Re: [sidr] Keys and algorithms for Updates - feasibility analysis? (was Re: RPKI and private keys)

[Brian Dickson <[e-mail]>]

I was referring to the use of HW-based crypto (which is not cheap), not the
timeframe (5-7 years), as having lack of quantitative analysis on
cost/benefit, cost barrier to entry, or other supporting justification.
The argument that "we can't do the crypto without HW" is circular, when the
argument for crypto is "we can include the HW for crypto in the next
go-around of HW".
If crypto requires HW, the incremental cost needs to be considered, along
with justification that shows that the market will accept and fully adopt
HW crypto universally.
The premise is bgpsec requires universal adoption to have end-to-end
delivery of protection.
The deployment scenario where anything less than the vast majority of ASNs
do bgpsec, quickly devolves to negative cost-benefit.
If the only parties deploying bgpsec are a closed set of peers who already
trust each other and already do TCP-AO (aka MD5), the net benefit is zero.

So, who is going to write up the cost benefit, deployment model (inter-as),
and critical mass required document?
Or the market analysis (how many routers with this will be needed), vendor
survey with committed roadmap (when will this be available, on what
platforms)?
Or the export restrictions limitations to deployment (serious crypto
hardware being deployed to the state-department listed countries?) and/or
alternative vendor support?

Basically, if the assumption is HW crypto, please go the extra mile and
show that this assumption is based on verifiable "stuff", i.e. that this is
not just fantasy.

Brian

On Fri, May 11, 2012 at 4:20 PM, Christopher Morrow <[e-mail]
> wrote:

> On Fri, May 11, 2012 at 3:44 PM, Brian Dickson
> <[e-mail]> wrote:
> > It has been proposed that a roadmap timeframe of 5-7 years is
> acceptable, in
> > order that vendors provide hardware-based implementations. No
> justification
> > for this has been offered, beyond "well, it is common sense".
>
> I believe the timeframes take into account common larger-network
> depreciation rates for equipment.
>  core -> agg -> fastedge -> hinter-lands-edge -> gone
>
> takes ~4-7 years... or so network folk had said (this came out in the
> RAWS WG as well, in 2006)
>
> -chris
>