Subject: [secdir] Secdir last call review of draft-ietf-opsawg-finding-geofeeds-06

From: Kyle Rose via Datatracker <[email-masked]>
Date: Thu, 29 Apr 2021 05:13:22 -0700

Reviewer: Kyle Rose
Review result: Has Issues

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
last call comments.

This document Has Issues.

== Nits

The nits include a need for a thorough editorial pass prior to submission to
the RFC editor. For example:

 * The abstract should probably give the uninformed reader a bit more
 information about the overall geofeed ecosystem. * "utterly awesome", "or
 whatever", "It would be polite"

I would also move the privacy discussion from section 2 "Geofeed Files" to a
privacy considerations section, as that is where those concerned will look for
that information.

== Unclear requirements

This document appears to propose overlapping mechanisms for establishment of
trust in geofeed data. As far as I can tell, geofeed data may be authenticated
both by:

 * RPKI private key signature of a digest of a canonicalized form of the
 geofeed data file. * Web PKI via https URL for geofeed data file.

I'm trying to suss out the requirements that led to this design, and so far it
is not clear to me why two mechanisms are necessary or desirable given the
complexity this implies for clients. ISTM that if a requirement is made that
the geofeed data file MUST be served via https, and RPKI authenticates the URL,
then the web PKI would provide a sufficient trust anchor for the geofeed data
itself without any additional RPKI signature. Alternatively, if the assumption
is that RPKI is the more appropriate PKI for protecting this information, then
why leverage the web PKI at all?

Moreover, even if the flexibility offered by two mechanisms is found to be
desirable, there is no explicit recommendation that an LIR use one mechanism
exclusively for a given geofeed.

== Security gaps

 * There appears to be no way to revoke previously-signed geofeed data except
 via rotation of the RPKI key pair. Using the web PKI and https is a
 countermeasure here by preventing impersonation of the geofeed host, but it's
 unclear what utility RPKI provides if web PKI is required to guarantee geofeed
 freshness. Metadata imposing a expiry on geofeed data authenticated by RPKI
 would serve the same function, at the cost of requiring the data to be
 refreshed regularly.

== Other questions

 * Is it always the case that RPKI private keys are protected by HSM, or is
 that simply a best practice? Is the assumption that all RPKI changes imply a
 manual workflow?

 * Is it actually the case that "the data change very infrequently"? Is there
 no legitimate use case for rapidly changing geofeed information, e.g., for
 overlay networks providing IP mobility? 'At most weekly' seems arbitrary. This
 also has implications for the choice of PKI, if manual workflows are indeed
 required for RPKI signing.

 * Why does the geofeed appendix not accommodate multiple signatures for
 distinct address ranges? The requirement that a geofeed file not be
 RPKI-signed in order to be shared by multiple INETNUM objects could be
 relieved were multiple signatures allowed.

---

From: Randy Bush <[email-masked]>
Date: Thu, 29 Apr 2021 12:56:31 -0700

hi kyle:

thanks a million for the review.  we have a suply chain problem getting
solid reviews these days.

>  whatever", "It would be polite"

aha!  the style directorate.  we'll see how far it gets.  maybe even
rfced still has a twinkle in their eye. :)

> I would also move the privacy discussion from section 2 "Geofeed
> Files" to a privacy considerations section, as that is where those
> concerned will look for that information.

aha.  a privacy section is a new fashion of which i was unaware.  done.
thanks.

> This document appears to propose overlapping mechanisms for
> establishment of trust in geofeed data. As far as I can tell, geofeed
> data may be authenticated both by:
> 

not exactly.

the web pki has no authority over IP address space ownership.  it is
only used to authenticate a *pointer* to the geofeed file.  and the S in
https is just because we know folk will whine if the S is not there;
it's ietf fashion, similar to not working over ipv6 (or privacy
consideration sections:).  And the us of TLS will ensure that the file
comes from the intended source and it comes without modification.

for example, was i to put my geofeed file in gobble docs, the web pki
would be gobble's cert chain, not mine, the IP space owner.

one can optionally authenticate the geofeed data themselves by using the
rpki to sign over them.  and, unlike the web pki, the rpki does provide
authority over IP address space ownership.

so these two pki uses are quite distinct and serve very different
purposes.

to aid the reader, i have hacked in

    The URL's use of the web PKI can not provide authentication of IP
    address space ownership.  It is only used to authenticate a pointer
    to the geofeed file and transport integrity of the data.  In
    contrast, the RPKI can be used to authenticate IP space ownership;
    see optional authentication in Section 4.

> I'm trying to suss out the requirements that led to this design, and
> so far it is not clear to me why two mechanisms are necessary or
> desirable given the complexity this implies for clients. ISTM that if
> a requirement is made that the geofeed data file MUST be served via
> https, and RPKI authenticates the URL, then the web PKI would provide
> a sufficient trust anchor for the geofeed data itself without any
> additional RPKI signature. Alternatively, if the assumption is that
> RPKI is the more appropriate PKI for protecting this information, then

see above

>  * There appears to be no way to revoke previously-signed geofeed data
>  except via rotation of the RPKI key pair. Using the web PKI and https
>  is a countermeasure here by preventing impersonation of the geofeed
>  host, but it's unclear what utility RPKI provides if web PKI is
>  required to guarantee geofeed freshness. Metadata imposing a expiry
>  on geofeed data authenticated by RPKI would serve the same function,
>  at the cost of requiring the data to be refreshed regularly.

validation of the signing certificate needs to ensure that it is part of
the current manifest and that the resources are covered by the RPKI
certificate.  this handles revocation.

but, if you want to go down the "how does revocation work in the rpki"
rabbit hole, you have to drink the 3779 validation koolaid, and that of
the "up-down" protocol, and have a look at manifests.  not that i am
recommending going down this rabbit hole.

>  * Is it always the case that RPKI private keys are protected by HSM,
>  or is that simply a best practice?

not at all.  but, imiho, we should stay neutral on that.  the example

   Identifying the private key associated with the certificate, and
   getting the department with the Hardware Security Module (HSM) to
   sign the CMS blob is left as an exercise for the implementor.
   
was merely a cultural reference to the silos in a large LIR where
address space ownership, rpki signing, ... are often in a very separate
fiefdom from geo location folk.

> Is the assumption that all RPKI changes imply a manual workflow?

no.  one hopes it will become more and more automated as time passes.
we hope the manual workflow will go away.  weekly would be a fantastic
improvement over the multi-month or forever gap we have now.  every week
there is a plea on nanog "my customer in gzork is blocked by fooTV who
seems to think thay're in gzplatz and won't let them watch sesame
street."

the two informative references, draft-ietf-sidrops-rpki-rta and
draft-spaghetti-sidrops-rpki-rsc, should give you a feeling to where
this can go, devops willing.

>  * Is it actually the case that "the data change very infrequently"?
>  Is there no legitimate use case for rapidly changing geofeed
>  information, e.g., for overlay networks providing IP mobility? 'At
>  most weekly' seems arbitrary. This also has implications for the
>  choice of PKI, if manual workflows are indeed required for RPKI
>  signing.

hmmmm.  on the one hand, UpTightInternetTV really just wants to know
geoloc of cable customers; and today this takes weeks, months, or never.
on the other hand, i can see ietf folk wondering about extensibility and
future uses.  on the third hand, do we really want to wrap ourselves
around the axle of geolocating LEO satellites?

but the bit you quote is in advice to the entity *fetching* geofeed
data.  if they are trying to geolocate LEO satellites which wish to
be geolocated with high time resolution, they should use the cache
headers.  Note that it does say

    Section 3.4 suggests use of the [RFC7234] HTTP Expires Caching
    Header to signal when geofeed data should be refetched. As the data
    change very infrequently, in the absence of such an HTTP Header
    signal, collectors MUST NOT fetch more frequently than weekly.

the ops style hack we would use is to change the
   collectors MUST NOT fetch more frequently
to
   collectors SHOULD NOT fetch more frequently

>  * Why does the geofeed appendix not accommodate multiple signatures
>  for distinct address ranges? The requirement that a geofeed file not
>  be RPKI-signed in order to be shared by multiple INETNUM objects
>  could be relieved were multiple signatures allowed.

do we really want to start work on RFC5485-bis?  but maybe russ has
better thoughts on this than i.

unless told otherwise, i'll hold -07 for a few more reviews.

again, thanks.

randy