Re: [sidr] Route Leak fix: V free routing

Brian Dickson <brian.peter.dickson@gmail.com> Tue, 22 November 2011 16:50 UTC

Return-Path: <brian.peter.dickson@gmail.com>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A59B91F0C3D for <sidr@ietfa.amsl.com>; Tue, 22 Nov 2011 08:50:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.496
X-Spam-Level:
X-Spam-Status: No, score=-3.496 tagged_above=-999 required=5 tests=[AWL=0.103, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id llo3aBzGJTIi for <sidr@ietfa.amsl.com>; Tue, 22 Nov 2011 08:50:53 -0800 (PST)
Received: from mail-bw0-f44.google.com (mail-bw0-f44.google.com [209.85.214.44]) by ietfa.amsl.com (Postfix) with ESMTP id 382A01F0C3C for <sidr@ietf.org>; Tue, 22 Nov 2011 08:50:52 -0800 (PST)
Received: by bkbzv15 with SMTP id zv15so43570bkb.31 for <sidr@ietf.org>; Tue, 22 Nov 2011 08:50:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=1xYS+B+ZqylrflcV06//5Pb2+jHv6y5cvmWErBV99k8=; b=Ksk+Mr9Od0SoIvHJEodiOt1118atJEPQ/kEJDV9U8lP3hB1o1dTgO0qQ7Xw9qQ9oEE t+RFDttr6asiiBxC0h76s85IQoC4UZbgzlN9hWEL5+vT7vVhaArnStXxSQF+6rQbL32H jo1s0c/Hett94t5VcuEmhszJ/noHFV9bkVppM=
MIME-Version: 1.0
Received: by 10.204.0.82 with SMTP id 18mr2009859bka.86.1321980648483; Tue, 22 Nov 2011 08:50:48 -0800 (PST)
Received: by 10.223.143.8 with HTTP; Tue, 22 Nov 2011 08:50:48 -0800 (PST)
In-Reply-To: <m2aa7onudn.wl%randy@psg.com>
References: <F45661E8FBC74F4EB7E1E0386B562A7502B85C80@ftrdmel0.rd.francetelecom.fr> <CAEFE521.704A0%dougm@nist.gov> <m2aa7onudn.wl%randy@psg.com>
Date: Tue, 22 Nov 2011 11:50:48 -0500
Message-ID: <CAH1iCipJPGHLzLsUnAK1r0+KY-sEvVQNZjNUbb_=FnL1hyRorQ@mail.gmail.com>
From: Brian Dickson <brian.peter.dickson@gmail.com>
To: Randy Bush <randy@psg.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: sidr wg list <sidr@ietf.org>
Subject: Re: [sidr] Route Leak fix: V free routing
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sidr>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Nov 2011 16:50:53 -0000

On Tue, Nov 22, 2011 at 8:45 AM, Randy Bush <randy@psg.com> wrote:

>
> do you expect it to be covered by the signature?  if so, then the
> business relationship is published globally.  do you see a way to assure
> veracity and non-repudiation while not exposing globally?

I see a way...

[I'm assuming here, that the the places where business relation ships
need to be possible to hide, are only where there is the potential for
that hiding to have some effect:

- Transit providers know the relationship they have with their
customers, and their customers' customers...
- Peers expect to only hear their peers' customers (and customers' customers)
- (Leaving aside "special" arrangements)
- The only place where any announcement of non-customer routes occurs
is from transit to customer

end assumption]

What is needed, is a separate signature chain, "provenance".

The provenance chain is required ONLY when sending a customer prefix
to a non-customer.

The provenance chain consists of signatures over (the current "apex"
bit + previous signature)
The apex bit is either zero (on customer->transit AS path hops), or
one (peer->peer).

Once received from a peer or transit provider, and validated (if
present), the provenance chain MAY be stripped from the prefix.

If a prefix has no provenance chain, it is to be treated as if it has
at least one apex bit set.

Transit providers SHOULD reject any prefix from a customer, if any
"apex" bit is set (or if there is no provenance chain).

Peers SHOULD reject a prefix from a peer, which has no provenance
chain, or has a provenance chain with the "apex" bit set anywhere
except on the peers' entry on the chain.

Note that the vast majority of prefixes received by any AS, will be
non-customers' and can have their provenance chains removed. This
significantly reduces the impact of another set of signatures.

The absence of a provenance chain achieves the hiding of business relationships.

The absence of a provenance chain also permits the receiver of routes
to detect and stop leaked prefixes.

This mechanism would be applied on a prefix basis, not blindly on an
neighbor AS basis, although it would require knowledge of the
relationship with the neighbor to function correctly.

I think this meets all Randy's requirements, as well as Danny's.

Brian