RE: [RPSEC] Re: draft-convery-bgpattack-00

On Thu, 7 Nov 2002, Joel M. Halpern wrote:

> It seems this overlooks several things:
> A) The indications are that operators are not interested in (or possibly
> even capable of) deploying solutions with this complexity

Good point. Also, this is very much a double edged sword: on the one
hand, the expensive crypto checks validate that what's in the routing
tables is good, but on the other hand they'll keep out stuff, and
certainly not all of what they'll keep out will be bad. If I look at the
way routing registry entries are maintained today, I expect the first
few networks that implement this will suffer from noticably degraded
connectivity to the rest of the world.

> B) We could probably get a lot of coverage (but not as complete) with a
> much simpler solution or set of solutions.

Agree. I think soBGP is much better than S-BGP in this regard, but both
of them are stuck on a track that I think is wrong for this: the source
provides information to the router, and the router validates this
information using cryptographic means. This is a good approach if the
information the source will be providing can't be checked by other
means. However, that is not the case here: it is possible to collect the
information about what the source may be announcing beforehand, and then
simply check the actual announcement against this information. This way
the routers don't need to do any crypto.

> C) Securing BGP this carefully when the rest of the infrastructure is
> completely insecure seems almost counter-productive.

> Note that currently many operators do not deploy source address filtering,

Which is indeed a big problem as it makes very hard to trace DoS attacks
possible. These happen every day, and many ISPs don't do very little to
stop it. Routing attacks are rare enough that I've never heard anyone
say they encountered one. I don't doubt Randy's remark that there have
been some, but the fact that the victims don't want to talk about it
makes me assume the attacks could probably have stopped using today's
technology.

However, just because there is problem A doesn't mean you shouldn't do
anything about problem B. It's not like work on routing security will
take away time from installing anti-spoofing filters.

> or even martian address filtering with their customers.

Martian filters aren't a good idea as they remove some symptoms but not
the cause. If someone doesn't filter, I like seeing those packets from
192.168.0.0/16 to inform me of this fact.

Iljitsch

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec