Re: Autonomous System Sanity Protocol

[Tony Li <[e-mail]>]

[e-mail] (RADIA PERLMAN) writes:

> BGP is actually somewhat like a link state protocol, in that the entire
> path is given. If each router signs its path to D, then when router R
> chooses among the routes given by each of its neighbors, it chooses one,
> and can preserve that neighbor's signature, and then add its own. So
> there would be a signature for each BGP-hop. I don't think that solves
> too much, though, since the problem is a legitimate router being
> misconfigured rather than having malicious people inject messages.

Exactly so.  What's truly needed is a delegation of authority to advertise
prefixes.  We'd also need a means of verifying that authority.  What Radia
describes is sufficient to guarantee that the path advertised matches
reality, which is necessary if we're out to secure the protocol against
liars and bad guys.  

However, if we assume that the basic protocol machinery is correct and are
out to protect us against ourselves, the delegation problem is the correct
one to solve.  Note that any practical solution probably requires some type
of key management solution already deployed.  One then needs to be able to
see a hierarchy of signed and trusted address space delegations.

Tony