Re: [RPSEC] BGP Security Requirements v08

At 11:55 AM -0400 7/17/07, Sandy Murphy wrote:
>...
>Steve, I strongly believe that incremental deployment scenarios WILL
>include cases where non-upgradable ASs will be provided with other,
>operational or algorithmic, protections, so that ISPs in the know will
>trust paths that come to them from those ASs.  I am less strongly
>convinced that incremental deployment scenarios MUST include such cases.
>But I see no way to provide benefit in incremental deployment otherwise.

Incremental deployment in ASes that are adjacent to one another 
offers  advantages, and I think one cannot rule out scenarios in 
which adjacent ASes deploy an enhanced version of BGP.

>I do not think that you are saying that solutions COULD NOT provide
>benefit when island hopping.  The work being done in the sidr wg
>(to provide an infrastructure that would provide authorization for
>prefix origination) would be an example of protections that would
>still provide benefit when island hopping, as the origin authorization
>check is of value no matter how many clueless ASs touch the UPDATE.

True, the SIDR work will make origin AS authorization data available 
to every ISP by virtue of publishing ROAs. However, it does so 
without passing ROA data via BGP, so the non-adjacency issue does not 
apply in this case.

>I believe that you are arguing whether solutions should be REQUIRED
>to provide benefit when island hopping.  And Curtis is arguing that
>they should, because otherwise incremental deployment will be very
>very unattractive.
>
>The choices seem to boil down to MUST or SHOULD.

Or a MUST/SHOULD vs. MAY.

Steve

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec