<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div><div>On Feb 15, 2011, at 7:40 PM, Andrew Alston wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<div>
<!-- Converted from text/plain format -->
<br><p><font size="2">>> Hi Guys,<br>
>><br>
>> While I was considering developing a policy proposal around RPKI in Africa,<br>
<br>
> What is the problem statement for the policy ??<br>
<br>
The problem is RPKI in its current form, and myself, like many others I have spoken to around the world are opposed to its current form and implementation because of the dangers it creates.</font></p></div></blockquote><blockquote type="cite"><div><p><font size="2"> I am prepared to go as far as saying, that unless there are a lot more assurances given about ways to prevent interference from political entities, I will propose a statement of rejection of RPKI from the African community.<br></font></p></div></blockquote><div>hmmm. RPKI is global security framework in which RIRs only issue certificates covering allocations they made and publish/maintain repository. What you do with the certificates is not really RIRs business.</div><div><br></div><div>So what will your policy of rejection say? "Do not issue the certificates"? or "Do not use the certificates to routing purposes" ?, etc......</div><div><br></div><div>Is this a matter of policy ? i doubt.</div><blockquote type="cite"><div><p><font size="2">
<br>
> I figured before I attempt that one, and its a bit of a minefield, I'd like<br>
> to open some discussion on the list about RPKI.<br>
<br>
<br>
> Great. We also have <a href="mailto:rpki-discuss@afrinic.net">rpki-discuss@afrinic.net</a> for RPKI related discussions.<br>
<br>
>> A.) When a government declares that ISP X must be turned off, and issues<br>
>> AfriNIC with an order to turn them off, that is generated in a court in the<br>
>> country that the ISP resides in, how is AfriNIC planning on responding.<br>
<br>
> Not a RPKI issue<br>
<br>
Very definitely an RPKI issue. At this point, if governments want to shut off ISPs they have to go after each ISP individually and actually force the ISP to do something. With RPKI there is a potential situation where they can come after the ISPs VIA the RIR, and the get the certificates revoked at the RIR, dropping the ISP off the face of the net without even talking to the ISP. That is DEFINITELY an RPKI issue.<br></font></p></div></blockquote><div><br></div><div>different reasons(payment, issues with the RSA, etc....) can lead to membership closure and resource revocation and with RPKI, certificate revocation. So my point here is that the issue is about legal aspects of the INRs management: governments/local laws implications in the INRs management.</div><div><br></div><div>So if governments or courts decisions have to be executed by AFRINIC, then RPKI certificate will just follow the implementation. So fix that and don't blame RPKI.</div><div><br></div><div>Without RPKI:</div><div><br></div><div>1- close membership</div><div>2- remove your numbers from the whois/IRRs</div><div>3-inform the world of the illegality of the routing of your former prefixes</div><div><br></div><div>with RPKI:</div><div><br></div><div>1-close membership</div><div>2- remove your numbers from whois/IRRs</div><div>3- revoke your Certificate</div><div>4- inform the world of the illegality of the routing of your former prefixes</div><div><br></div><div><br></div><div>NB:routing and other filtering decisions are made elsewhere.....</div><div><br></div><blockquote type="cite"><div><p><font size="2"><br>
>> B.) With the acceptance of RPKI we effectively allow outside forces to<br>
>> control the issuing and revocation of IP space,<br>
<br>
> Nope. RPKI reflects what AfriNIC members and allocations databases say. If you are member and have resources, you will have a<br>
> RPKI certificate to say so.<br>
<br>
In an ideal world, are you telling me that AfriNIC will give guarantees that under court order they will not withdraw certification of a route to shut down an ISP if a meddling political entity tries to force it? Are you really telling me there is no danger here? Sorry... gonna need a lot of convincing to believe that one.<br>
<br>
<br></font></p></div></blockquote><div>political interferences in the INR management as in many aspects of the NET is a potential danger. So we shall be careful and deal with them as much as possible, and not stop technologies needed to make the NET more reliable, secure, etc..... </div><blockquote type="cite"><div><p><font size="2">
>> and if we look at the<br>
>> actions taken recently in Tunisia, Egypt and rumour has it now in Algeria,<br>
>> is this really a road we want to walk down?<br>
<br>
> Nobody wants to go there. Open and free access to the Internet should a goal for every net citizen.<br>
<br>
No sane person wants to go there, governments and the powers that be can be far from sane. RPKI gives them a method to exercise this insanity unless we are extremely careful. I seek reassurances that we have ways to address these issues. At this point, as pointed out here, and as pointed out by a LONG mail thread on NANOG, there are others that share the concern that we are creating a huge "internet kill switch", and this I have to oppose. Once RPKI starts being used for "negative" testing of routes, I.E, no cert, no route, we develop a major problem. Further more, part of the redundancy and the reliability of the Internet is based in its highly distributed nature, RPKI seriously reduces this and makes it reliant on a number of smaller authorities. This is not something that I can see happen without serious objection.<br>
<br></font></p></div></blockquote><br></div><div>Route validation or other filtering will always be a local policy decision:</div><div><br></div><div>"No Cert: no route" is an option</div><div><br></div><div>"CERT: route, CERT: route more trusted" could be another one.</div><div><br></div><div><blockquote type="cite"><div><p><font size="2"><br>
<br>
>> C.) Has AfriNIC done any work with regards to RPKI to prepare for if this<br>
>> does become a reality?<br>
<br>
> For the RPKI, we have a CP and CPS and are looking at the legal related aspects with the Legal adviser. This does include Legal > aspects on the Internet Number resources management.<br>
<br>
I am glad to hear there are legal opinions being sort on this, and I would like to hear opinions from the legal side on this. I can tell you that before we walk down the RPKI route, I wouldn't feel comfortable without having our own legal council take a serious look at this as well.<br>
<br>
>><br>
>> Right now, I see the world discussing RPKI as a solution for IP hijacking,<br>
>> which is likely to become far more commonplace now that IP space is running<br>
>> out, at the same time, I see us being years away from RPKI implementations.<br>
>> (There is no code in the routers to support this yet,<br>
<br>
> you can just use the RPKI objects to generate filters for routers for now.<br>
<br>
If you do negative route testing right now with RPKI objects you'd end up filtering 99% of the table, we're a long way from that being viable</font></p></div></blockquote><blockquote type="cite"><div><p><font size="2">
>> there are immense<br>
>> technical and political hurdles to be crossed, and its a fundemental change<br>
>> to the way the Internet actually operates and in my opinion a grave threat<br>
>> to the autonomy of ISPs). <br>
<br>
> I thought you were in favor of solutions for IP hijacking and BGP threats :-)<br>
<br>
You thought correctly. I am in favor of solutions that prevent IP hijacking and BGP threats, including but not limited to, a complete overhaul of the current IRR system (which I believe if implemented properly on a global scale would solve half the problems RPKI is supposed to address). I am NOT in favor of creating a mechanism that allows for political and other outside entities to influence the reachability of independent ISPs. Nor am I favor of creating mechanisms that reduce the highly distributed nature of the internet that lends it the current level of redundancy and reliability.<br></font></p></div></blockquote><div><br></div><div>RPKI is not replacing or killing IRRs. Improving the IRRs to get it solved half of what RPKI is intended to do will be a good move. On the way, we will see many other options of solving the problems and not only RPKI.</div><div><br></div><div>What will think of using a DNSSEC-enable RDNS to publish what we need ? Aie !!!!! i forgot: DNS is hierarchical and in the RDNS, you need delegations from RIRs and RIRs may be under governments pressure:-) </div><blockquote type="cite"><div><p><font size="2">
<br>
It was once written (and forgive me, I forget who said it), that the internet is the worlds largest and more successful demonstration of anarchy that exists. Some people don't like that, but the fact is, it works. Go down the RPKI route as it is currently being discussed, and we walk down a road where the control is transferred to a few and we lose this.<br>
<br>
Pray tell as well, what happens if one of the root issuing systems is compromised? Do we really want to risk that? <br>
<br>
Anyway, this is an academic debate at the moment, and I am not saying that I am beyond being convinced that this is the right way to go, but call me highly skeptical and highly cynical, but at the moment, looking at this system as I understand it, I consider this one guilty until proven innocent.<br></font></p></div></blockquote><div><br></div><div>On the general, does the "non RPKI situation" really defeat governments actions on shutting down ISPs ? Will an ISP continue to operate in a country with a government/courts decision which deny that ?</div><div><br></div><div><br></div><div>We all share your concerns, but with different perspectives :-)</div><div><br></div><div><br></div><div>--alain</div><br><blockquote type="cite"><div><p><font size="2">
<br>
Just my 2c<br>
<br>
Andrew<br>
</font>
</p>
</div>
</blockquote></div><br></body></html>