Re: [babel] babel Digest, Vol 21, Issue 9

[Tony Przygienda <[e-mail]>]

>
> > Network wide keys are useless.
>
> Depends on the size of the network, I guess.
>


>From experience, I would dissuade you from pursuing a "network wide-key
approach" to secure a routing protocol (in terms of node associations, i.e.
adjacencies). Routing protocol is the substrate on which very often things
like X.509 run (or Radius or any other key infra "du jour"). In case you
loose the protocol nodes due to bugs, unexpected behavior, key expiration
and so on you loose the infra and with that you may never recover the
routing since key infra cannot reach the nodes anymore ... Key
roll-over/withdrawal/repudiation are especially tricky.

 Having a distro of keys across the network to provide "path-security",
i.e. I do not only trust my neighbor but trust the whole chain an update
passed is doable but too expensive to bother for routing (well, BGP will
get there eventually I guess) and benefits from a key infra obviously or
rather cannot be run without some kind of key infra.

my 2c

--- tony