Re: [sidr] Route Leak fix: V free routing

Brian Dickson <> Tue, 22 November 2011 16:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A59B91F0C3D for <>; Tue, 22 Nov 2011 08:50:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.496
X-Spam-Status: No, score=-3.496 tagged_above=-999 required=5 tests=[AWL=0.103, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id llo3aBzGJTIi for <>; Tue, 22 Nov 2011 08:50:53 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 382A01F0C3C for <>; Tue, 22 Nov 2011 08:50:52 -0800 (PST)
Received: by bkbzv15 with SMTP id zv15so43570bkb.31 for <>; Tue, 22 Nov 2011 08:50:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=1xYS+B+ZqylrflcV06//5Pb2+jHv6y5cvmWErBV99k8=; b=Ksk+Mr9Od0SoIvHJEodiOt1118atJEPQ/kEJDV9U8lP3hB1o1dTgO0qQ7Xw9qQ9oEE t+RFDttr6asiiBxC0h76s85IQoC4UZbgzlN9hWEL5+vT7vVhaArnStXxSQF+6rQbL32H jo1s0c/Hett94t5VcuEmhszJ/noHFV9bkVppM=
MIME-Version: 1.0
Received: by with SMTP id 18mr2009859bka.86.1321980648483; Tue, 22 Nov 2011 08:50:48 -0800 (PST)
Received: by with HTTP; Tue, 22 Nov 2011 08:50:48 -0800 (PST)
In-Reply-To: <>
References: <> <> <>
Date: Tue, 22 Nov 2011 11:50:48 -0500
Message-ID: <>
From: Brian Dickson <>
To: Randy Bush <>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Cc: sidr wg list <>
Subject: Re: [sidr] Route Leak fix: V free routing
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Secure Interdomain Routing <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 22 Nov 2011 16:50:53 -0000

On Tue, Nov 22, 2011 at 8:45 AM, Randy Bush <> wrote:

> do you expect it to be covered by the signature?  if so, then the
> business relationship is published globally.  do you see a way to assure
> veracity and non-repudiation while not exposing globally?

I see a way...

[I'm assuming here, that the the places where business relation ships
need to be possible to hide, are only where there is the potential for
that hiding to have some effect:

- Transit providers know the relationship they have with their
customers, and their customers' customers...
- Peers expect to only hear their peers' customers (and customers' customers)
- (Leaving aside "special" arrangements)
- The only place where any announcement of non-customer routes occurs
is from transit to customer

end assumption]

What is needed, is a separate signature chain, "provenance".

The provenance chain is required ONLY when sending a customer prefix
to a non-customer.

The provenance chain consists of signatures over (the current "apex"
bit + previous signature)
The apex bit is either zero (on customer->transit AS path hops), or
one (peer->peer).

Once received from a peer or transit provider, and validated (if
present), the provenance chain MAY be stripped from the prefix.

If a prefix has no provenance chain, it is to be treated as if it has
at least one apex bit set.

Transit providers SHOULD reject any prefix from a customer, if any
"apex" bit is set (or if there is no provenance chain).

Peers SHOULD reject a prefix from a peer, which has no provenance
chain, or has a provenance chain with the "apex" bit set anywhere
except on the peers' entry on the chain.

Note that the vast majority of prefixes received by any AS, will be
non-customers' and can have their provenance chains removed. This
significantly reduces the impact of another set of signatures.

The absence of a provenance chain achieves the hiding of business relationships.

The absence of a provenance chain also permits the receiver of routes
to detect and stop leaked prefixes.

This mechanism would be applied on a prefix basis, not blindly on an
neighbor AS basis, although it would require knowledge of the
relationship with the neighbor to function correctly.

I think this meets all Randy's requirements, as well as Danny's.