Re: [secdir] New Routing Area Security Design Team

[Jeffrey Haas <[e-mail]>]

> On Apr 16, 2018, at 9:54 AM, Richard Barnes <[e-mail]> wrote:
> On Mon, Apr 16, 2018 at 9:38 AM, Russ White <[e-mail] <mailto:[e-mail]>> wrote:
> Until the IETF starts listening to folks beyond BGPSEC supporters, and rethinks what needs to be solved, the IETF will continue to play essentially no role in moving any solution for this problem forward. Hint: ensuring the "proper operation of BGP" is not a good starting point. 
> 
> I'm fully willing to admit that there has been some intransigence on the security side of things.  And I'm not trying to argue for BGPSEC in particular, but for solving the problem.
> 
> However, the messages in this thread make me think there's not really a willingness in the routing community to engage seriously in the problem either.

What I believe you're seeing is at least two veterans of the bgp security war saying they've done enough bleeding on that specific topic for a little while. 

>   Security mechanisms exist to enforce invariants, so if you're not willing to concede that BGP should adhere to some invariants (which is how Jeffrey's bullet points read to me), then you're never going to be able to meaningfully secure the protocol, and we should publish an RFC that says "here's the security properties you can expect of BGP lolz #YOLO CAVEAT ROUTOR" -- like RFC 4272, but more honest.

More emphasized below.  However, we didn't approach this as "let's secure BGP".  Matter of fact, BGP wasn't even what we were here to talk about.  Yet that's all this thread has devolved to.

> So maybe this group needs a more focused title :)

My opening message was "this group is mis-chartered". :-)

>   Because as this thread demonstrates, when you say "Routing Area Security", people are going to think you're going to solve actual problems with the security of routing, not just better transport security -- which really has nothing to do with routing, it's just securing the routing protocol as an application.

Bingo.

If you want more ocean boiling, let's do that later on.  For now, we have narrower work we'd like to focus on.  We believe it'll have value to the overall IETF community and should make part of the security review of RFC targeted documents easier.

> How about "Better Routing Application Transport Security (BRATS)"?  ;)

Only if we get our own line of dolls.

-- Jeff