December 2013 - ncc-services-wg

comments on proposal 2012-07
by Nick Hilliard 05 Feb '14

05 Feb '14

Hello, I thought I'd chip in on 2012-07. The current version of the proposal is a huge improvement on v1.0 and thanks / kudos need to go to the authors for what was obviously a huge amount of work. I still have issues with a number of areas. Serious issues: Section 3.0 needs to include a term in the contract to state that the services provided by the RIPE NCC to the legacy resource holder are defined by RIPE community policy and may be amended from time to time, according to ripe community policy. Section 2.6 still provides carte blanche for legacy resource holders to freeload services off the RIPE NCC with no consequences. As a RIPE NCC member, I am not at all happy about this. The amount of work that the RIPE NCC is going to have to undertake to handle the legacy resource holder community is very large indeed, and it is not reasonable to expect the RIPE membership to foot the bill for those legacy resource holders who aren't members and who feel un-inclined to contribute towards registration services just because they couldn't be bothered to pay. Section 2.5: I see where this is coming from, namely there will probably be situations where the users of the address space will be unable to identify themselves adequately as having any claim to their assignment. However, this section is open to abuse and it concerns me that it's still there. I concede that there is a requirement to have some type of arrangement like this, but the wording of the current section needs to be tightened up considerably. Less serious issues: Section 2.4 is redundant. We have a well established precedent under the terms of 2007-01 for engaging with sponsoring LIRs and this seems to work well in practice. Creating this policy option merely adds cost to the RIPE NCC's bottom line for no gain. Nits: Section 3.0: "a statement that the RIPE NCC is not entitled to deregister the resources for whatever purpose unless so instructed by the resource holder". This statement is advisory only and it needs to be made clear that the sponsoring LIR does not have power to make a legally binding statement of this form. This actually applies to all four statements in section 3.0. Nick

7 25

New RIPE NCC PGP Key
by Ingrid Wijte 17 Dec '13

17 Dec '13

[Apologies for duplicate e-mails] Dear Colleagues, On Monday, 6 January 2014 we will start using our 2014 key to sign e-mails from our ticketing system. The new key has been signed by the old key as described in the key-management policy on our web site: https://www.ripe.net/lir-services/resource-management/contact/pgp-authentic… The old key remains valid until Wednesday, 29 January 2014. If you have any questions about this, please contact <ops(a)ripe.net>. Kind Regards, Ingrid Wijte RIPE NCC

1 0

Proposed Implementation for Two-Factor Authentication
by Alex Band 12 Dec '13

12 Dec '13

Dear colleagues, Firstly, I would like to thank all who provided feedback on our authentication proposal for RIPE NCC Access. Many responded to the request for feedback, both publicly and privately, which is very encouraging to see. Based on your input, and the fact that this functionality is very rarely used, we would like to propose the following: 1. Discontinue X.509 identity certificate login from 1 February 2014 - All users who currently have a certificate will be contacted individually - Users will only use their RIPE NCC Access username and password to log in from 1 February 2014 - Note: a lost password can be recovered at https://access.ripe.net/forgot-password 2. Build an implementation for two-factor authentication for RIPE NCC Access, supporting at least: - HMAC-Based One-Time Password (HOTP) - Time-Based One-Time Password (TOTP) We would like to plan the development effort and scheduling before the end of the year and inform you about our roadmap once the project plan is in place. Please let us know if you have any comments or questions. Kind regards, Alex Band Product Manager RIPE NCC

2 1

IPv6 support in the IP Analyser API
by Alex Band 11 Dec '13

11 Dec '13

Dear colleagues, We are incrementally adding support for IPv6 in the IP Analyser toolset. The first piece of functionality that we deployed is the API. You can read more about this feature at: https://www.ripe.net/data-tools/developer-documentation/the-lir-portal-ip-a… Please do not hesitate to contact us if you have any feedback or questions. Kind regards, Alex Band Product Manager RIPE NCC

1 0

Authentication Proposal for RIPE NCC Access
by Alex Band 06 Dec '13

06 Dec '13

Dear colleagues, In our RIPE NCC Access authentication system, we offer the ability to log in using an X.509 identity certificate instead of a username and password. This functionality was transferred from the legacy authentication system we used to have, without evaluating the value of this feature at the time. Since then, we have encountered several implementation, user interface and support issues surrounding this feature, while it is used by less than 0.7% of the users with a RIPE NCC Access account. Most importantly, the functionality does not actually offer any additional security. This is something that is provided by true two-factor authentication. We would like to propose to put this functionality in maintenance mode, meaning that it would be provided as it is without a service guarantee. Alternatively, it could be removed altogether. This would free us of a maintenance and support burden, meaning that we can spend these resources on other valuable services. If the membership approves, the RIPE NCC could investigate ways to implement true two-factor authentication for RIPE NCC Access. We look forward to hearing your feedback. Kind regards, Alex Band Product Manager RIPE NCC

16 17