Re: [Idr] Route Leaks and solutions

[Randy Bush <[e-mail]>]

>>> 1.  Does the IDR WG think Route leaks should be deployed in two modes:
>>> With BGPSEC and without BGPSEC?
>> without bgpsec, is it an attack vector?
> 
> We have tried to address this question in some detail in Section 5.1
> of the updated version:
> https://tools.ietf.org/html/draft-sriram-idr-route-leak-detection-mitigation-01#section-5 
>
> Please let us know if that seems reasonable or would like to add
> anything to that discussion.

my read of 5.1 is that it says, yes, it is a new attack vector.  so we
agree.

you left out the attack where it A's customer uses it to poison a prefix
so that A does not pass it to A's peer B.  there might be others, but i
am on my first cup of coffee.

i am unsure whether these issues are sufficiently critical to discourage
use of rlp bits without bgpsec.  but at least they're coming out in the
open.

randy