Re: [sidr] BGPSEC Threat Model ID

[Danny McPherson <[e-mail]>]

On Nov 9, 2011, at 2:56 PM, Geoff Huston wrote:
> 
> I did not claim it existed - I merely disagreed with the claim of its 
> impossibility of existence.
> 
> In the same way that the only way you can eliminate the "unknown" validation
> outcome is to achieve universal adoption of the generation of credentials,
> the general visibility of intent relies on universal adoption on the generation
> of routing policy. It is not impossible per se, it just relies on universal adoption!
> 
> In the case of the efforts relating to RPSL, reality has not achieved such targets
> of universal adoption, as you point out.
> 
> In the case of the efforts relating to the BGP security mechanisms you are working
> on, it is an open issue as to how many folk would adopt it, but our experiences
> of other technologies, including 4 byte ASN support indicate that universal
> adoption is an extremely challenging objective.

I completely agree with you here Geoff - and a resource certification 
infrastructure to bootstrap IRRs, coupled with a few lessons learned 
from the RIPE playbook and beyond, and their potential utility is orders 
of magnitude beyond where it currently is and addresses that residual 
risk (my primary concern) that current solutions fail to address.

-danny