Re: [RPSEC] BGP Security Requirements v08

In message <469E65F7.8010509@cisco.com>
Russ White writes:
>  
>  
> >> o The authentication information may be passed between authenticating
> >> implementations outside the BGP protocol.
> > 
> > Is this practical?  Pass information out of band to every far distant
> > BGP speaker rather than just to peers.
> > 
> > This seems to break the "must be scalable" requirement for everything
> > related to routing.
>  
> Aren't the ROAs already being transmitted that way?
>  
> :-)
>  
> Russ

The ROAs do not provide authentication information to accompany a
packet or that pert of an AS path might be legitimate.  It just serves
to verify that a route could be originated at all by a given AS.

If you want to authenticate a routing packet you need a signature over
the packet or a digest.  Its fine to then provide the public keys OOB.

For example, if the AS Path is A X Y Z and I trust my peer A but not X
and Y, the ROA only tells me that its OK for Z to have originated this
route and nothing about whether this could have legitimately passed
through Y and Z.  An authentication would be Z signature, Y signing
that, X signing that, and A passing along the signatures.  If 128
bytes are used per signature that is 384 bytes.

OTOH if some OOB mechanism also addressed whether a peering might be
legitimate, then requirements would be met.  So maybe its just that
the current ROA scheme (or schema) is inadequate.

Curtis

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec