Re: [RPSEC] BGP Security Requirements v08

>...
>
>DDOS attacks are more than a decade old.  DDOS is exactly the sort of
>practical problem that the security theorists ignored while the
>Internet practitioners advocated hardenning.  The hardenning had
>nothing to do with cryptography and in fact cryptography was
>impractical. The security theorists had a very hard time accepting
>this and still do, hence our recent discussion on GTSM.

It seems that you took my reference to DDoS to mean attacks against 
BGP session on routers. I was referring to the broader problem of 
such attacks against subscriber end point or links. In that broad 
context, almost all of what you say above is not accurate:
	- security folks noted this potential for such attacks before 
they occurred
	- ISPs ignored the warnings because they had not seen the attacks
	- the security community generated a lot of papers on the 
topic, some good some bad
	- a few start up companies were created to deliver technology 
to address the problem
	- ...

As for GTSM, yes, it is a simple fix for a class of off-link attacks, 
and there's nothing wrong with that. If ISPs decide to stop there, 
and not also employ crypto-based mechanisms that addresses on-link 
(or, more properly on the same L2 net) attacks, that's a local 
decision based on a perceived threat. However, it still makes sense 
for the IETF to develop such mechanisms, for those ISPs who do choose 
to employ them.

>   I can dig up
>plenty of back email dating from the mid-1990s on DOS hardenning and
>DDOS hardenning and *practial* and *deployable* protection against
>injection of false routing information.

A common theme in your comments is "practial [sic] and deployable." 
There's nothing wrong with those goals, although I would add "secure" 
as well :-). The problem, of course, is getting agreement on what 
constitutes practical, deployable, and secure.

Steve

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec