Re: Autonomous System Sanity Protocol

[Noel Chiappa <[e-mail]>]

<My apologies to the IETF list for getting into routing grup, but I can't
 allow these erroneous statements to go uncorrected.>

    From: Pedro Marques <[e-mail]>

    > use of public key cryptography can prevent anyone else from originating
    > bad information about connectivity inside or to X

    s/map/BGP route/g
    ... and everything you said still holds.

No. There is a fundamental difference. 

If I'm X, I know, *authoritatively and definitively*, who is attached to me.
I can then originate this information and sign it, in the form of map element
information ("Hi, I'm X, and I'm attached to A, B and C, and here's the seal
for that, encrypted with my private key".) You can use the concatentation of
all such data (modulo, as I said, issues like people co-operating to lie
about non-existent connections) to produce routing which is resistant to
single-point failure and/or malice.

However, in a destination vector system, such as BGP, X cannot know,
authoritatively, the details of connectivity elsewhere. That means that Y can
pass on to Z information about a route which Y has to X, and there is no way
for X to sign *that* data, or even to verify that it is correct.

(Extra detail, ignore if you don't care: Saying you can recursively sign the
route doesn't help, I don't think - you can strip off later elements and work
with a partial, and fully signed, route. In other words, if I get a route to
X which is Z->Y->X, it *can't* be the case that when Z signed it, he only
signed an indivisible composite - if so, how can you check that the Y->X
portion is legitimate, and not something Z made up? You have to be able to
check the Y->X component, and the X source, separately - and if you can do
that you can snarf the Y->X component and discard the Z component.)

Please think about the issues some, and study Radia Perlman's PhD thesis,
(where you will find it all laid out) before claiming that the two are
equivalently protectable, when they are not.

Connectivity information is *fundamentally* different from *reachability*
information.

	Noel