[Idr] Issues with SIDR

["Vishwas Manral" <[e-mail]>]

Hi folks,

As part of the discussion in OPSEC with Stephen Kent and others, I
looked at the SIDR infrastructure as well as soBGP document.

I found easy ways to just get over all the security
infrastructure(PKI) and still being able to do all the attacks as we
can currently. Please have a look at the discussion below and let me
know your comments.

Thanks,
Vishwas

---------- Forwarded message ----------
From: Vishwas Manral <[e-mail]>
Date: Wed, Feb 27, 2008 at 7:13 PM
Subject: Re: [OPSEC] pccw as17557 leak...
To: Stephen Kent <[e-mail]>
Cc: Roland Dobbins <[e-mail]>, opsec wg mailing list <[e-mail]>


Hi Steve,

 Thanks a lot for the comments. I agree it can be a good first step but
 not sure what the future holds.

 I am not sure if a heavy solution like this is required which only
 gives reasonable security. What about the CPU DoS attacks that can be
 result when new random routes are injected into a domain.

 Thanks again,
 Vishwas



 On Wed, Feb 27, 2008 at 7:07 PM, Stephen Kent <[e-mail]> wrote:
 > At 5:12 PM -0800 2/27/08, Vishwas Manral wrote:
 >  >Hi folks,
 >  >
 >  >I looked at the SIDR documents in brief. It can probably be used to
 >  >help prevent any attacks caused due to non-malicious intent.
 >  >
 >  >I found easy ways to get over the SIDR security when done with a
 >  >malicious intent. SIDR just tells the mapping between AFI, AF and AS
 >  >number which can originate the same. However the choosing of a route
 >  >by BGP does not depend on these fields alone. So if a malicious router
 >  >changed the attributes attached to an NLRI update so that it becomes
 >  >the chosen AS to the prefix (of course without changing the
 >  >originating AS field). It can still redirect all the traffic to itself
 >  >for the prefix and then do whatever malicious it wants to do,
 >  >including just drop the packet.
 >  >
 >  >In this way still achieving the attack, but this time for sure with
 >  >malicious intent.
 >  >
 >  >Thanks,
 >  >Vishwas
 >
 >
 >  Your example of how an AS can tamper with a route, without changing
 >  the origin AS assertion is correct. I think the SIDR WG participants
 >  understand that.
 >  The work so far i SIDR focuses on establishing an infrastructure that
 >  will enable more comprehensive routing security capabilities in the
 >  future.  Both the soBGP and SBGP proposal need this sort of
 >  infrastructure, so it is viewed as a reasonable initial effort.
 >
 >  I also agree with your observation that the infrastructure makes it
 >  potentially easier to distinguish between some forms of attacks vs.
 >  accidental routing errors, and that, in itself, seems valuable too.
 >
 >  Steve
 >

_______________________________________________
Idr mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/idr