- ncc-services-wg - mailman.ripe.net

Re: [ncc-services-wg] Improved Secure Communication for Registration Services (RS) Mailboxes
by Wilfried Woeber, UniVie/ACOnet 27 Feb '04

27 Feb '04

Hi Gert! >> I would argue that it is the other way around; given the forced choice of >> "only one" the broadest support exists for PGP. > >I don't see anyone talking about "only one". Why are you worried? Well, the "only one" may come from the wording in the document, and it was suggested already during this discussion (although _in favour_ of PGP!!): ______________________________________________________________________ From: Kurt Jaeger <lists(a)complx.LF.net> To: ncc-services-wg(a)ripe.net Subject: Re: [ncc-services-wg] Improved Secure Communication for Registration Services (RS) Mailboxes Date: Thu, 26 Feb 2004 08:59:38 +0100 HI! > > No but it highlights one of the reasons why X.509 might be the > > better choice. > to repeat myself, why is there a choice at all? why one xor the > other, as opposed to one or the other? Because in the long run, providing both ways will cost more than consolidating into one. So, sometime in the future, we will be asked: Does someone still use the GPG way ? Aha, only a minority. So: We will close that down, to save costs. [ .... ] Frankly, if the cost in implementing the x.509 way had been invested in the GPG way, we would have exactly one and better solution than having now to run/use both. -- MfG/Best regards, Kurt Jaeger 16 years to go ! LF.net GmbH fon +49 711 90074-23 pi(a)LF.net Ruppmannstr. 27 fax +49 711 90074-33 D-70565 Stuttgart mob +49 171 3101372 ______________________________________________________________________ >(If someone proposed abandoning PGP, I would be one of the loudest voices >opposing it) So I guess you should voice your opinion :-) >Gert Doering > -- NetMaster >-- >Total number of prefixes smaller than registry allocations: 58081 (57882) > >SpaceNet AG Mail: netmaster(a)Space.Net >Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 >80807 Muenchen Fax : +49-89-32356-299 Wilfried.

1 0

Re: [ncc-services-wg] Improved Secure Communication for Registration Services (RS) Mailboxes
by Wilfried Woeber, UniVie/ACOnet 27 Feb '04

27 Feb '04

>However, the document under discussion appears to offer X.509 as the >only method for securing communication with RS mailboxes, If this is the case then I strongly suggest to amend the wording! >the >alternative is continue as today, where this communication is going >unsigned and in the clear in both directions. Not really, the Reg.Serv Dept. obviously applies PGP signatures to outgoing mail by default (see below). And I really appreciate that!! >Regards, > >- Håvard Regards, Wilfried. ______________________________________________________________________ To: Woeber(a)CC.UniVie.ac.at Subject: NCC#2004xxxxxx AW raise From: RIPE NCC Hostmaster <hostmaster(a)ripe.net> Date: Fri, 30 Jan 2004 15:18:10 +0100 This is a cryptographically signed message in MIME format. ------------=_1075472293-11892-0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-length: 280 Dear Wilfried, Thank you for approaching us this morning. We have decided to raise your Assignment Window from /xx to /xx (you will receive an official approval message within a few moments). If you have any question please let us know. Kind regards, Andrea Cima RIPE NCC - ------------=_1075472293-11892-0 Content-Type: application/pgp-signature Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Comment: For info see https://www.ripe.net/rs/pgp/ iD8DBQFAGmelaF6b6AtxYiURAmMIAJ4kseNxvU+D7NoFdPpe8ikAY2EYRwCfW8pm Ww6xtXPHUtuKACSDvWMq0Q8= =eCb7 -----END PGP SIGNATURE----- ------------=_1075472293-11892-0-- --------------------------------------------------------------------------------

1 0

RE: [address-policy-wg] New Draft Document: De-boganising New AddressBlocks
by Michel Py 27 Feb '04

27 Feb '04

> Rob Thomas wrote: > The reality is that the miscreants are seeing a lower > return on the investment when spoofing from bogon prefixes. Because they are being filtered :-) If more people filtered bogons, the "ROI" would be even lower. Although it is clear that bogon filtering is not a complete cure for spoofing, it does help and it also helps for some spammers. The only negative effect of bogon filtering is not-up-to-date filters, which is why we have written this draft that will expand the applicability domain of bogon route servers and other filtering schemes. Michel.

1 0

New Document available: RIPE-301
by RIPE NCC Document Announcement Service 26 Feb '04

26 Feb '04

New RIPE Document Announcement -------------------------------------- A new document is available from the RIPE document store. Ref: ripe-301 Title: Mergers, Acquisitions, Takeovers and Closures of Organisations Operating an LIR Author: Kamran Khalid Nurani Nimpuno Sabrina Wilmot Date: February 2004 Format: PDF=195891 TXT=13941 Obsoletes: ripe-185, ripe-241 Obsoleted by: Updates: Updated by: Short content description ------------------------- This document provides guidelines to Local Internet Registries (LIRs) on the steps to take when the organisation operating an LIR changes ownership (due to a merger, sale or takeover) or stops serving entirely as an LIR. Accessing the RIPE document store --------------------------------- You can access the RIPE documents in HTML format via our website at the following URL:. http://www.ripe.net/docs/mergers.html The RIPE Document Store is also available via anonymous FTP to ftp.ripe.net, in the directory ripe/docs. The URLs for the new documents on the FTP-server are: ftp://ftp.ripe.net/ripe/docs/ripe-301.pdf PDF Version ftp://ftp.ripe.net/ripe/docs/ripe-301.txt plain text version

4 3

Re: [address-policy-wg] New Draft Document: De-boganising New Address Blocks
by Michael.Dillon＠radianz.com 26 Feb '04

26 Feb '04

>The RIPE NCC has prepared a draft document titled "De-Bogonising New >Address Blocks": That is a misleading title. The problem is that ISPs cannot react quickly enough to open filters when new ranges are allocated. The proposed solution is to provide advance notification. I suppose this could allow ISPs to open filters before the new addresses are actually in use officially. However, it will also allow spammers to announce this space and get it through bogon filters. The real solution to this problem is to make it possible for ISPs to closely track RIR allocations in their filters in a semi-automated way. There may still be a few days of delay before a new allocation is fully routable but ISPs can compensate for that with internal processes. Why can't ISPs subscribe to a feed of all new RIPE allocations in near real-time? --Michael Dillon

10 15

Re: [ncc-services-wg] Improved Secure Communication for Registration Services (RS) Mailboxes
by Wilfried Woeber, UniVie/ACOnet 25 Feb '04

25 Feb '04

Hi Shane! >Ignoring the "PGP versus X.509" question, does the membership want us to >support signed e-mail at all? What about encrypted e-mail? Of course I cannot speak for the membership, I can only do so for our LIR: Yes, signed email communication should be supported. In particular with the current situation that "from" and "to" lines are just "random text" in a "subset" of messages being sent on the net these days ;-) I think that encryption almost comes for free when we've got signatures, and should be offered as well, _but not be required_. >- -- >Shane Kerr >RIPE NCC Wilfried (at.aconet)

1 0

New Document available: RIPE-303
by RIPE NCC Document Announcement Service 25 Feb '04

25 Feb '04

New RIPE Document Announcement -------------------------------------- A new document is available from the RIPE document store. Ref: ripe-303 Title: Procedure for Becoming a Member of the RIPE NCC Author: Olivia Ruimwijk Ingrid Wijte Agata Peszkowska Emma Bretherick Leo Vegoda Dominic Spratley Date: February 2004 Format: PDF=142723 TXT=14811 Obsoletes: ripe-212, ripe-230, ripe-257 Obsoleted by: Updates: Updated by: Short content description ------------------------- This document aims to provide the necessary information for those who wish to become a member of the RIPE NCC by setting up a Local Internet Registry (LIR). In this document initial guidelines are given to organisations that are planning to set up an LIR. Further, the necessary steps to set up an LIR are described. Accessing the RIPE document store --------------------------------- You can access the RIPE documents in HTML format via our website at the following URL:. http://www.ripe.net/docs/new-lir.html The RIPE Document Store is also available via anonymous FTP to ftp.ripe.net, in the directory ripe/docs. The URLs for the new documents on the FTP-server are: ftp://ftp.ripe.net/ripe/docs/ripe-303.pdf PDF version ftp://ftp.ripe.net/ripe/docs/ripe-303.txt plain text version

1 0

RE: Improved Secure Communication for Registration Services (RS) Mailboxes
by Wilfried Woeber, UniVie/ACOnet 25 Feb '04

25 Feb '04

> I object on making x.509 the sole method of authenticated > communication with RIPE. I would certainly object against the PGP technology _which is in place now_ being phased out (soon). However, the NCC has reported that for _some_ applications/interfaces the integration of PGP into the server environment and with scripts is cumbersome. Although I do not have first hand experience of my own, I do not have any reason to question that. If one/some of the document(s) needs re-wording to make that clear, then we should put our effort into that. And yes, I still have to find the spare time to read the text this is referring to. [ taking off my DB-WG hat ;-] On a more private side, I still think that PKI technology is not mature enough, and stable enough, to be used in a production environment which is NOT based on a "point and click on demand" interface. OTOH, unless we start trying to do that, this will never change. Wilfried. _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ the street finds its own use for technology...

2 1

Re: [address-policy-wg] New Draft Document: De-boganising New Address Blocks
by Wilfried Woeber, UniVie/ACOnet 25 Feb '04

25 Feb '04

[ cc: list trimmed ] >However, it will also allow spammers to announce this >space and get it through bogon filters. [ ... ] >Why can't ISPs subscribe to a feed of all new >RIPE allocations in near real-time? Do you have any simple and concise definition of "ISP" for this context which would solve your "hide the info from spammers" issue? >--Michael Dillon Wilfried. _________________________________:_____________________________________ Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at UniVie Computer Center - ACOnet : Tel: +43 1 4277 - 140 33 Universitaetsstrasse 7 : Fax: +43 1 4277 - 9 140 A-1010 Vienna, Austria, Europe : RIPE-DB: WW144, PGP keyID 0xF0ACB369 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: [ncc-services-wg] Improved Secure Communication for Registration Services (RS) Mailboxes
by Michael.Dillon＠radianz.com 25 Feb '04

25 Feb '04

>I object on making x.509 the sole method of authenticated >communication with RIPE. >There's GPG, and it works, now. I think this is an exageration. The only form of authenticated communication which works now over the Internet is SSL combined with HTTP. The choice of which secure technology is irrelevant. The security features of the technology are irrelevant. The only thing that matters is how easy will it be to use the new technology and how will RIPE teach people to use the technology and what tools will RIPE make available to people to run on their Windows machines, Macintosh machines and UNIX workstations so that they can use this new technology as easily as they use the web or email today. GPG isn't necessarily any easier to learn and use than X.509 is. Remember, the audience for this is the LIR staff who administer IP address allocations. They are not necessarily engineers or technical people. They probably don't use UNIX workstations and they probably don't know how to write scripts or use a command line. --Michael Dillon

2 1