Re: [sidr] [Idr] draft-ietf-sidr-bgpsec-threats-02: Path shortening & lengthening

Robert Raszuk <robert@raszuk.net> Mon, 09 April 2012 16:29 UTC

Return-Path: <robert@raszuk.net>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1ACF821F8735 for <sidr@ietfa.amsl.com>; Mon, 9 Apr 2012 09:29:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.465
X-Spam-Level:
X-Spam-Status: No, score=-2.465 tagged_above=-999 required=5 tests=[AWL=0.134, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KPFbv7I23V37 for <sidr@ietfa.amsl.com>; Mon, 9 Apr 2012 09:29:43 -0700 (PDT)
Received: from mail1310.opentransfer.com (mail1310.opentransfer.com [76.162.254.103]) by ietfa.amsl.com (Postfix) with ESMTP id 3567021F872E for <sidr@ietf.org>; Mon, 9 Apr 2012 09:29:43 -0700 (PDT)
Received: (qmail 20314 invoked by uid 399); 9 Apr 2012 16:29:42 -0000
Received: from unknown (HELO ?192.168.1.57?) (pbs:robert@raszuk.net@83.9.123.224) by mail1310.opentransfer.com with ESMTPM; 9 Apr 2012 16:29:42 -0000
X-Originating-IP: 83.9.123.224
Message-ID: <4F830E75.70606@raszuk.net>
Date: Mon, 09 Apr 2012 18:29:41 +0200
From: Robert Raszuk <robert@raszuk.net>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20120312 Thunderbird/11.0
MIME-Version: 1.0
To: "Sriram, Kotikalapudi" <kotikalapudi.sriram@nist.gov>
References: <D7A0423E5E193F40BE6E94126930C4930B96182E71@MBCLUSTER.xchange.nist.gov> <4F828D6D.10907@raszuk.net> <D7A0423E5E193F40BE6E94126930C4930B96C507DA@MBCLUSTER.xchange.nist.gov>
In-Reply-To: <D7A0423E5E193F40BE6E94126930C4930B96C507DA@MBCLUSTER.xchange.nist.gov>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: "idr@ietf.org List" <idr@ietf.org>, "sidr@ietf.org" <sidr@ietf.org>
Subject: Re: [sidr] [Idr] draft-ietf-sidr-bgpsec-threats-02: Path shortening & lengthening
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: robert@raszuk.net
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sidr>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Apr 2012 16:29:44 -0000

Hi Sriram,

 > When the update is to leave a BGPSEC island to go to a BGP-4 only AS,
 > then the Secure Path is easily converted to BGP-4 AS_PATH at the edge
 > of the BGPSEC island.

What happens in the opposite direction ? How AS_PATH/AS4_PATH can be 
converted to BGPSEC_Path_Signatures without all necessary information 
present at the ASBR at any arbitrary Autonomous System ? Are you going 
to propose NULL signatures ?

How are you planning on a flag date where all ASBRs in the Internet are 
BGPSEC complaint ?

Why one needs to upgrade also all P routers (intra domain BGP speakers) 
to be BGPSEC complaint provided he is not using BGP as an overlay today?

If you think removal of AS_PATH/AS4_PATH is helpful in any way the much 
simpler would be to define new set of AFIs and call it "SECURED" leaving 
current AFI 1 and AFI 2 unchanged BGP protocol wise.

Thx,
R.


> The updates in a BGPSEC island can be BGPSEC (i.e., signed) or BGP-4 (i.e., unsigned).
> In either case, the update necessarily has AS-path info.
> If the update is BGP-4 (i.e., unsigned), it has the BGP-4 AS_PATH (mandatory) in it.
> If the update is BGPSEC (i.e., signed), then it MUST have the "Secure Path" in it.
> The Secure Path is in the form of {ASN1, pCount1, ASN2, pCount2, ...., ASN-k, pCount-k}.
> Please refer to slide 8 in Matt's presentation (BGPSEC Protocol) in Paris.
> The Secure Path is semantically equivalent to the BGP-4 AS_PATH.
> When the update is to leave a BGPSEC island to go to a BGP-4 only AS,
> then the Secure Path is easily converted to BGP-4 AS_PATH at the edge of the BGPSEC island.
> Any prepend ASN that was collapsed in BGPSEC will be repeated pCount number of times,
> and any transparent route server ASN (with pCount=0) in BGPSEC will be removed.
> Is this semantic equivalence (of the Secure Path) and
> the guarantee of convertibility to BGP-4 AS_PATH not enough?
> Should we really require in BGPSEC that the BGP-4 AS_PATH be carried (in a pristine way)
> in addition to the Secure Path, albeit at the cost of duplication and associated
> processing cost/confusion? Just a honest question seeking people's opinion.
>
> Sriram
>
>> -----Original Message-----
>> From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of Robert
>> Raszuk
>> Sent: Monday, April 09, 2012 3:19 AM
>> To: sidr@ietf.org
>> Cc: idr@ietf.org List
>> Subject: Re: [sidr] draft-ietf-sidr-bgpsec-threats-02: Path shortening&  lengthening
>>
>>
>>> Your analysis assumes that there a conventional BGP-4 AS_PATH field
>>> and then there is is BGPSEC_Path_Signatures from which AS path info
>>> can be inferred separately. This is not true in the latest BGPSEC
>>> update format as Matt presented it in Paris.
>>
>> How an optional attribute replace well-known mandatory one ?
>>
>> Sorry but for such step formal IDR WG approval is necessary if you choose to
>> propose BGPSEC_Path_Signatures as mandatory attribute. This is major BGP
>> protocol change.
>>
>> Documentation of partial deployment is required as well as two interoperable
>> implementations ;).
>>
>> RFC4271:
>>
>> 5.1.2.  AS_PATH
>>
>>     AS_PATH is a well-known mandatory attribute.  This attribute
>>     identifies the autonomous systems through which routing information
>>     carried in this UPDATE message has passed.  The components of this
>>     list can be AS_SETs or AS_SEQUENCEs.
>>
>>
>> draft-ietf-sidr-bgpsec-protocol-02.txt
>>
>>     This document specifies a new optional (non-transitive) BGP path
>>     attribute, BGPSEC_Path_Signatures.
>>
>>
>> Best regards,
>> R.
> _______________________________________________
> Idr mailing list
> Idr@ietf.org
> https://www.ietf.org/mailman/listinfo/idr
>
>