[nasr] Re: 回复: Re: Secure Routing Path Consideration- China Mobile-ietf120

[Michael Richardson <[e-mail]>]

刘鹏辉 <[e-mail]> wrote:
    > Toerless etc said there may be stealth L2 device in-between routing as
    > discussed in early emails...

Yes.  There may also be bent fibre.  https://en.wikipedia.org/wiki/Fiber_tapping
That's the same.  We can't prevent it, and may be unable to detect it, (short
of quantum entangled methods).  It presents a capture-now-decrypt-later
attack.

However,
1) We can encrypt everything (MACsec)
2) we can determine the trustworthiness of the end-points
3) we can pick paths where the fibre does not go through adversarial or
insecure routes.

We can prove where traffic went, but we can not prove where traffic did not
go.


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide