Re: [RPSEC] BGP Security Requirements v08

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>   The protocol MUST support a mechanism ... [to connect islands, sic]
> 
>   The protocol MUST keep authentication information reasonable small.
>   If that information needs to be large in order to be robust, then
>   the protocol SHOULD provide an alternate smaller digest that is less
>   likely to get tossed.
> 
>   ISPs SHOULD try to pass information to non-authenticating peers.
> 
>   ISPs SHOULD prefer information from a subset or trustworthy
>   non-authenticating peer AS with partial authentication covering all
>   less known AS over information where untrusted non-authenticating AS
>   are in the path.
> 
>   Non-authenticating AS should pass the authentication information
>   unchanged unless doing so is infeasible due to router memory
>   constraints.

Maybe this would work?

The protocol SHOULD either either be designed so:

o Non-authenticating implementations will pass the authentication
information without modification.

o The authentication information may be passed between authenticating
implementations outside the BGP protocol.

Would that cover what you're trying to get to?

:-)

Russ

- --
riw@cisco.com CCIE <>< Grace Alone

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGnk/rER27sUhU9OQRAhb+AJ0WPdWfJghpG0l/0pBxJ5E2UcOyXACeNV+G
sobdBs31dQmkGSMWEuQOLso=
=crZa
-----END PGP SIGNATURE-----

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec