Re: [RPSEC] BGP Security Requirements v08

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>> Why? Because if you can validate the originator and the first (second)
>> hop (the second entry in the AS Path), then you have a good bit more
>> assurance the destination is valid/etc, than if you just drop this
>> information out.
> 
> As many people have said (I recall particularly Danny McPherson at NANOG),
> a deliberate attack would just take the valid initial info and add
> invalid info to it.  So it is best to be cautious about the good bit
> more assurance.

Right--the more information you have, the more assurance you have. Just
the origination authorization is easy to fool. Including the second AS
in the AS Path (the first hop) makes it harder to fool but still not
impossible. As you add more path information, you add more assurance.

So, I would say it's not an "all or nothing" affair, and retaining
information through a non-supporting AS is useful.

:-)

Russ

- --
riw@cisco.com CCIE <>< Grace Alone

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGlO0QER27sUhU9OQRAj2/AJoCXvR21xQSZCpHldM+A1O2smkYRQCgjKnJ
Oboutp1yYLSfCP15JIXTW84=
=m8hQ
-----END PGP SIGNATURE-----

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec