Re: [RPSEC] BGP Security Requirements v08

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>>>> o The authentication information may be passed between authenticating
>>>> implementations outside the BGP protocol.
>>> Is this practical?  Pass information out of band to every far distant
>>> BGP speaker rather than just to peers.
>>>
>>> This seems to break the "must be scalable" requirement for everything
>>> related to routing.
>>  
>> Aren't the ROAs already being transmitted that way?
> 
> The ROAs do not provide authentication information to accompany a
> packet or that pert of an AS path might be legitimate.  It just serves
> to verify that a route could be originated at all by a given AS.

Whether a BGP packet is "authentic" is only a question hop by hop, and
hence, anything transitive you carry within the packet doesn't help you
much.

Whether an AS Path is valid is a long discussion, and we've had it many
times before. Suffice it to say I believe it's possible in many ways
without carrying anything in the BGP packet.

> If you want to authenticate a routing packet you need a signature over
> the packet or a digest.  Its fine to then provide the public keys OOB.

You're treating this like IPsec, where a packet originates at one end of
a connection, and ends up on the other side of the Internet at the other
end of that connection. Wrong. There's no way to know if a BGP "packet"
is "valid," beyond a single hop. You can validate the information
contained within the packet, but "validating" the packet across
"multiple hops," is only one possible way to do it.

:-)

Russ

> 
> For example, if the AS Path is A X Y Z and I trust my peer A but not X
> and Y, the ROA only tells me that its OK for Z to have originated this
> route and nothing about whether this could have legitimately passed
> through Y and Z.  An authentication would be Z signature, Y signing
> that, X signing that, and A passing along the signatures.  If 128
> bytes are used per signature that is 384 bytes.
> 
> OTOH if some OOB mechanism also addressed whether a peering might be
> legitimate, then requirements would be met.  So maybe its just that
> the current ROA scheme (or schema) is inadequate.
> 
> Curtis

- --
riw@cisco.com CCIE <>< Grace Alone

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGnpc1ER27sUhU9OQRAtgLAJwO7/Q/n6jjdFLDs/tA93HI74ZFywCgzJXU
12xxdMHHt2SAQRX2bAgCSLk=
=7vX4
-----END PGP SIGNATURE-----

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec