Re: BGP-4+

[Curtis Villamizar <[e-mail]>]

In message <[e-mail]>du>, "John W. Stewart III" writes:
> 
>  > > 2) Security Considerations
>  > > 
>  > > BGP-4++ is just as secure or un-secure as BGP-4.  
>  > 
>  > To be more precise the two new attributes do not alter
>  > BGP-4 security properties.
>  > 
>  > > Is it your understanding that users need this security or is
>  > > TCP good enough?
>  > 
>  > I would like to get a feedback from the WG on this question.
> 
> at least one Popular Router Vendor has a feature for
> enabling security for bgp.  my understanding (correct
> me if i'm wrong) is that this is done via crypto-
> checksum of the underlying tcp connection .. which has
> the nice result of protecting the bgp process as well
> as the underlying tcp connection from SYN and RST
> attacks (bgp-only security wouldn't protect the latter)

The NSS did this back in 1992 with BGP3, the auth field, and an MD4
check in each BGP packet.  Today we'd be more likely to use MD5.

> if i were a provider, then i think this would be enough
> for me right now

That's fine.  All we need now is a way to protect against RST.

> idrp provides for its own transport, right? does that
> include anything in the way of security?  i ask to know
> if any already-existing specs with alternatives exist
> 
> /jws

Use IDRP if you prefer.

This reminds me of the "abandon Unix because Mach does X better"
arguments.  Nothing wrong with Unix taking the better ideas from Mach
like copy on write VM semantics and leaving behind those things that
didn't work out as well.

Same with BGP.  There is a lot of excess baggage that needs to be
dumped from IDRP.  It might be better to take the (few) better
features of IDRP and respin BGP.  In other words, IDRP is *not* BGP5.

Curtis