Re: [Idr] WG adoption call for draft-abraitis-bgp-version-capability-08, to end September 25

[Robert Raszuk <[e-mail]>]

Hi Jeff,

Very good points.

But I am not sure if they are really applicable here ?

Keep in mind that we are talking about p2p BGP OPEN Msg between PE & CEs
(computes with lot's of machines - bare metal or virtual). Moreover what is
proposed is really informational with little to no bearing into operational
aspects of the subject BGP session.

So while I am all for making right, robust and secure protocol encoding
decisions it seems that especially in BGP we have lot's of other security
holes which if exploited could have a much bigger negative impact.

Regards,
R.

On Wed, Jan 11, 2023 at 12:11 AM Jeffrey Haas <[e-mail]> wrote:

> Robert,
>
> Please note that the points I'm about to make is intended to more broadly
> discuss the URL issue and isn't saying you're making these recommendations.
>
> On Jan 10, 2023, at 5:47 PM, Robert Raszuk <[e-mail]> wrote:
>
> I would like to just highlight one IMHO very cool property hidden in yr
> note ... If we would use URL to carry a pointer to the information the URL
> can be shortened to be a fixed length of a few characters which could be
> really easy to process and presented  to users in a pretty uniformed way
> across any receiver.
>
>
> Before we move forward with any specific shortened-URL proposal, it's
> likely we'll want to get comment from those with expertise in the security
> implications of shortened URLs.
>
> Certainly, many vendors maintain a domain name for shorter URLs for
> various contexts.  That's likely not the main concern.
>
> URL shortening services are probably a Very Bad Idea since they're in an
> entire vector of attacks on their own.
>
> (We also introduce all of the interesting headaches about interaction with
> the PKIX certificate infrastructure.  See my prior comments in the BGP
> autoconfiguration discussions if you're interested.)
>
> One possible mitigation for some of the attacks given the problem to be
> addressed is to permit an IANA registered prefix for the URI/URL.  This
> means rather than carrying a potentially long URL to a specific resource,
> you carry something like the Private Enterprise Number's[1] instance of
> your registered prefix and a suffix portion of the URL.  The rest of the
> data is contained in the structured data at the other side of the expanded
> URL.
>
> I'd encourage Donatas to continue the discussion on such structured data
> before we worry over-much about how to point to it in BGP. :-)
>
> -- Jeff
>
> [1] https://www.iana.org/assignments/enterprise-numbers/
>