Re: [RPSEC] BGP Security Requirements v08

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Curtis Villamizar wrote:
> In message <4697224A.5050901@isi.edu>
> Joe Touch writes:
>>  
>> Curtis Villamizar wrote:
>> =2E..
>>> GTSM is very effective in protecting against certain high volume
>>> attacks that would cripple infrastructure protected by cryptographic
>>> means alone.  From a practical standpoint GTSM used alone may be
>>> inadequate as a solution (though some ISPs might contest even that)
>>> but it is a required part of any solution in an ISP environment.
>>> =20
>>> Curtis
>>  
>> I agree that DOS attacks benefit from protections that help reduce the
>> impact of attack traffic; GTSM falls into that category - it's clearly a
>> useful part of a DOS solution, but DOS protection isn't cryptographic
>> protection. The bulk of the BGP security requirements document focuses
>> on cryptographic issues - not DOS protection. It's worth noting the
>> difference, but not lumping the solutions together.
>>  
>> Joe
> 
> 
> Joe,
> 
> It would be most accurate most helpful to acknowledge the strengths
> and weaknesses of both and then define the limit of scope of your
> work. 

Agreed...

> So we seem to be in violent agreement about the difference between
> crypto solutions and DOS solutions.  Its just a matter of the wording
> in the draft not adequately acknowledging the part of the problem
> space that is not addressed.

Agreed!

...
> The way the draft reads now is GTSM, TCP/MD5, etc are all "prior work"
> and the reader might interpret this to mean that work meeting these
> BGP requirements supercede that prior work.  It doesn't state
> otherwise and it should.

Yes - that's the sort of thing I'm hoping to address in a brief paragraph.

Joe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGl6rJE5f5cImnZrsRAnOpAJ998nCytW9y2YMhdb7bZaCgwOS6pwCeKQqh
JfW0JgqK0flx+06hGhgjiyU=
=chEy
-----END PGP SIGNATURE-----

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec