Re: [RPSEC] BGP Security Requirements v08

In message <p0624051cc2c286f29523@[128.89.89.71]>
Stephen Kent writes:
>  
> As a "security guy" I would not agree with your opening statement. 
> We usually worry that mixing unverified info with verified info, in 
> any context, is a recipe for trouble, as it encourages folks to 
> accept the mixed info and treat it as verified.  You give an example 
> of ISPs wanting to " ... distinguish their services as having 
> somewhat more reliable routing due to the use of authentication ..." 
> That is precisely the sort of claim most security folks would worry 
> about :-).

As a security guy, you could think of it as a different kind of (not
very good) security across a known reliable ISP or a small set of
known reliable ISPs.  A provider may peer with one or more ISPs who
they know have excellent security practices and whose routing is known
to be fairly robust.  An set of AS with those AS numbers only plus
a set of authenticated AS would be more likely to deliver packets than
an AS Path through unauthenticated AS of unknown reliability.

What we are talking about here is prevention of DOS, not protection of
secrets.  Choosing a path that is extremely likely to be reliable but
not guarenteed to be reliable in practice is clearly an improvement
over choosing any available path.  It is the sole basis of most policy
routing decisions today.

My view on this is we can strive for perfection and get nothing at all
or try to improve the current situation and get the work implemented
with limited deployment in ISPs and due to being implemented the
security community has it and can use it as they please.  My concern
is that with no interest from ISPs it will be hard to get vendors to
implement and it will never get PS status for lack of implementation.

It would be nice to hear from ISPs since I'm not at one.  If memory
serves me, we had two opinions voiced.  One was that some sort of
transitive property across non-authenticated AS was a necessary
feature.  The other was that the storage overhead needed to be
reasonable or ISPs who did not use the authentication would simply
drop the attributes at their peerings.

Curtis

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec