Re: [RPSEC] BGP Security Requirements v08

[Curtis Villamizar <[e-mail]>]

In message <[e-mail]>
Joe Touch writes:
>  
> Curtis Villamizar wrote:
> =2E..
> > GTSM is very effective in protecting against certain high volume
> > attacks that would cripple infrastructure protected by cryptographic
> > means alone.  From a practical standpoint GTSM used alone may be
> > inadequate as a solution (though some ISPs might contest even that)
> > but it is a required part of any solution in an ISP environment.
> >=20
> > Curtis
>  
> I agree that DOS attacks benefit from protections that help reduce the
> impact of attack traffic; GTSM falls into that category - it's clearly a
> useful part of a DOS solution, but DOS protection isn't cryptographic
> protection. The bulk of the BGP security requirements document focuses
> on cryptographic issues - not DOS protection. It's worth noting the
> difference, but not lumping the solutions together.
>  
> Joe


Joe,

It would be most accurate most helpful to acknowledge the strengths
and weaknesses of both and then define the limit of scope of your
work.  Cryptographic solutions can provide for protection over an
insecure channel but cannot provide protection against very high
traffic volume DOS attacks.  GTSM protects against very high traffic
volume DOS attacks over a secure channel to a peer but provides no
protection over an insecure channel.  Which approach is appropriate,
or both, depends on the situation.  The scope of your work is
cryptographic solutions.  (Some ISPs have noted that this does not fit
*their* problem space, but it does fit other problem spaces).

So we seem to be in violent agreement about the difference between
crypto solutions and DOS solutions.  Its just a matter of the wording
in the draft not adequately acknowledging the part of the problem
space that is not addressed.

draft-behringer-bgp-session-sec-req-01.txt cites rfc4593 which defines
part of the real world problem.  ISPs might argue that rfc4593 is
silly in the context of a fiber strung across 20 feet of collocation
space that is regularly taken down by DOS attacks and they'd be right.
Its time these security requirements documents acknowledged that.

For the ISP, GTSM protects the BGP peerings.  Packet filtering
protects the IGP if its OSPF (not applicable for ISIS).  Crypto
protection of the session can protect against low traffic volume
internal attacks.  Other applications such as routing in a wireless
battlefield would have different requirements.  We don't need to go
into specifics but both types of attack need to be acknowledged.
Drafts/RFCs describing requirements need to be clear about this and
specify which problem space they are addressing without implicitly
denying that the other problem space exists.

The way the draft reads now is GTSM, TCP/MD5, etc are all "prior work"
and the reader might interpret this to mean that work meeting these
BGP requirements supercede that prior work.  It doesn't state
otherwise and it should.

Curtis


_______________________________________________
RPSEC mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/rpsec