Re: [RPSEC] BGP Security Requirements v08

At 9:26 PM -0400 7/13/07, Curtis Villamizar wrote:
>...
>
>
>I think most of the WG is comfortable with this and is insisting on
>it.  How many times do we need to go in circles on this?  Once every
>IETF meeting?

You may be right. Hoqwever, I appear to be the primary (only?) person 
who reads each draft and provides comments and edits to Tony, so I'm 
don't think that the WG consensus has been established, at least not 
through the editing process.

>...
>>  >2. Is information about the validity of an AS path useful to AS' on the
>>  >"other side" of a non-supporting AS?
>> 
>>  because there may be no way to verify the number, much less the
>>  identify of ASes listed in an UPDATE between the end of the secured
>>  path and the current AS, the utility of the passing that data beyond
>>  the end of the secured part of the path is questionable.
>
>
>The real world problem is that this is the best you are going to get
>for attempts to use any such mechanism on most of the Internet at
>least during early deployment which might be many years or longer.
>There is no sense defining a protocol which won't get deployed.  If
>you do there is a good chance it won't be widely implemented - or
>implemented at all without someone throwing big money at it.  So even
>if the application you have in mind would never trust information from
>another island, you need this capability to have some chance that the
>protocol you define will get widely implemented and eventually
>deployed in enough places to start to gather critical mass.
>
>A bit of optimism maybe.

Sorry, Curtis, but I don't understand your reasoning above.

I think we all want to establish requirements for a protocol that 
will be widely deployed, and agree that deployment will be a long 
time coming.

I think the question is why, if the path info received by an "island 
AS" has a number of unverified hops, is this path info useful, in a 
security sense, to the AS that receives? How does the requirement to 
send such info promote adoption of the protocol?

Steve

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec