain situations. So at the moment the draft suggests to treat pass with ice set like it sweets, hijacks and leagues. All.

N

O

You um yeah a question or clarification because on a check that my understanding is correct, laughs.

O

So, in my understanding the semantics here are similar to what you have an origin validation in the sense that you would argue to drop in ballots. So if there's anything verifiably invalid, but when things are unknown, that's! Okay! Yes, right! Okay, because the text in the document seemed to say something about treating unverifiable things with some suspicion and I'm, not sure that that's right.

J

There is difference between unverifiable and unknown, and verifiable is exactly introduced for Isis. Well, unknown is for ice baths, so the ice bath even returns. I think well, it's in case of so there is a purification. There is three outcomes valid invalid unknown for ice bath, verification procedure. It should be valid invalid and algorithm, so the unknown will be wedded right. Okay, that clarifies thank you so I think if I come to, I will check that it is clearly stated and.

O

Maybe somewhat related that we can also talk about that offline, but there is an es who makes a statement here, a signed statement and I asked earlier like. Maybe we should think about how to to make that object, because.

O

What I'm look for what I'm thinking of as a missus a year? If there's an SMAS I make a statement? Maybe I run one object signed by a yes that has everything in it to ensure that I see the complete policy, that's applicable here and not risk that there are issues with a bunch of objects where some of them are being published and withdrawn, and so that may be something to think about, because.

J

It would row us that's.

O

Different because there, if you put multiple prefixes on a single row and one of the prefixes goes away, then the object becomes invalid. But if this is signed by only one a s, then you don't have that problem. So you may want to think about that. I'm.

J

Not sure that a properly gets your question, let's discuss it's.

O

Out of line yes, what I'm buying is that, maybe if one a s makes a statement or a bunch of statements, they can put them all in one object.

J

But it can be single areas, may create objects only for either originating out on system number. So you are creating objects for your providers. You can make it create more objects, but anyway, your great your objects only for your providers.

O

So what I'm implying is that as AAS who is signing I could put all those statements on a single object. So there's no risk that when I publish things you miss things because you know it's still being processed and it's partially published itself. So it's not a big deal, but you know maybe something to think about. Okay,.

P

Okay, thank you. Geoff Huston look I'm, not sure that actually need a single object. The underlying constraint is, if you sign one of your adjacencies, you need to sign all of your adjacencies okay.

P

How can I be adjacent to an AS set and what might it look like- and this is this sort of weird thing where you're cutting out I- need a guess.

P

It's deprecated, but I actually don't even understand how, if I'm signing all my adjacencies, how I can sign myself as adjacent and is set within your construct and maybe that just simply finesses out the entire issue of ASAS, because I can't be adjacent to one unless a whole bunch of other work is done to define what I'm adjacent to so, if I sign all my adjacencies and you see a park with me adjacent to one of these, a assets I think that's a dud. You know straight away. Thanks.

J

I'd like to stay just one saw one more time. No problem with I sit in the in the bath is the PISA. This it is unordered, it's not it's, not the number, so it.

P

Doesn't matter.

J

P

Just doesn't matter I'm like you're, inside an environment where, when maybe you get a path until you reach some gold and healthy and day, that's never going to happen that everyone signs stuff, you're gonna, have to do partials, yeah and if you're doing partials no one's going to be incorporating. If I'm, if I do my signing, I'm never adjacent to a set, the problem just goes away. That's what I'm suggesting Chris you can have the time I'm.

J

Not sure that I fully get your idea, I will try to reach your later. Thank you.

Q

Quick Chad much Akamai I, don't know how many ASI Jason sees I. Have it's actually an unknown? It's an unanswerable question for me. So I I, don't know. I wouldn't even have a way to sign something to say who I chase it with because I fear with things like route servers, so I have very many unknown es adjacencies, just for my backbone, a s but how many upstream.

J

Providers do have, we are not speaking about signing all adjacencies when speaking about only signing your IP transit providers.

Q

It is still a little bit indeterminate that I might be able to answer, but some of the people, the agreement, it looks like peering, but it may actually be more like transit, so sometimes.

J

The source relationships.

Q

Are a little bit fuzzy we're.

J

Not trying to define complex business relations, the only thing that a speii does is, if you create a record, you are just be meeting what is called provider to send your prefixes to up streams or peers, and so on. You are free, for example, not to pay me to one of your providers to send prefixes. You can do it, it's it's up to you.

J

So the the core idea is that, yes, you never know you all. Your agencies is because of transparent access- it's not possible, but to list your providers I. Think 99% of eyespace in the world will be capable to do it.

G

Okay, there's a much a conversation that probably needs to go on. The mailing list, for this I think would be a lot of help more helpful Daniel.

R

S

I would like to present to you our draft again. I have been at the last ITF meeting at Prague, so this time I will give you an update, and we would like to go for last call soon to finish this draft. So this is about how to use rpki validation at route servers and how to forward the result to the peers.

S

So the draft is around 4:00 already about three years more than three years, and they have been some substantial changes inside like edit modes of operation, how to do it at a route server and how to forward result appears so.

S

The last feedback from the ITF 104 is basically about which community to use and which mode of operation to run at default.

S

The motivation for this draft was basically to have something like our C 1897, which says how to forward época validation results in interior PGP. So at X piece we have some kind of similar situation. We run kind of a more trusted environment to the peers and it's natural for ex piece to forward some information with with routes, for example, where the route has been learned from how far like.

S

What's the round-trip time to the drought, things like that, so we would like to do the same with rpki protect result of a PKI onto the road, so that would be makes sense to make routing positions for monitoring, troubleshooting maintenance or just to record it to have educational or to do some research about it.

S

So, just to get a picture on how it works. Some of you already know it. We get an prefix from, for example, a SD that goes into a route server. There are servers doing all its usual checks. Also doing our D check, see if the prefixes valid for the a s. If it's an is a a set and additionally this time it will also do our PK validation. Then it can have different modes.

S

For example, it can drop the prefix right away or it can just forward the prefixes and take the state the result of the state onto the route to the to the neighbors, and then it should go to the neighbors, but the neighbors shouldn't redistribute this to others. It's just the idea to have this at the domain of the IXP.

S

So technically we now changed from an extended community to a large community, because this has been feedback from the last ITF meeting and it's now our standard. So basically it would be. We would have the habilitation um status at the last field, which would be like zero for if it's a valid prefix one, if it's not found it's unknown or two. If it's an invalid prefix, we would also have the function of function.

S

Specific number to signal the desist, a PKI, prefix validation community, and we would have the ASN of the of the XP, for example, that is distributing this validation result inside the route server that would have there would be different modes of operation available.

S

The first node would be to just tag the result that routes of a processed on to order out and distributed to the peers. The second mode of operation would be to drop all invalid prefixes and just forward valid ones and unknowns. So this would be now the default mode of operation and is basically like what is done today at severai expand. The third mode would be to to drop prefixes with invalid and unknown, but basically do the best path. Selection, after dead saw that valid routes would remain like on top of all errors.

S

Operational recommendations in the draft is that peers that receive the result should not redistribute it to a DA is ends. If a route server is receiving such a community from from a peer, it should strip it so that it will not redistribute. Other checks then was also common. Is that if the very origin relation fails at a route server, the community should be admitted there should be no community, and then, if there's, multiple validation results for appear, if it receives multiple validation results, the validation was art with the highest values should be should be taken.

S

That would be two for invalid, for example. So it's the most secure way to do it. So comments from the last meeting have been that we shouldn't, or there should be, a mechanism to a signal if the validation could be performed throughout server, and we have this now and operational recommendations to admit the community tech at the route server. Then one comment was that the draft has been overtaken by reality, which means that now more and more XP s already drop in billets, but I see it like this.

S

That things of the draft are now already implemented kind of, and we also define the communities to tag on and also if you go, for example, to the looking class, you can see at some ISPs that are already using communities.

S

You can't just see that you don't see it on your router, but you see that internally there are servers already using these communities. Then we had a discussion about extended and large communities we now resided in favor for large communities. There was always the concern of outsourcing security. That means that you are giving like the security. There is a decision to the route server, but this is some some trade-off that appears doing anyway.

S

It is peace and there's kind of a trusted relationship and then also discussion was always to drop envelopes by default, which we know it up did in the draft yeah. So with this I'm open to more comments and as I said, we would like to finish this draft fairly soon.

T

That Montgomery, but back one slide, what's the scenario where you get to validation results, it was like the last bullet of the previous slide. Yeah.

S

The last point here.

T

When what's the scenario and when you win this.

S

If your router is maybe peering with different route servers and there's giving you different different results of the validation for a prefix, so.

G

Let me try there's two route servers at Dax I appear with both of them. They happen to be unsynched with their perspective of the rpki data. One says valid, one says unknown: what should I do? Yeah.

S

That would be like a failure scenario yeah that true well.

M

Okay, but these would be two different routes and actually figuring out that you have two routes with different communities: I'm, not aware of any of the currently available configuration language to have appropriate policy language I.

T

Think we've talked about this before, but not in this context. You have no guarantee that the highest value of highest is valid. I, think that was why your youth, you have no guarantee they write.

F

T

The more recent data right.

S

Okay time time, wise I don't know, but basically if it would be at the same time and you should favor the higher value I.

T

Wasn't suggesting a race condition, I'm saying the idea that you choose the one with the more favorable validation result, isn't a sign that you're choosing the one that has the more up-to-date rpki information right it things could be effectively degrading, yeah.

S

It would be in favor from security I think in this case, I.

G

Think that's I think Doug. Your point is that as the data and the RPI is changing over time, I may choose to validate. I may choose to authorize you to do this route today and job tomorrow and not you tomorrow, and if the data at the to different route servers is in a state where one has the old data you and the other one has the good the new data job I. Certainly don't want to accept the route with you in it anymore. Can.

U

I injecting sense or abortionist. We made an awful lot of tests last year about that and you can have the following situation: let's assume you have a route on the East Coast and you have a router on the west coast and they exchange their data and they have the same path. Those who have two different validation, caches, I, don't know which of the validation cache has more up-to-date data. It might be that the one that resorts a novella is more up-to-date than the one that has the other result.

U

It also might be that the one vision in Belet has more up-to-date data than the one with a valid, so I cannot say just because I think out of security, because it might be a security that caused a certain prefix to be all of a sudden venit. So what now.

S

Okay, I take this as a good comment. Photographed thank.

E

You job Snyder's and CT in the case of failure in the original foundation process. For instance, how do you? How do you define failure of the original foundation process because, for instance, if the cache is empty policy will dictate that all of them become unknown and then omitting? The community is a force signal in this conflict that contradicts with what we understand that unknowns are or not found.

E

So we cannot differentiate, I, think between a failure in the urgent validation process or the absence of a validation process. Yeah I see this problem as well and then a second comment. If the default is to reject invalids, maybe you should remove the well-known invalids community and then only two communities are left the unknowns and valid, and at that point I kind of wonder what the use case is because I I think it's not very valuable and you should reconsider the words that we can trust each other at an internet exchange.

E

I fully agree from a commercial incentive if I were working for an internet exchange, but we in the transit world say transit is what you trust.

S

Okay, so you shouldn't yet you sought service or.

K

John Scudder, now that you explained what the last bullet means, I would like to agree with rüdiger that one route has one validation state. It doesn't make sense to talk about having multiple validation states for a route and as as I understand, I have I would need to go and I haven't looked at this version of the draft, so I don't know what the normative language is, but it sounds to me like that should just be removed because it doesn't make sense to say their route has two different validations days.

K

It only has one and it's the one that the route server told me alright. Thank you.

V

Randy push hi Jamarcus, oh I have problems with the trust nozzle also, but that's been beaten to death. um Why you switched, which tomorrow day, confuses me, we already have a well, then one and Burton Lee, not well-known one, but a well-defined one, um but basically, as you'll see the real problem, that's expressed in the original validation signaling graph, which you'll get to hear about boringly later. Is that saying the community gets to my router, but then what they're like German, if it's invalid?

V

Okay and the problem, is that I want to cause withdrawal and we haven't quite got the route map semantics for that.

S

Yeah, the community was changed because of the comments from the last meeting, so I understood that this is the right way to go and the default thing that is also done at route servers, so otherwise I understood that if we want to have extended communities like it's done with the ibgp draft, you have to implement all the policies and we have to wait like 10 years so yeah we thought. Is this the way to go.

S

All right normal comments all right. Thank you. Thank you very much.

G

Tim believe it is your turn find your aha.

G

Whoopsy quick thing: let me make this to go to fullscreen.

O

Yeah all right, yeah, Tim Burgess, and on that laughs, I'm going to talk about this graph, which is actually not a last call as far as I know, but it is on the Status pages. I think that's because HDS intell's was in law school. So it would be nice to rectify that because this is not finished so goals still. This is similar to the slide deck.

O

After that it presented two meetings ago, where I said, shall we call it done, but still no dome and I'll get back to that in a bit actually, but let's first look at the goals, so we want to allow for key roles in the RPI. There are many reasons why, but this might be useful. I used to work for write and CC where I was operating a trust anchor and we have done the lock-in which regards to an HSM. So that's just one of the reasons why this might be useful for relying parties.

O

It's important to learn about these things. Currently, there's no way, except for somehow offline in learning about a new trust, anchor locator and including it. Maybe when you update or your implementation, you get a new tell with that update, but it's not very well defined, so we also want to learn from experience in the DNS we like to have a way for this to be done, that you know, lands well into the existing standards, so it works well with, what's out there.

O

Finally, leave it's real for our data clients. What I mean by that is that if you have a piece of software that has aids for sync on locator in its so that's, it would be the way your your relying party tool finds the current certificate. Well, if that's our data, it would be very nice that you can follow a trail to the current set up thrust anchors that should be applicable.

O

So it was a major Commons on version 2 in Singapore, which is when is it safe? When do you know that you can actually drop lucky? So changes in three are well. I hope that the text is more clear. I could ask your first show of hands who actually try to read it.

O

No yeah, okay, great well I, will go through the phases here on this, my deck as well actually, but they try to make the document a bit more clear, but regards to what's going on, I mean we're starting from a situation, but none of this is applicable. How do you start use this, and how do you then do it use it to make a a role in a plan direction? How do you use it to make a role in long blimp plans of direction?

O

That's it and, as mentioned back in Singapore as well, the draft now uses distinct your eyes for where you can retrieve the TA certificates in an attempts to help figure out how many people are actually learning about this stuff and how many people support the standard if it becomes wrong now the objects. This is say someone. This may be bit painful for people, but essentially it says that there has to be one or more current keys.

O

The current key is defined as a sequence of or a sequence of certificate Euron. So it's bunch of your eyes and subject public key info and in fact that's exactly the same information as you find on a tell file. What an ace and 1d are formats rather than via text.

O

You can also have zero or more revoked keys, so.

O

Current situation, you have none of this right. You have the trust and can locate a faulty, a text file. It contains a bunch of your eyes and the the subject of key info of a tracker certificate. So relying party uses that to fetch a certificate verifies it, and it goes off a way to introduce this in the phase.

O

One let's say is at a or what we call a tech foul to confuse tall, UNTAC, less I suppose where a signed object has a reference, a URI to a location where that's ranked a certificate is signed and the same subject: public info now, when a relying party two runs, they will encounter this and the text in the document. Can he says or when you learn about these signed statements, you should use the information in there to replace what ya had obtained earlier from the clear text value were using now.

O

If you used different your eyes for both them as an operator, you can learn where people fetch things, so you can also understand somehow how many people would be able to. You know, follow its rail, let's say so. That's the more significant change, I think in this version of the document. If you go on, though o completeness, you can then add a new key have new tag files as a call referencing, both keys. You could have tell files for both entry points.

O

That say, but probably if you in terms to roll to key to here, you might want to reach out to relying party software to include that in the distribution or you could actually technically even have a discussion about you know using the design format in in that respect, then going further.

O

You can roll to a third key and revoke the first one off all the wrongs in here and I'm, not sure that I yeah, we can have a discussion about this. You will want, but I did present this before. Let me take away here is that I can revoke that first key on the tech file over the second I. Don't need to do that on the third, because people who learn about the third key will have already learned about the verification of the first by looking at a second, the reason: that's that complication is.

O

There is because I'd like to avoid having to have a long trail of what are all the previous revoked keys. We could still include that, but you know it might make the object bigger than is strictly necessary, so.

O

The document actually distinguishes two ways here: you could say: okay, we want to revoke he one, so a TA here or you could say well, actually, the one that we just introduced is no longer good and it would technically look the same from a a blind party point of view. Both current keys are just treated equally as current, essentially and either key can revoke all the others. Now the documents actually allows for any number of keys, and this is another question I think I have for the group as well.

O

Well, that leaves the the makes a document flexible, I think it also makes it more complicated and strictly necessary if we could constrain this to scenarios where you only have ever have two keys. That might may make things a lot simpler, so that may be well worth it now. Then, what's next well, well other ways that I thought I included something, but no it's in my mind, actually wanna do real proof of concepts.

O

Work on this and I happened to do that earlier, but I didn't get around to it, I'm still busy with some other things but arenal to get there because I don't feel confident. You know going asking for law school on this. Unless I have running code. That proves that okay, we can do a roll. We can do a roll where we went on with our intent. We do overall, where we figured no distant key, is no longer good and I want to verify that you know following it. Phil actually works.

O

So, even though it takes longer I would rather, you know, do it well, then rush it and I'm not entirely sure that I can form as when I'll get to it. But you know say it is update. That's where I want to go so question to the chairs. I suppose would be please get rid of the status last call because I don't think it's there and to anybody else. I mean if you have comments. Ideas concerns, like you know.

O

An old friend here, please speak up can be here can be in the hallways on the main list or wherever or if you want to help test. That's also great, of course, so without.

W

Hey Eric, Australia, coach, Mason, University, so I think this is really good. I, really like the approach you've taken and also the fact that you're highlighting a problem that I think exists in DNS SEC, among other places, where understanding what a key role is is proving to be very difficult, because it wasn't very clear when the protocol is designed. That key role is a really a big thing. It's more than just sticking a key out there using it and then seeking a new key out there and using it.

W

You know they actually wind up having a relationship to each other after they've been cycled out and whether they're still valid they become replay, vulnerabilities, I. Think there's a lot of like thinking through. Are you rolling forward or you're rolling backward? And how do you actually represent that that I think you I, like the fact that you're going to do a lot of analysis?

W

I think you might also sort of think through what are the various states that the resource is going to be in as keys change and whether keys exist in you rolled forward backward and coming with the taxonomy? For that I'd be happy to work with you, if you want sure.

V

Randy Bush IJ anarchists Oh like um like well enough. That would like to see early security reviews and suggest the chairs go, find some friends over there.

X

X

Bravo Stein arcus uh to your question about without you can simplify but getting rid of some of those infinite light sequences given you're talking about prototyping at first, which I think is a highly advisable thing li, but it's open-ended sequences for now and if it turns out you don't actually need all those slots, then you turn them because we've been seeing all kinds of entertaining things lately with people's pushing things that were not envisioned as more than three entries up to ten thousand. Let's see what happens.

Y

Marcin iris and she she, the dutch one- that's so you just talked about keys being able to revoke other keys and what that's your security conservation says that currently any key can revoke any other key. So I was thinking about this too, and I'm wondering if you want to roll a key, because you are not sure that it's safe anymore, for example, that's the property you're looking for, and I don't know what the property is, that you're looking for but yeah. This basically made me question how that that works.

Y

So in the I noted in the last working group that they tried to get some of the academic, formal proof groups, look at some parts of the protocol, I'm wondering if that's useful, to be trying to do here with the the P key a bit to try and understand if the property here looking for are provided by the functionality, you're, modeling and I'm, not sure, if, if anyone's willing and able to do that, but I guess it's. This is a time where you can easily fix oversight.

Y

So just questions I, suppose ya.

O

Know well, thank you for for pointers, because you know speaking for myself, I'm just making this up and hoping it. You know it works. So I can definitely use good advice. Sorry I should keep it a consistent distance.

O

So, but in terms of what we had in mind is well.

O

One of the thoughts is that if you have an HSM, you're, usually well protected against key theft, let's say, but you may still want to do plans rules, because you know you want to change, however, or but you can still use a key as well in particular like if you use card sets or people to protect key one, then you know you may not have a quorum anymore, and you may still have that one for key and you don't know for sure that it's going to go that direction.

O

So those are some of the concerns here about you know. Why do this at the same time? If you a lot of this, relies on operational procedures about how you manage your keys right, because in theory of course, if you have multiple keys and they can all revoke each other, then you just need to have.

O

You know own one of these keys to wreak havoc and clearly that that can introduce you know, bigger security risks, so I think there's a trade-off here and you know I'm not sure that I have only all the answers but I'm, hoping that the use of hsn's will actually help in this regard and strong processes, but I don't think having this is enough. You need, you need to have all kinds of our know, especially processors. I. Think your.

Y

Your slide sparked my thought, because you mentioned just now that you didn't want to revoke key one with keep with package two and three, so that made me think about this. So if you don't want like the newest key to revoke, then maybe it doesn't have to be able to or well so you think about that kind of property.

O

Well, if you referring to the one where I said only key to needs to revoke key one, that was mainly because you and only need to learn about key ones, revocation ones, and so that was an attempt to stop. You know the object from becoming really huge. If you, you know, theoretically, to do dozens of these roles.

G

Last two questions, then we'll lose the next sandy.

C

Murphy Parsons I'm standing at the far mic, because I'm asking a question from a position of ignorance and in case you want to throw things. I have been impressed at the amount of effort it took to do the DNS SEC key role. So this is a really good idea to get an early start on considering here, and so thank you very much for starting the work. I also remember the difficulties that there was in the site of working group to define the algorithm change documents from very long ago.

C

So what happens if your key role is also an algorithm role.

F

F

Don't know okay.

X

Boston orcas again, um I haven't reread this recently, so I don't know if you've already covered it. My apologies, but one of the things that was a consideration that they're already taking a little bit of speaking from what I think Mike st.

X

John's was intending with the RC 5011 for DNS SEC was the ability to pre publish keys before really using them, and that's basically because no one really knows how to do an emergency key role, an emergency key role for real and unplanned one he's basically burned it to the ground and start over which kind of sucks. So what you do instead is an accelerated schedule planned key role, which kind of requires you get the the four to work. Well, you need to get the next key out there early part.

X

The reason I bringing this up now is the question about whether or not there really should be some ordering in these keys so that you can't have you know the older one revoke the new one we probably want to put that into the bucket, while we're thinking this through I think they're all good questions I'm, just not sure what the answer is yet.

O

Fair enough.

G

All right, thank you very much. Next up is mr. Bush.

G

Let's see right away, didn't run away.

G

You tell me, which one would you like to do that one or that one don't.

V

Care, whatever comes up, you.

G

V

You got the old yep with the wrong tiny ones right foil, on Jesus I want a refund god. Damn.

G

Pardon my french all right.

V

C

V

Had a presentation: look: Ike, okay, better, yes, okay!

V

So, as was kind of mentioned in a previous talk, there was RFC 1897 with an extended community for origin validation. Signaling, it kind of looked like this, and how does the receiver drop in balance? Yeah I got the message. I gave you a prefix, you wrote back and you said it sucked. What do I do cry? Okay, so I want to drop in balance as if I had detected it myself running origin, validation, okay, that should be the effect kind of, in fact, even slightly more strongly.

V

I should withdraw all the announcements where I actually sent out the garbage right so think about reflector with lazy clients, the clients don't run origin validation, but it would be nice if they understood this community and actually knew how to act on it. And this isn't policy. This is actual behavior change, I'm getting a scowl from John and that's why? Because it sounds like work.

V

Okay, I mean it's not just the route reflect your situation, but here in this draft we specifically talked about trust boundary. Okay, it's only within a pop. It's not outsourcing! It okay do not share your needles with customers or friends; okay, so here's where we kind of differ with the route server issue: okay, no, okay, as well of origin validation, ploys. We really want to do something like this. It would be a bit of an accelerator, make it easy for some people. Let's set her okay and we'd like to request w/g adoption.

V

You also want an email to the listener. Will that do please email list, because I will forget about now. Three.

G

To go to the next presentation because you just said so: do you have questions before I.

K

Better I want to explain why I was scowling, which wasn't the reason you said. I, don't think if I understood your summary, slides correctly you're scowling because of withdraw the ones I.

V

Already announced right.

K

That should be a natural consequence of a policy that says I'm. Not accepting this I don't know. The problem is I'm about reflect your client, yeah, okay,.

V

Take me around yeah I accepted it yeah I, pass it to the right. Reflector right throughout reflector, says and sends the signal back to me to you, yeah. Okay, to me, that's okay and.

K

I've already accepted Andrea now now.

V

K

What you're asking for I, don't think I like it but I'll think about it for a while. That's.

V

Why that is why I thought that's what you were scowling at. This is work and slightly ugly work, because it's not only bad announcement, but it's all the other announcements of the same prefix with the same origin. Right.

E

Yep job Snyder's entity, so you're kind of sticking, bgp withdrawals for off link pierce into a BGP quincy, no, because what the route reflector so the reflector decides. This is invalid. It sends a signal back to the spoke that could be I, know a well-known community or new attributes. The.

V

Spokes that the community, it's already documented and find.

E

V

G

This mine takes.

E

Word completes what it received from the ebgp peer as a withdrawal, and then it will send with trust to know the other route service. No.

N

No about some baby care can see the route reflector when it receives routes from its clients will run a best spot and will announce the best spot a best spot when it does the community tags on top of it to say what is wrong with it. Now the route reflector could say part one is the best but part four that I just received had a bad community, so it could do ad parts in piggyback part. Four and say this is wrong.

N

Take it back, which will be the net result will be same, but it could also send it on the path one which was the best part. That is what Ryan is trying to say. I think.

E

The spoke receives the signal, then. What does it do? It should perform. Origin validation know.

V

That the point is when the spoke receives the signal it withdraws. It drops the invalid as if it had detected it, but it has no cash feeding it so hands.

E

Redraw any announcement it.

V

May have made with.

E

That invalid origin, in other words, this is signaling, withdrawals over EGP communities.

V

Since its signalling asking you to withdraw.

Q

Shared watch, Akamai and- and then it decides- oh I might have seen this again, because somebody did soft reconfigure route refresh and now I'm gonna send it back up and loop. It loop it and create a message loop. This this sounds potentially very scary and messy actually.

N

What Randy is trying to say and I'm channeling him? So keep me honest when it receives an extended when edge router receives an extended community for that, given prefix on an edge router for all the paths, it will go and loop and say wherever you find a spot, which is incorrect, mark that path, ineligible for best path, reading the best path and then announced that new best path back to the route reflector, so that, if someone does a router refresh in again, you always always send out the right path. Does that make sense.

V

Maybe I I have ten minutes for two presentations. Gentlemen, yep.

Q

Yeah, which means.

V

Q

And it may yeah I could see this getting very messy. You very quick I.

E

Had a second question: if we're gonna modify the edges to accommodate the behavior, why not just implement region, validation and I don't mean to be cocky, but no? No, no! That's perfectly valid. That's.

V

My personal instinct, of course, but there are others who said otherwise they want to have more centralized control at that level, just as they have single or you know, paired validators in a pop Ruettiger, I'm, sorry to be rude, I have another present day. How am I doing for time? For the second presentation, can we move along? Please sorry, gentlemen:.

V

C

V

Pluck the magic Twitter okay.

V

Update the content on the thingy, the.

G

Meeting materials are correct. This just is wrong, but.

V

It's only the tie, seeing is that yeah yeah I sent him the email on this than you asked for this says signaling what this says egress. So that's just a very funny spelling of egress ignored.

V

This is incited by professor Volk, so the problem is the origin. Aas may be modified by outbound policy and also note that the origin is is know when it's preparing to be announced.

V

Okay, so it will definitely be modified by outbound policy for if it's being originated here, okay, so we want policy. Semantics based on validation should be applied separately to distribution into bgp, which, if we've already defined and kind of, have running and separately to egress.

V

Because I can lunge the path change. The effect of origin I could have a selection of a SS on this router and I'm the originator and then I choose which one of I'm gonna tag, etc. So I want to be able to apply origin validation to what I am about to announce, because I don't want to hear from warrants. Knock well. I've got bad breath.

V

So when applied aggress, the effective origin is the note, that's the effective or geneious must be used to determine the origin, validation state and yes, I will send you an email to request adoption. Thank you very much. No extra charge Mike.

K

G

Will mr. mandersohn.

G

So I don't have a fun slide for you, so I'll just go back to the schedule slide.

H

Thank you for your um your time, so my name is Terry I'm a route server operator I'll be very clear that I only speak for myself as a root server operator and for the root server that I operate. I will not speak for any other root server operator. I want to draw your attention I'm talking about DNS and there's a reason. I'm talking about DNS I'll get to it in a minute.

H

Yes, yes, route, not route.

H

So there's a lot of a lot of push to do. Rpki because you know you'll, look better you'll, you'll grow your hair back and you know you'll be more attractive to the opposite, sex, all those sorts of things and that's fantastic. There are two documents. I would like to draw your attention to just slightly. You may not understand where they come from, but you can google them and find them. There's something called Rs sac. 0:21 are a sec. Is the root server system. Advisory Committee and our sector.

H

A21 essentially says that the failure of one root server operator is not critical to the operation of the entire internet and that's good. There's a second document. Our sex 0 for 2, which says things about the independence of root cellar operators and one of those things that it discusses, is that root server operators will be diverse in their operations and their network operations and infrastructures.

H

So now I think about this, and this is my perspective. Only no one else's, someone might share it, but this is my observation. Is that if the root server operators all do rpki, they are then impacted? Should one of the five TAS have an a situation more so right now, if one particular operator ta operator, rpki operator has an issue, it will affect nine root. Server operators discuss.

Z

Iottery there's a flaw.

L

Z

Seeing them also root so operator and I learned about this about five minutes ago.

Z

So what I figured out with the and Natalie sand Roberts help from the NCC is it turns out, even if you're not doing our PK, if you don't have an Aurora, you still have a problem.

Z

Because someone can get Aurora.

AA

Then Madison, what come on? um I presume the the single ta operator that you refer to is Erin and that's because that's where most of the it doesn't.

H

Matter who it is it's arbitrary? Well, whether there's there's 12 organizations that operate root, servers, there's only five organizations that currently do the in this current model, like I'm, not trying to propose any solutions. That's not my job. My job is just to highlight that I see there that there is a diversity issue. I was.

AA

Asking to make sure I was understanding the problem. As you said, this is presumably exacerbated by the fact that all five acclaiming root in their roots, yeas of no.

H

Not necessarily, it would actually also exist if there was a single trust anchor and it could be worse, but it's still.

AA

So you don't see this being improved from a diversity perspective by having the the numbers from which the root servers come from more widely spreading right amongst this, so.

X

Evenly distributed.

AA

H

It as a as a it's better, but it's not ideal in in my opinion. Again. This is all my opinion. My observations, job Snyder's, NCT, I.

E

Have trouble grasping the problem, there are five root certificates and there are 1326 prefixes and you can distribute the 2605 tells and that's not enough. Diversity can.

G

You do the numbers for your first. Two are sac documents. Please 0:21, sorry know about those numbers. The the internal numbers like the first one was it's okay. If one root server is disappeared, yeah and the second one is the.

H

The the first one is it one, it's okay, if there is one one roots of operator, fails the second one is a principal that's set for the operation of root server operators, and that is that root server operators will have diversity in their operations, inclusive of network and stuff, like that.

E

So if you sign half of them not sign the other half and distribute amongst multiple r ers you're done right, I.

H

Don't know is that the answer that that cider ups would recommend.

E

Is that within our men days,.

H

You upper this is where you operate: rpki and cider and stuff. This is where your expertise is. That's.

E

Not my expertise.

H

E

That case I would recommend you try to transfer at least one ipv6 prefix to another region as an experiment to see if you can obtain access to other certificates.

E

I

My name is Carlos I work for Lange, Nick notify, or else we would happily welcome you guys I mean we can recover policies that allow us to assign prefixes for critical infrastructure that can be used outside of our region and I. Believe the other four have similar policies. My my comment is that I, don't think that's a problem for us to solve I mean as cider ups I.

I

Think if you have nine prefixes within a single IRR, you guys are a bit weak on the diversity aspect that you apparently are defending and other documents I, don't know what the solution is. I mean you could roll a piece in some of the root servers distributed among their areas. You could get a new space from us. You could transfer like yourself. There are a bunch of ways. You could actually create more diversity in that aspect of their roots or reparations.

H

Maybe someone should like write a document that defines some things that you should do, but that is no.

C

I

H

Advice about this to date, you know.

I

I have my statement for a plane to our site in my computer I've had it for a while I think I've. This is the right time to submit. Maybe it is Terry.

G

Can I ask another clarifying question? She.

I

G

Sounds to me, like you're, using the root servers as an example organization and losing.

H

The weight serve as an example.

G

Okay, sorry you're using your root I have.

H

A problem: okay, okay I, have people telling me that I need to do a PK. Oh I am nervous as heck a baby.

F

Doing it because I.

H

Don't want to end up on the front of Time magazine too late, so.

M

G

Don't make a magazine anymore, I think the depth I guess what I was trying to go. Is you? There are some things that are sort of hot-button topics, and maybe the issue is not necessarily a roots or a problem. This is in general network operations problem if I operate, something a large resource of the Internet.

C

Or so you think.

G

That's interesting to me from a business perspective. I have to have redundancy diversity, you know failover sort of capability and my business continuity plan, maybe didn't take into account that I have all of my resources in one rir. I wasn't.

H

Making that point, but if you want to let up that, that's fine, okay,.

G

H

I was making a point simply for my own operations is selfish and lack of altruism, as that is that's where it was.

AB

H

AB

Robert Kiyosaki ripe, ncc I am NOT a Rupert root operator. I have friends who are three things. First, what Chris said in I don't think that root the root servers are any special. In this context, just a state yeah.

H

That's funny I, don't like the idea of golden.

AB

Numbers and stuff as well, six five second statement: we went through the scenarios over lunch and I'm happy to talk to you or anyone who is interested or we can form some kind of committee whatever. um But the end result of the discussion was that no operator can be worse off than today. If they also have Roseanne rpki, they may be better off, but they will not be worse off in case of attacks and so on. Okay, it's not just every day, but if hits the fan, I'm happy to talk about it, as I said.

AB

The third statement is that it's a bit tongue-in-cheek, but brute operators already synchronize on protocols and everything they do. You all run ipv4 ipv6, bgp blah blah blah. So you might want to you know. If you want to diversify, then you might want to do write, P, X or something yeah. It's pretty much tongue in cheek.

T

Doug McDermott just to be clear, so you're afraid of either accidental or malicious Roiz being created. That caused other folk to drop your route or it could be anything I'm trying to understand the.

H

T

Scenario, which.

H

Doesn't cause all right, I'll look I understand that it could be an operational failure at the entity that is signing so, which.

T

Resources to become.

H

T

H

Would become invalid if it becomes invalid, then people.

T

Who are filtering invalid, can't reach you on that address, correct.

H

Especially if they, but that the people who are filtering or transit and all of their customers, can't reach.

T

Good slurm value.

V

First, for everybody else, suggestions did involve a route server, changing its IP address, our fir after I'm dead, the.

V

Protocol, if you get far build I, don't care they're, twelve other Road servers um so doing drastic structural action in the rpki or the protocol is doesn't get a lot of sympathy. Thirdly, is I would refer you to about a three year old presentation that shows you how to escape Aaron.

V

All my resources are ripe.

V

All my v4 and v6 are in right. Oh not maybe six cuz, it's not mine, I.

H

Didn't mean this to be a beat up on on any Aria. That's not why? Who.

V

You said you have a whole bunch of the rude operators are in one arm. That's.

H

V

Facet of history, whatever was the cause. What I'm saying is some of them could move without changing IP addresses.

H

I think my key point is that even if we all moved and and shuffled around it would be still people world.

C

H

Being compressed down into five organizations, so your diversity set is now five.

V

Said being having Aurora is no worse than having no row, and your response was incorrect. When you said the folder of that role could far below an issue, a bad AS IS the detail, you're worried about, and they couldn't issue a role with a bad alias for you. If you hadn't, registered.

X

Bravo Stein arkose two observations. One you're not gonna, settle this or get career an advice today. This is a little bit to do. People I.

P

Know I thought.

H

X

H

X

Other thing, though, I think you need to make a distinction between reliability and availability and the two services you're talking about here. The fetching and caching behavior of DNS is very different from the fetching and caching behavior of the rpki. You can probably survive an outage of no new stuff being published in the rpki for a while I mean eventually they'll start to have problems.

X

You know, CR ELLs get stale bla bla bla bla bla, but if people aren't using stupidly short expiration times, you can last a few days right a few days if a root server being out would probably be more noticeable, so you may need to do the numbers on how long of an outage is acceptable. That sort of thing- and you know getting good.

F

X

F

X

The better distribution- but you know, talked about it by five there's only so much you can do.

P

Jeff Jeff Houston accidental player inside the ICANN circus. From time to time look our sack exists for a very good reason and part of that reason.

P

He to observe, understand and possibly recommend you've raised an interesting issue and part of the issue is whether you should sign and what the Associated sort of issues of diversity where the addresses get said it, and so on and I think they're great topics, and you should consider from the perspective of all 12 of you what you should do to give yourselves both diversity and maximal, availability and performance and so on, and that seems to me like something that our sac should investigate and harness resources and do study for maybe invoking expert commentary or whatever our sec wants to do.

P

I think it's difficult for this group to understand the particular needs of those 12 operators, or even just one in isolation and your motivation about diversity is perhaps best studied in detail in our sac. I'm saying in short, not here not now, guess.

H

Where I'm going next and.

P

H

But wait I do want to go there and then all of a sudden, you guys get sideswiped by a random.

P

H

I'm being polite in this situation, right and.

P

I think the politeness is more than a sec might circle around either. The group will one or two of the group and get some more data as they do their investigation and that's great and it's great that it's forewarning as I said it's a bit tough to say to us solve it because, like I, said wrong place wrong time, I'm not ask you to solve it on actually think.

H

About it, that's why I said discuss I didn't say so, because I actually don't think it is solvable in in the sense of a protocol sensor that, as Randy pointed out, it would be a significant architectural change and I. Don't think that is rightly appropriate, but other things can be done.

P

Like many things about the root server system, it's about assurance to the community that the you know we're doing as well as we can do state-of-the-art. Is there and you know I- think our sac is perfectly capable of getting to that kind of advice without necessarily committing myself there doing any work at all. Just.

G

Just a note on time: we are over time, so there, whatever cookies, are the next thing coming.

AC

With little markers just one general remark: it's a common thing that the when you are implements are mechanism to cope the summer, the attacks, then you will have additional failures connected with a possible failure of that mechanism. It's obvious! You should leave that. The problem is whether gains from implementing that measure mechanism over weights, where possible, drawbacks from these mechanism being broken. So you just brought the common general question so who is it worth to implement mechanism yeah? Just the drawbacks will alway to gains so so everyone should decide by himself. So.

T

Duck again, so it seems, like your risk, is the same, no matter what decision you take right, because it's the other people doing validation if, if a CA is compromised and somebody creates a a a wrong ro uh for your resources, whether you take action or not, I'm hoist correct right.

T

Okay, so it seems like you can make your decision as to whether you, whether you fear Route hijacks to the routes routes route, hijacks to the routes more than you do. You know compromised massive failure to rpki in the way that would generate invalid somewhere else. Iii.

H

Think of I've done enough here of raised the awareness of it and then I think the rest can be discussions. I could be a perhaps because I think we're kind of out of time and cookies awaiting so.

E

What is what you would propose a mechanism for follow up on this? Is there a working group that works on this or an action.

M

E

We have a great idea: where do we send it I.

H

My next steps, and one had already planned, is to raise it at at our sect bit of information is that I am also a representative at our sac and I'm. Also, a member of the asset caucus. The asset caucus is the thing that does the work for our sac, so it will be raised in our sac that may also spin off into other requests into other parts of the the I can't ecosystem, including something called s SEC which I do know.

H

Jeff is also a member of, and some others here in this room, perhaps as well. So yes, there's additional stuff coming through and I think Jeff's right, I think those groups will circle back here, but I think it was good to just raise it, and so you have some awareness of issues, some operational issues that are caused by this particular corner case and, as Chris pointed out, possibly by other organizations who might think the same way are.

H

Thank you. So much I really appreciate it.

W

A