Re: [RPSEC] Discontiguous Deployment (Show of Hands)....

[Tony Tauber <[e-mail]>]

Hi All,

Sorry for the long snooze.

See the new third sentence below and fourth bullet-point after that.
I feel these are only marginal clarifications on what was contextual
received wisdom within the group.  If there are no grave concerns by
week's end, I'll submit the changes.

Thanks,

Tony
----

3.2.  Incremental deployment

    It will not be feasible to deploy a newly secured BGP protocol
    throughout the public Internet instantaneously.  It also may not be
    possible to deploy a such a protocol to all routers in a large AS at
+  one time.  Any proposed solution MUST support an incremental
+  deployment which will provide some benefit for those who participate.
    Because of this, there are several requirements that any proposed
    mechanism to secure BGP must consider.

    o  A BGP security mechanism MUST enable each BGP speaker to configure
       use of the security mechanism on a per-peer basis.

    o  A BGP security mechanism MUST provide backward compatibility in
       the message formatting, transmission, and processing of routing
       information carried through a mixed security environment.  Message
       formatting in a fully secured environment MAY be handled in a non-
       backward compatible fashion though care must be taken to ensure
       UPDATES can traverse intermediate routers which don't support the
       new format.

    o  In an environment where both secured and non-secured systems are
       interoperating a mechanism MUST exist for secured systems to
       identify whether an originator intended the information to be
       secured.

+  o  Proposed solutions MUST provide comment and analysis of what the
+     security services the solution will provide in the case of
+     incremental deployment scenarios (e.g, contiguous islands,
+     discontiguous islands, universal deployment).


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> I would call for a hum, but we can't hear it, of course, on email,
> so.... Please state your answer to the following:
>
> o Discontiguous deployment should be included as a capability any
> proposed mechanism SHOULD have.
>
> o Discontiguous deployment should be included as a capability any
> proposed mechanism MUST have.
>
> o We should say something about discontiguous deployment, but we
> shouldn't attach any requirements to that statement.
>
> o Discontiguous deployment should not be included in the requirements at
> all.
>
> I'd just like to settle where we are, so we can actually work on wording
> with a common understanding of what it is we are trying to actually word.
>
> :-)
>
> Russ
>

_______________________________________________
RPSEC mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/rpsec