- ncc-services-wg - mailman.ripe.net

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Owen DeLong 05 Oct '10

05 Oct '10

> >> I'll go a step further and say that the resource holder should be >> the ONLY holder of the private key for their resources. >> >> Owen > > If you're saying that ISPs can only participate in an RPKI scheme if they > run their own Certificate Authority, then I think that would practically > ruin the chances of Certification actually ever taking off on a large > scale. > > -Alex No... I'm saying that if ISPs aren't the only entities that hold their private keys, then they aren't the only entities that can sign their resources. If you choose to delegate the CA role for signing your resources to someone else, then, obviously, you have to give them a valid private key with which to sign those resources. However, in doing that, you've created a situation where your signature is now much easier to forge. Kind of like automatic signing machines for checks. Benefit: The accounting department can sign thousands of checks and the CFO doesn't have to. Draw-back... The accounting department can sign thousands of checks without the CFO knowing they did so. Owen

4 5

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Alex Band 04 Oct '10

04 Oct '10

On Mon, October 4, 2010 04:38, Owen DeLong wrote: > > On Oct 3, 2010, at 7:26 PM, Randy Bush wrote: > >>> Do you think there is value in creating a system like this? >> >> yes. though, given issues of errors and deliberate falsifications, i am >> not entirely comfortable with the whois/bgp combo being considered >> formally authoritative. but we have to do something. But blindly considering whois/BGP authoritative is not what I am proposing. I want to confront the network operator with what is registered in the IRR and what is seen in BGP, and let the human element make decisions and corrections, improving data quality in the process. >>> Are there any glaring holes that I missed >> >> yes. the operator should be able to hold the private key to their >> certificate(s) or the meaning of 'private key' and the security >> structure of the [ripe part of the] rpki is a broken. >> >> randy In the hosted implementation the RIPE NCC currently has, only a registered contact for an LIR with whom we have a business relationship has access to the secured LIR Portal in which the Certification system is embedded. The reason to offer a hosted system initially, is to take away the burden from an LIR of having to run their own Certificate Authority. We offer a service that makes the entry barrier for Certification as low as possible. Properly running your own CA, with all the crypto aspects, is no small feat for a lot of LIRs (technically, but perhaps more psychologically). You may argue that it's easy and cheap to do yourself, but just look at adoption rates and levels of IPv6 and DNSSEC *at an LIR level* to see what reality is like. After the production launch on 1 January 2011, the next step we will take is to implement the up/down protocol, allowing people to run their own Certificate Authority if they choose to do so. We plan to roll this out in the first half of 2011. We'll go one step further by having our software certified by an external independent company, and releasing it as open source to the Community, so they can be sure they adopt a robust system if they choose our package. So in the end our implementation is not 'broken' as you say, it is in he middle of a planned, phased approach. Not everything is possible yet and that is a deliberate decision. > I'll go a step further and say that the resource holder should be > the ONLY holder of the private key for their resources. > > Owen If you're saying that ISPs can only participate in an RPKI scheme if they run their own Certificate Authority, then I think that would practically ruin the chances of Certification actually ever taking off on a large scale. -Alex

1 0

RPKI Resource Certification: building features
by Alex Band 03 Oct '10

03 Oct '10

Most of the discussions around RPKI Resource Certification that have been held up to now have largely revolved around infrastructure and policy topics. I would like to move away from that here and discuss what kind of value and which features can be offered with Certification for network administrators around the world. Because in the end, the goal is to make Internet routing more robust and create a more reliable method for network operators to make routing decisions. We all know about the shortcomings of the IRR system and that just half of all prefixes on the Internet have a route object associated with them (http://bgpmon.net/blog/?p=140). However, it does mean that there is ton of valuable information in the IRRs, whereas the Certification system needs to start from scratch. Based on many discussion I've had with members and the Community, here is my idea for a Route Origin Authorisation** (ROA) wizard that retrieves IRR information, compares it to real world routing and uses that for the creation of ROA Specifications. This has a number of benefits: - Network operators don't have to create their routing policy in the Certification system from scratch - Because a comparison between is done the IRR and RIS (http://ripe.net/ris/), only accurate up-to-date information is added to the Certification system - The accuracy of the IRR is increased as a bonus, and is achieved without leaving the wizard Ideally, a network operator should be able to manage and publish their routing policy – both for the IRR and Certification – from one single interface. Here are the basic steps for the wizard after a certificate is generated: 1. Start ROA Wizard 2. Detect IRR information using the AS numbers in the Certificate, like for example: http://www.db.ripe.net/whois?searchtext=AS286&inverse_attributes=origin&for… 3: Compare results with RIS using RRCC/Netsense, like for example: http://www.ris.ripe.net/cgi-bin/rrccng/query.cgi?target=AS286 4: Allow user to flag which ROA specifications they would actually like to create, based on the IRR and RRCC/Netsense results. 5: Allow user to create additional ROA Specifications 6: Detect which maintainer is used for the route objects in the IRR 7: Allow user to specify maintainer password/pgp key, so all route objects are updated/removed/added based on the ROAs that were created. This makes sure the data in the IRR and the Certification system is consistent. 8: Save and publish ROAs and route objects Do you think there is value in creating a system like this? Are there any glaring holes that I missed, or something that could be added? I'm looking forward to your feedback. Alex Band RIPE NCC http://ripe.net/certification ** The certification system largely revolves around three main elements: (1) the Certificate, that offers validated proof of holdership of an Internet Resource, (2) the Route Orgin Authorisation Object (ROA), a standardised document that states that the holder of a certain prefix authorises a particular AS to announce that prefix and (3) the Validator, which relying parties, i.e. your peers, can use to validate certificates and ROAs.

1 0

A case study for using public RIPE NCC Tools on RIPE Labs
by Mirjam Kuehne 20 Sep '10

20 Sep '10

[Apologies for duplicate emails] Dear Colleagues, After a short K-root outage last week, RIPE NCC Chief Scientist Daniel Karrenberg investigated exactly what happened using the public RIPE NCC tools DNSMON and RIS. Read this interesting and informative step-by-step case study on RIPE Labs: https://labs.ripe.net/Members/dfk/investigating/investigating-events-with-r… Kind regards, Mirjam Kühne RIPE Labs

1 0

LIR Portal Upgrade
by Trudy Prins 31 Aug '10

31 Aug '10

Dear Colleagues, The RIPE NCC is currently upgrading the LIR Portal to a newer software version, increasing the flexibility, quality and reliability, and including a single sign-on system. To help ensure a smooth deployment, the upgrade is rolled out in stages. The first stage of deployment, upgrading the Billing section of the site, was carried out on 14 April 2010. The Training section and the Resource Lists were upgraded as well. The second stage, which includes all resource request forms and wizards, will be deployed today, 31 August. Downtime of the portal should be less than one minute. The deployment of the new portal software including the sign-in system does not yet include the entire LIR Portal. Users may find that they are asked to sign in more than once as they move between different sections of the site. This will continue until the single sign-on system has been fully deployed throughout the LIR Portal. The remaining old LIR Portal sections will be replaced in the final upgrade, scheduled to take place in the fourth quarter of 2010. After this final deployment, all functionality of the LIR Portal will be available under the single sign-on system. The migration to newer software might result in some small changes, but the overall look and feel should not be affected in a very noticeable way. If you have any questions or comments regarding this upgrade, please email <sw-bugs(a)ripe.net>. Best regards, Trudy Prins Manager Business Applications RIPE NCC

1 0

2007-01 Policy Implementation - Phase 3 draft procedures available
by Arne Kiessling 23 Aug '10

23 Aug '10

Dear Colleagues, As announced during the RIPE NCC Services Working Group session at RIPE 60, the RIPE NCC will provide the RIPE community with a draft procedure for Phase 3 of the policy implementation for "Contractual Requirements for Provider Independent Resource Holders in the RIPE NCC Service Region". The draft document is available at: http://www.ripe.net/news/2007-01-phase3.html Please note that the draft document describes an internal RIPE NCC procedure and is provided for informational purposes. If you have any feedback for the RIPE NCC regarding the procedure for Phase 3 of the policy implementation, please send an email to <enduser-contract(a)ripe.net>. -- Kind Regards Arne Kiessling IP Resource Analyst RIPE Network Coordination Centre

1 0

IPv6 RIPEness - Criteria for a Potential Fifth Star Rating - RIPE Labs
by Amanda Gowland 17 Aug '10

17 Aug '10

[Apologies for duplicates] Dear Colleagues, Earlier this year, RIPE Labs posted an article about IPv6 "RIPEness", a 4-star rating system of LIR IPv6 deployment. In that article, we asked for feedback on what criteria we could use to determine the potential addition of a 5th star to the rating system. We received some great feedback on how we could determine a 5-star RIPEness rating, you can read about it on RIPE Labs: https://labs.ripe.net/Members/becha/ipv6-ripeness-5th-star-criteria As always, any comments or suggestions are welcome. You can send us email or post in the article's comment section. Kind Regards, Amanda Gowland RIPE NCC

1 0

Data Repository on RIPE Labs
by Mirjam Kuehne 27 Jul '10

27 Jul '10

[apologies for duplicates] Dear colleagues, We launched a new project on RIPE Labs: the RIPE Data Repository. You can read the announcement here: https://labs.ripe.net/Members/mirjam/ripe-data-repository On the projects pages you will find a more detailed description of the project, a list of data sets and the terms and conditions for using those data sets: https://labs.ripe.net/datarepository If you have any questions or comments, please do not hesitate to leave a comment on RIPE Labs or send mail to labs(a)ripe.net. Kind Regards, Mirjam Kühne RIPE NCC

1 0

Outage report for RIPE Database updates
by Denis Walker 21 Jul '10

21 Jul '10

[Apologies for duplicate emails] Dear colleagues, Between 22:06 and 23:37 (UTC) on Tuesday, 20 July 2010, there was an interruption to the update service for the RIPE Database. All update processes were affected. If you did not receive any acknowledgement, you might need to check any objects you were updating in the RIPE Database to see if the update was successful. If you received an acknowledgement, you need to check the messages in that acknowledgement to see if any errors occurred. Apologies for any inconvenience this may have caused. Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

Splitted PI billing
by Max Tulyev 21 Jul '10

21 Jul '10

Hi All! Recently RIPE NCC has assigned a PI network for my client. It is 1536 IPs (/22+/23), and it was assigned as two completely different inetnums (with one same netname). I have asked how it will be billed, and got an answer - as two separate objects. I understand, in future it will be harder and harder to get a non-splitted networks, and splitted networks will be more frequent. But how I can predict it in my agreements with customers? I don't know how much pieces will be splitted the next network to. When I said it will be twice more expensive than expected, customer was unhappy and said there is an agreement already signed, with the exact price in it. I think, one request shold be billed as one object, isn't it? -- WBR, Max Tulyev (MT6561-RIPE, 2:463/253@FIDO)

5 5