Re: [sidr] GOST & SIDR

[Randy Bush <randy at psg.com>]

> Except that if a significant portion of the world uses an algorithm
> your validator code can't handle, then you can't validate routes to
> that part of the world.

like if drc decides to change in a panic because dean anderson said he
broke X?

> I would think that the validation of routes is not only of benefit in
> packets reaching you, but in you being more confident that your
> packets are going where they are meant to go.

hard to disagreee with that.  though, to be pedantic, we are securing,
or attempting to secure, the control plane, not the data plane.

> Are you really advocating a system that could not support a change of
> algorithm?  A new algorithm means a new RPKI-v2?

i really do not think it's gonna be reasonable to add a new algorithm
without serious operational planning and roll-out.  if this stuff
deploys successful, N years from now, there will likely be a significant
part of the net that just won't except non-validatable routing data.
and we can't just let chunks of the net go unroutable.

i also worry that non-trivial chunks of the net may not manage their
certification data well, just as they do not manage bogon filters well
today.

basically, i think we need a few years of experience to get a feeling
for what kinds of change we can tolerate and what kinds we need.

> (How is that different from an RPKI with a new OID in the alg field?)

probably not much.  excuse the jet lag wipeout.  at least i managed to
get some food.

but if there is negligible difference, then why/what exactly does sam
want to change? :)

randy