< draft-ietf-opsawg-finding-geofeeds-05.txt   draft-ietf-opsawg-finding-geofeeds-06.txt >
Network Working Group R. Bush Network Working Group R. Bush
Internet-Draft IIJ & Arrcus Internet-Draft IIJ & Arrcus
Intended status: Standards Track M. Candela Intended status: Standards Track M. Candela
Expires: October 15, 2021 NTT Expires: October 21, 2021 NTT
W. Kumari W. Kumari
Google Google
R. Housley R. Housley
Vigil Security Vigil Security
April 13, 2021 April 19, 2021
Finding and Using Geofeed Data Finding and Using Geofeed Data
draft-ietf-opsawg-finding-geofeeds-05 draft-ietf-opsawg-finding-geofeeds-06
Abstract Abstract
This document describes how to find and authenticate geofeed data. This document describes how to find and authenticate geofeed data.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on October 15, 2021. This Internet-Draft will expire on October 21, 2021.
Copyright Notice Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 3, line 45 skipping to change at page 3, line 45
exposure in geofeed data and be cautious. All the privacy exposure in geofeed data and be cautious. All the privacy
considerations of [RFC8805] Section 4 apply to this document. considerations of [RFC8805] Section 4 apply to this document.
This document also suggests optional signature, which authenticates This document also suggests optional signature, which authenticates
the data when present, for geofeed files to provide stronger the data when present, for geofeed files to provide stronger
authenticity to the data. authenticity to the data.
3. inetnum: Class 3. inetnum: Class
The Routing Policy Specification Language (RPSL), [RFC4012] used by The Routing Policy Specification Language (RPSL), [RFC4012] used by
the Regional Internet Registries (RIRs) specifies inetnum: database the Regional Internet Registries (RIRs) specifies the inetnum:
classs. Each of these objects describes an IP address range and its database class. Each of these objects describes an IP address range
attributes. The inetnum: objects form a hierarchy ordered on the and its attributes. The inetnum: objects form a hierarchy ordered on
address space. the address space.
Ideally, RPSL would be augmented to define a new RPSL geofeed: Ideally, RPSL would be augmented to define a new RPSL geofeed:
attribute in the inetnum: class. Until such time, this document attribute in the inetnum: class. Until such time, this document
defines the syntax of a Geofeed remarks: attribute which contains an defines the syntax of a Geofeed remarks: attribute which contains an
HTTPS URL of a geofeed file. The format of the inetnum: geofeed HTTPS URL of a geofeed file. The format of the inetnum: geofeed
attribute MUST be as in this example, "remarks: Geofeed" followed by attribute MUST be as in this example, "remarks: Geofeed" followed by
a URL which will vary, but MUST refer only to a single [RFC8805] a URL which will vary, but MUST refer only to a single [RFC8805]
geofeed file. geofeed file.
inetnum: 192.0.2.0/24 # example inetnum: 192.0.2.0/24 # example
skipping to change at page 6, line 19 skipping to change at page 6, line 19
address range is included in the [RFC5652] CMS SignedData address range is included in the [RFC5652] CMS SignedData
certificates field. certificates field.
Identifying the private key associated with the certificate, and Identifying the private key associated with the certificate, and
getting the department with the Hardware Security Module (HSM) to getting the department with the Hardware Security Module (HSM) to
sign the CMS blob is left as an exercise for the implementor. On the sign the CMS blob is left as an exercise for the implementor. On the
other hand, verifying the signature requires no complexity; the other hand, verifying the signature requires no complexity; the
certificate, which can be validated in the public RPKI, has the certificate, which can be validated in the public RPKI, has the
needed public key. needed public key.
Unless [RFC8805] is modified to formally define such an appendix, it The appendix MUST be 'hidden' as a series of "#" comments at the end
MUST be 'hidden' as a series of "#" comments at the end of the of the geofeed file. The following is a cryptographically incorrect,
geofeed file. The following is a cryptographically incorrect, albeit albeit simple example. A correct and full example is in Appendix A.
simple example. A correct and full example is in Appendix A.
# RPKI Signature: 192.0.2.0/24 # RPKI Signature: 192.0.2.0/24
# MIIGlwYJKoZIhvcNAQcCoIIGiDCCBoQCAQMxDTALBglghkgBZQMEAgEwDQYLKoZ # MIIGlwYJKoZIhvcNAQcCoIIGiDCCBoQCAQMxDTALBglghkgBZQMEAgEwDQYLKoZ
# IhvcNAQkQAS+gggSxMIIErTCCA5WgAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu # IhvcNAQkQAS+gggSxMIIErTCCA5WgAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu
... ...
# imwYkXpiMxw44EZqDjl36MiWsRDLdgoijBBcGbibwyAfGeR46k5raZCGvxG+4xa # imwYkXpiMxw44EZqDjl36MiWsRDLdgoijBBcGbibwyAfGeR46k5raZCGvxG+4xa
# O8PDTxTfIYwAnBjRBKAqAZ7yX5xHfm58jUXsZJ7Ileq1S7G6Kk= # O8PDTxTfIYwAnBjRBKAqAZ7yX5xHfm58jUXsZJ7Ileq1S7G6Kk=
# End Signature: 192.0.2.0/24 # End Signature: 192.0.2.0/24
The signature does not cover the signature lines. The signature does not cover the signature lines.
 End of changes. 6 change blocks. 
12 lines changed or deleted 11 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/