February 2013 - ncc-services-wg

Policy update request on certification of transferred IPv4 allocations
by Andrew de la Haye 21 Feb '13

21 Feb '13

[Apologies for duplicate emails] Dear colleagues, Based on recent discussions on the RIPE Address Policy WG mailing list, the RIPE NCC is now seeking policy related action from the RIPE community with regards to clear guidelines on how it should proceed with certifying transferred IPv4 allocations. It has recently come to our notice, via two of the policy authors, that the original intention (in 2007) of the sentence "Re-allocated blocks will be signed to establish the current allocation owner" was that the transferred block *must* be signed *after* the transfer in order to completely establish holdership. This sentence can be found under section 5.5 of "IPv4 Address Allocation and Assignment Policies for the RIPE NCC Service Region" here: http://www.ripe.net/ripe/docs/ripe-582#Transfers-of-Allocations Because the RIPE community provided guidance saying that certification should be an opt-in system, the RIPE NCC built an RPKI Certification system based on this opt-in notion, therefore it is not currently possible for the RIPE NCC to issue certificates without the resource holder initiating the process. Therefore, the RIPE NCC's interpretation and implementation of this specific sentence has been: Registration Services verifies and reflects the change in holdership of the re-allocated blocks by updating the database objects and internal records following the transfer. Any certificates that had been attached to these number resources before the transfer automatically become invalid/revoked due to the holdership change. The transfer recipient can then request a new certificate for the address space and the RIPE NCC will proceed to sign these resources to establish the current allocation holder. Therefore, the RIPE NCC does not make certification of any resources mandatory. As the sentence in section 5.5 of "IPv4 Address Allocation and Assignment Policies for the RIPE NCC Service Region" is open to interpretation, the RIPE NCC is seeking representative(s) from the RIPE community to submit an update to ripe-582 that will replace this sentence with more accurate and appropriate wording or perhaps remove it completely. Kind regards, Andrew de la Haye Chief Operations Officer RIPE NCC

1 0

Internet Governance and the RIPE NCC: The Year Ahead
by Chris Buckridge 20 Feb '13

20 Feb '13

Dear colleagues, We have just published an article on RIPE Labs that details some of the major Internet governance-related discussions currently taking place, as well as the RIPE NCC's priorities and activities in this area for the coming year. We encourage you to read the article and comment, either on RIPE Labs or on this mailing list. Feedback from the RIPE NCC membership and RIPE community is vital in shaping the RIPE NCC's position and strategy in relation to these issues. We also welcome any suggestions on how to improve the RIPE NCC's engagement with the public sector and other Internet stakeholders in your country or region. You can read the article in full at: https://labs.ripe.net/Members/chrisb/internet-governance-and-the-ripe-ncc-t… Best regards, Chris Buckridge External Relations Officer, RIPE NCC

1 0

Support for proposal 2012-07
by Mihael Dimec 20 Feb '13

20 Feb '13

I support https://www.ripe.net/ripe/policies/proposals/2012-07 Best regards, Mihael Dimec

1 0

Re: [ncc-services-wg] [anti-abuse-wg] WG: 2013-01 New Policy Proposal (Openness about Policy Violations)
by Dan Luedtke 19 Feb '13

19 Feb '13

Hi all, (citing from the proposal) > The RIPE NCC will handle all such reports and update the state accordingly. What I miss, is a state like 'closed, violation took place, ressource not (yet) returned' Otherwise it looks like the whole "returning" comes down to listing the ressource in the 'returned'-file. What happens if the ressource holder is "guilty" but does not want to return the ressources? Does returning mean, we all stop peering/announcing/whatever with the listed ressources? How can we re-allocate the ressources, when someone still uses it (against the ruling of RIPE NCC)? These questions are more technically, because I haven't understood fully how the whole process is meant to work. For the sake of transparency, I'd like to see - Date submitted; - The resources the report is about; - A short summary from RIPE NCC (2-3 lines) [not the initial report] published for alle reports that have the state 'closed,resources-returned'. Furthermore, if the ressource holder agrees, we should publish 'closed,no violation', 'closed,out of scope', 'closed,resolved by holder' reports, too. Just to make sure that subsequent reports will not report the same issue again and again. Best regards Dan -- Dan Luedtke http://www.danrl.de

1 0

[news] RPKI and PI End Users Proposal - Feedback Requested
by Axel Pawlik 18 Feb '13

18 Feb '13

[Apologies for duplicate emails] Dear colleagues, Since the launch of the RIPE NCC resource certification (RPKI) system on 1 January 2011, more than 1,300 RIPE NCC members have requested a resource certificate. Together, they have created statements about BGP routing for over 3,000 prefixes, covering more than five /8 blocks. Currently, this system is only applicable to Provider Aggregatable (PA) address space held by RIPE NCC members. The functionality that we most commonly receive requests for is to make address space held by Provider Independent (PI) End Users eligible for certification. During the RIPE 65 Meeting in Amsterdam, there were discussions on this and the RIPE NCC Executive Board extensively deliberated the issue. Based on these discussions, the Executive Board now submits this proposal for consideration and discussion to you, the RIPE NCC membership and the RIPE community. One of the most important considerations when issuing a resource certificate is that it be given to the legitimate holder of the address space. This is fundamental to the reliability and trustworthiness of the system and to the goal of making our registry as robust as possible. To ensure that the resource certificate retains its authoritative value over time, it is important that the RIPE NCC periodically verifies the association between the resource and its holder. With our members, this is a straightforward process because we have direct contact with them at least once a year. Under current RIPE Policy, PI End Users who are not RIPE NCC members must have a contractual agreement with a sponsoring LIR (as detailed in ripe-452). Periodic verification of the resource holder could be handled by the sponsoring LIR. Also note that the RIPE NCC cannot enter into any contractual agreement with PI End Users, other than the "RIPE NCC Standard Service Agreement" (ripe-435). Therefore, the Executive Board proposes that PI End Users in the RIPE NCC service region who want to certify their resources be given both of the following two options: 1. Sign an agreement with their sponsoring LIR (a RIPE NCC member) to have the resources certified by the RIPE NCC via the sponsoring LIR. In this case, the sponsoring LIR would be responsible for periodically verifying that the PI End User is the legitimate holder of the resources. However, the RIPE NCC will in all cases be responsible for issuing the resource certificate and providing access to the RPKI management interface. Therefore, PI End Users should, at all times, be able to change from one sponsoring LIR to another while still retaining the same certificate for the resources that they hold. The cost associated with this option lies in building a framework in the LIR Portal to facilitate the process, some administrative overhead, and the additional burden on the RPKI infrastructure, that would not be funded by the direct beneficiary of the resource certification service. These costs would come out of the general RIPE NCC budget and would therefore be funded by all RIPE NCC members, however it is unlikely that this would have any direct impact on future membership fees. Alternatively a PI End User may choose to: 2. Become a RIPE NCC member, pay the full annual membership fee and receive a certificate directly through the RIPE NCC. The Executive Board feels that offering both of these options will result in relatively little impact on membership fees while offering all PI End Users the opportunity to certify their Internet number resources without being forced to become a member of the RIPE NCC. For the sake of completeness, we also present a third scenario discussed by the Executive Board that would involve giving PI End Users that have received resources through a sponsoring LIR the option to deal directly with the RIPE NCC without becoming a RIPE NCC member or needing to make contact with their sponsoring LIR. They could do this by authenticating the relevant INETNUM object using their MNTNER, and supplying additional information directly to the RIPE NCC (company registration papers, business address details, contact email, etc.) on a periodic basis (probably every 12-18 months). This option would not entail any fee or contractual agreement for the PI End User. However the Executive Board does not see this as a viable option, as the amount of resources required to check the necessary supporting documentation and other administrative overheads would be too large a financial burden on the RIPE NCC membership. The lack of a periodically-renewed contractual relationship with the PI End User, while providing them this service, may also cause complications. *IMPORTANT* Your opinions and feedback on this proposal are vital in shaping a resource certification system that best suits your needs. We encourage you to discuss this matter on the RIPE NCC members-discuss mailing list. Following approximately six weeks of discussion (ending on 30 March 2013), the Executive Board will consider feedback from the list and propose options on moving forward on this matter which will be properly communicated. Kind regards, Axel Pawlik Managing Director RIPE NCC

3 2

Fwd: [anti-abuse-wg] 2013-01 New Policy Proposal (Openness about Policy Violations)
by Brian Nisbet 18 Feb '13

18 Feb '13

Good people of the NCC Services WG, The following policy '2013-01 Openness about Policy Violations' started it's trip through the PDP yesterday. While the discussions on this proposal will take place in the Anti-Abuse working group, I just wanted to make sure this WG was aware as there are obvious implications for NCC processes & procedures. Brian Co-Chair, RIPE AA-WG -------- Original Message -------- Subject: [anti-abuse-wg] 2013-01 New Policy Proposal (Openness about Policy Violations) Date: Thu, 14 Feb 2013 15:05:23 +0100 From: Emilio Madaio <emadaio(a)ripe.net> Reply-To: anti-abuse-wg(a)ripe.net To: policy-announce(a)ripe.net CC: anti-abuse-wg(a)ripe.net Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2013-01 We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 14 March 2013. Regards Emilio Madaio Policy Development Officer RIPE NCC

6 15

2012-07 Discussion Period extended until 21 February 2013 (RIPE NCC Service to Legacy Internet Resource Holders)
by Kornfellner Johannes, Ing. 18 Feb '13

18 Feb '13

Hello, this proposal (https://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-January/001972…) seems to provide a good balance between the legacy resource holders' existing rights and community's wish for accurate registration data. It provides several options for a direct or indirect contractual relationship between a Legacy Internet Resource Holder and the RIPE NCC. I think that this crucial to cover the different needs of the different legacy resource holders. I therefore support this proposal. Best Regards, Ing. Johannes Kornfellner Parlamentsdirektion A1.5 EDV / Systemgruppe [file:///C:\Users\jk\AppData\Roaming\Microsoft\Signatures\CorporateDesign.jpg] A-1017 Wien - Parlament Tel. +43 1 401 10-2822 Mob. +43 676 8900 2822 Fax +43 1 401 10-2848

1 0

Re: [ncc-services-wg] [anti-abuse-wg] 2013-01 New Policy Proposal(Openness about Policy Violations)
by Jørgen Hovland 16 Feb '13

16 Feb '13

1 0

Re: [ncc-services-wg] [ncc-announce] [news] RPKI and PI End Users Proposal - Feedback Requested
by Nick Hilliard 14 Feb '13

14 Feb '13

On 11/02/2013 13:55, Axel Pawlik wrote: > The functionality that we most commonly receive requests for is to make > address space held by Provider Independent (PI) End Users eligible for > certification. During the RIPE 65 Meeting in Amsterdam, there were > discussions on this and the RIPE NCC Executive Board extensively > deliberated the issue. Based on these discussions, the Executive Board > now submits this proposal for consideration and discussion to you, the > RIPE NCC membership and the RIPE community. If I'm reading this correctly, the board has already decided to provide RPKI services to PI address holders without a RIPE community policy proposal or a RIPE NCC membership vote, and this email is just soliciting opinions on the terms of this decision. Could I respectfully suggest that the board put this proposal through the normal channels for policy development, i.e. the PDP. Nick

3 3

Re: [ncc-services-wg] 2012-08 New Policy Proposal (Publication of Sponsoring LIR for Independent Number Resources)
by Randy Bush 14 Feb '13

14 Feb '13

< peanut gallery > this one seems a no brainer to me. it's just part of proper and open documentation of registration and allocation, the ncc's primary job. as far as the lir not wanting to be known to have sponsored a pi site, if the lir is ashamed of doing something, maybe they should not have done it. i just don't get this stuff. correct and open documentation is the ncc's primary job. randy

6 21