Re: [mpls] Poll to see if we have consensus to adopt draft-farrelll-mpls-opportunistic-encrypt as an MPLS wg document

[Stephen Farrell <[e-mail]>]

Eric,

On 01/07/15 16:53, Eric C Rosen wrote:
>

I'll skip over the speculative negative rhetoric about security ADs:-)

> 
> It would certainly be interesting to hear from operators whether they
> think there really is a need for "opportunistic" security as opposed to
> PKI-based security, especially given the way that some of the evolving
> BGP security schemes seem to be relying on PKI-based techniques.  

That would be interesting yes, though its not actually at all about
whether one does or does not use a PKI. (A PKI could easily be used
to authenticate the keys belonging to endpoints implementing this
draft - that's an entirely straight forward option one could define
in a few minutes.)

But if one looks at the complexity of the RPKI and contrasts that with
this draft, there is a real divergence in approaches for sure. RPKI
is v. complex but aims to be comprehensive, has taken a long time to
develop and more to start deployment and may need to achieve
significant deployment before its most appealing benefits accrue.
The reason for that isn't the PKI in the RPKI name, but I think the
fact that it's main aim is to provide authentication and authorization
for the entire routing infrastructure.

This approach tries to be much more light weight and focus on ease
of deployment as and where beneficial but without trying to meet
every potential need.

My experience of security protocols is that the approach we're trying
to follow here is more likely to lead to useful deployment. But that
experience may or may not be replicated in this space, I'm not sure.

S.