Re: BGP-4+

[Brad Smith <[e-mail]>]

> I think you need to re-focus your question. What are you trying to protect?
> a. RST-attachs to BGP sessions and such, including spoofing of BGP data?
>    IPSEC-AH will fix that in an exportable manner..
> b. People knowingly and willingly injecting false routes (such as host route)
>    to play games with traffic?
>    That's a much harder problem and IMHO that would be out of scope for
>    BGP4++
> 
> I think you'll get more useful answers if you post your questions that way.
> What do others think?

I agree.  Addressing (a) is pretty straight-forward and protects you from
"outside" attackers (masquerading speakers, unauthorized speakers, and
subverted links).  Addressing (b) is non-trivial and protects you from
subverted speakers.  (a) is pretty well understood, with reasonably effective
and efficient solutions available; (b) is less well understood, and there are
no adequately efficient solutions available.

Asking if secure TCP or similar mechanisms is sufficient for addressing
the threat (a) is straight-forward (I'd answer yes; I'd also be interested
in seeing an analyisis of how IPSEC accomplishes the same goal... although
the claim that it does sounds right to me).  The same question for (b)
would be answered no.

Brad