Re: [RPSEC] BGP Security Requirements v08

[Curtis Villamizar <[e-mail]>]

In message <p06240515c2c4060958e4@[128.89.89.71]>
Stephen Kent writes:
>  
> At 12:14 PM -0400 7/18/07, Curtis Villamizar wrote:
> >In message <[e-mail]>
> >"James Ko" writes:
> >> 
> >> 
> >>  Indeed, ideally incoming data should be "authentic" and "verifiable",
> >>  otherwise we are back to square one and this work is no different but to
> >>  give bad guys a window of opportunity to run man-in-the-middle attacks,
> >>  or inject bogus routes.
> >
> >
> >So why does Internet routing work at all today?  Rhetorical question.
> >
> >It does work by the way.  Not always perfectly.
> >
> >Curtis
> >
> >
> >ps - The answer is because the DOS would be short lived and very
> >traceable (ie: not much damage and they'd get caught).  The reason for
> >this is the bogus information would have to be injected from within an
> >ISP and ISP security of their own infrastructure is reasonably good.
>  
> Curtis,
>  
> a few observations:
> 	- as I just noted in a prior response, DoS is not the only issue here.
>  
> 	- the fact that routing does generally work today is not a 
> good basis for deciding on security requirements.  If we turn back 
> the clock a few years we could say that DDoS attacks never happen and 
> thus one need not make provisions to deter such attacks.  As they say 
> in the financial sector "performance data shown represents past 
> performance and is no guarantee of future results" :-).

I think you mean turn back the clock a decade.

DDOS attacks are more than a decade old.  DDOS is exactly the sort of
practical problem that the security theorists ignored while the
Internet practitioners advocated hardenning.  The hardenning had
nothing to do with cryptography and in fact cryptography was
impractical.  The security theorists had a very hard time accepting
this and still do, hence our recent discussion on GTSM.  I can dig up
plenty of back email dating from the mid-1990s on DOS hardenning and
DDOS hardenning and *practial* and *deployable* protection against
injection of false routing information.

> 	- active attacks against BGP sessions are possible. not all 
> BGP sessions make use of extant protection mechanisms like the TCP 
> MD5 checksum, and among those that do there are reports of key 
> management that leave s a lot ot be desired
>  
> Steve

TCP MD5 is of limited value with GTSM and packet filtering being the
preferred methods of providing such protection.  GTSM for EBGP
peerings.  Filtering for IBGP peerings.

I would also point out that GTSM had very strong ISP support
particularly from AOL (Vijay Gill) because it did solve a practical
problem and vendors had no choice but to implement it promptly, even
before the IETF had acted.  In contranst this work may drag on for
(many more) years and (continue to) yield nothing if practical
problems are not addressed.

Curtis


_______________________________________________
RPSEC mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/rpsec