Re: [RPSEC] BGP Security Requirements v08

In message <469E9735.4080703@cisco.com>
Russ White writes:
>  
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>  
>  
> >>>> o The authentication information may be passed between authenticating
> >>>> implementations outside the BGP protocol.
> >>> Is this practical?  Pass information out of band to every far distant
> >>> BGP speaker rather than just to peers.
> >>>
> >>> This seems to break the "must be scalable" requirement for everything
> >>> related to routing.
> >>  
> >> Aren't the ROAs already being transmitted that way?
> > 
> > The ROAs do not provide authentication information to accompany a
> > packet or that pert of an AS path might be legitimate.  It just serves
> > to verify that a route could be originated at all by a given AS.
>  
> Whether a BGP packet is "authentic" is only a question hop by hop, and
> hence, anything transitive you carry within the packet doesn't help you
> much.
>  
> Whether an AS Path is valid is a long discussion, and we've had it many
> times before. Suffice it to say I believe it's possible in many ways
> without carrying anything in the BGP packet.

I do too but if it involves information using a slow, almost static,
OOB mechanism such as IRR or X.509 based ROA, then it needs some means
of expressing the possible AS adjacencies and the policies applied
over those adjacencies.  If so, we're right back to RPSL.  We might as
well just pick up that work and use a different underlying delivery if
the RPS work was considered unacceptable.

> > If you want to authenticate a routing packet you need a signature over
> > the packet or a digest.  Its fine to then provide the public keys OOB.
>  
> You're treating this like IPsec, where a packet originates at one end of
> a connection, and ends up on the other side of the Internet at the other
> end of that connection. Wrong. There's no way to know if a BGP "packet"
> is "valid," beyond a single hop. You can validate the information
> contained within the packet, but "validating" the packet across
> "multiple hops," is only one possible way to do it.
>  
> :-)
>  
> Russ

Sorry.  Should have said advertisement.

Curtis

> > For example, if the AS Path is A X Y Z and I trust my peer A but not X
> > and Y, the ROA only tells me that its OK for Z to have originated this
> > route and nothing about whether this could have legitimately passed
> > through Y and Z.  An authentication would be Z signature, Y signing
> > that, X signing that, and A passing along the signatures.  If 128
> > bytes are used per signature that is 384 bytes.
> > 
> > OTOH if some OOB mechanism also addressed whether a peering might be
> > legitimate, then requirements would be met.  So maybe its just that
> > the current ROA scheme (or schema) is inadequate.
> > 
> > Curtis
>  
> - --
> riw@cisco.com CCIE <>< Grace Alone
>  
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>  
> iD8DBQFGnpc1ER27sUhU9OQRAtgLAJwO7/Q/n6jjdFLDs/tA93HI74ZFywCgzJXU
> 12xxdMHHt2SAQRX2bAgCSLk=
> =7vX4
> -----END PGP SIGNATURE-----

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec