RE: [RPSEC] Re: draft-convery-bgpattack-00

On Wed, 6 Nov 2002 sandy@tislabs.com wrote:

> >IMHO - "Security requirements" that force Internet capital spending and
> >network wide maintenance windows to deploy are not going to be adopted by
> >the operations community.

> Not a surprising development and reminiscent of the auto manufacturers'
> stance on seat belts, crash resistent bumpers, air bags, ...  Those whose
> focus is the bottom line always want to be shown a financial incentive.
> "How about 'survival'?" seems to be unpersuasive.

Routers are a lot like regular computers in many ways, but you can only
expect to sell a very small number compared to computers. I'm not a
router builder but I think that's the reason why router CPUs are so slow
compared to those of regular computers: the design costs to keep up with
the latest CPU technology would be too high.

As far as I can tell, verifying a signature takes in the order of a
millisecond on a decent CPU. So with 115,000 routes in the global
routing table, that's 2 minutes to initialize BGP, assuming one
signature must be checked per route. I don't think this is acceptable,
especially not considering router CPUs may be slower, there is other
processing to do as well and the expected growth of the global routing
table. This means routers must be equipped with crypto modules.

Then there is memory. There are still many routers in production that
are already in trouble memory-wise as their design allows only 32, 64 or
128 MB and a Cisco needs 256 MB to comfortably run BGP. I've tried to
add up all the extra fields but I couldn't be sure how much of what goes
where, but it looks like S-BGP will take at least twice the memory of
regular BGP.

This means some routers must be replaced completely and all others need
hardware upgrades. So expect resistance from the people who have to pay
the bill. Especially if there is so much of a byte wasted in your packet
formats, or there is a place where crypto is used when the same result
could be obtained without it.

Also note that the perceived need for more security in BGP can't be all
that high, as we can tell by the level of MD5 option deployment.

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec