Re: [secdir] New Routing Area Security Design Team

[Christian Huitema <[e-mail]>]

On 4/13/2018 4:51 PM, Jeffrey Haas wrote:

> The initial motivation to start this was the further "what do we do
> about tcp-md5" that the MPLS protocols are dealing with now.  And
> further, it's a bit about how to reduce the frustrating dance we have
> between routing (and other areas?) and security-focused groups during
> the RFC process.
>
> See my slides I did for IEPG to give an idea of some of what at least
> I think we'd like to see come out of this:
>
> http://iepg.org/2018-03-18-ietf101/haas-iepg-101.pdf

So basically you are debating which protected transport to use for
routing protocols. That's certainly an issue that needs solving, but it
has a feeling of focusing on the solution before debating the problem.
As Richard said, the headline issue for outsiders like me is BGP
hijacking, whether as a mean to hijack addresses and inject spam, or as
a way to detour Wall Street's traffic through Belarus. It seems that the
first step in router security would be to analyze these attacks, from
BGP hijacking to the control plane attacks that you mention. Replacing
TCP-MD5 by TCP-AO or DTLS may be part of the solution, but the problem
is bigger than that.

-- Christian Huitema