Re: [secdir] Secdir review of draft-ietf-sidr-origin-validation-signaling-09

[Randy Bush <[e-mail]>]

> This is quite short draft explaining how to transmit prefix origin
> validation state over BGP. Its security considerations section say:
> 
>    This document introduces no new security concerns beyond what is
>    described in [RFC6811].
> 
> I think this is mostly correct, but I also think that there might be
> also new security considerations when you are not doing prefixi origin
> validation yourself, but you are trusting someone else to send you
> that information. I.e. you need to know whether the sender should be
> trusted to send that information and how the BGP information is
> protected from tampering (on the other hand if you trust BGP
> information from untrusted sources, or allow attackers to modify BGP
> messages, you most likely have more serious issues :-)
> 
> Adding that kind of text to the security considerations section would
> be needed.

well said.  outsourcing security is a tenuous method and needs to be
flagged.

i do not hold the pen, otherwise i would fix.

randy