Re: [sidr] I-D Action: draft-ietf-sidr-usecases-03.txt

Danny McPherson <> Mon, 02 April 2012 01:22 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id B9E9411E80AE for <>; Sun, 1 Apr 2012 18:22:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -100.74
X-Spam-Status: No, score=-100.74 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 77Pvvjlcc2Hq for <>; Sun, 1 Apr 2012 18:22:18 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 4953A11E80AD for <>; Sun, 1 Apr 2012 18:22:18 -0700 (PDT)
Received: by (Postfix, from userid 0) id E536526806D; Sun, 1 Apr 2012 19:22:17 -0600 (MDT)
Received: from new-host-4.home ( []) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by with SMTP; for; Sun, 01 Apr 2012 19:22:17 -0600 (MDT) (envelope-from
X-Avenger: version=0.7.8;; client-ip=; client-port=49864; syn-fingerprint=65535:48:1:64:M1460,N,W3,N,N,T,S MacOS 10.4.8; data-bytes=0
Content-Type: text/plain; charset="iso-8859-1"
Mime-Version: 1.0 (Apple Message framework v1257)
From: Danny McPherson <>
In-Reply-To: <>
Date: Sun, 01 Apr 2012 21:22:02 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <> <> <>, <> <>
To: " list" <>
X-Mailer: Apple Mail (2.1257)
Subject: Re: [sidr] I-D Action: draft-ietf-sidr-usecases-03.txt
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Secure Interdomain Routing <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 02 Apr 2012 01:22:18 -0000

On Mar 31, 2012, at 12:12 AM, Murphy, Sandra wrote:

> Origin validation is strictly and only judging whether the origin has the authority to originate announcements of the prefix.  Origin validation does not ensure that the authorized AS is actually making the announcement.

Indeed!  It's not actually "validation" at all, it's more "policy enforcement".  I.e., is the origin AS in the AS_PATH of the received update an origin AS that the resource holder said was "authorized" to originate the prefix in question.

I suppose it's really no different than static AS filter lists except that rtr-rpki is router-wide and storage is soft-state (akin to ORF, though it's in-band per-peer, or flow spec, for that matter) v. persistent static configuration most folks employ today for policy.

> It is bgpsec path validation that ensures that the announcement is currently and authentically being announced by the AS.  That's the "signed injection" you mention.

This reminds me -- we don't have a signing certificate and validation certificate router on-boarding protocol defined yet for BGPSEC (I assume rtr-rpki is the basis, though it currently does not support this), I think we need to begin working that out sooner rather than later as I suspect the operational implications are far more complex and they will markedly impact RPKI system design as well.

Finally, to R.'s point in a different thread:

"If that would not be enough BGP is soon to become completely "hard state" if one would implement"

I suspect we're going to end up with draft-foo-rtr-rpki--proto-persistence-* at some point as well (or we could use BGP itself for on-boarding RPKI data :-)