IETF Logo Mail Archive

Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10

"Alvaro Retana (aretana)" <aretana@cisco.com> Tue, 06 December 2016 22:31 UTC

Return-Path: <aretana@cisco.com>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EC891295A3; Tue, 6 Dec 2016 14:31:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.417
X-Spam-Level:
X-Spam-Status: No, score=-17.417 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uX2RmHxqVHng; Tue, 6 Dec 2016 14:31:43 -0800 (PST)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 926171295C7; Tue, 6 Dec 2016 14:31:35 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10150; q=dns/txt; s=iport; t=1481063495; x=1482273095; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=lTgfoAUSYLA0BrWyyPC0GN5jkSRpjcZSsR3Om1uIE5Q=; b=dJYKgg55HCN+i/uISzAqnPRNtaBuKr0feo8krmLgWoPd8eZqn2wu0pjt M+RsFBcs4uIhv5VbCgZtJzt3XTa27R9UZcCgPFk92lYvv0Js/C0YPvrn3 0Y7fRciGN9nvSJF4BQDbP+cmJtVHiZSlXiWbKWsKASYaJr0vw1hs76L+8 o=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0BxAQAFO0dY/4gNJK1eGgEBAQECAQEBAQgBAQEBgnNGAQEBAQEfWoEGB41ApmiFIoIHhiICGoIMPxQBAgEBAQEBAQFiKIRpBiNWEAIBCD8DAgICMBQRAgQOBYhvqTKCKS+LEwEBAQEBAQEBAQEBAQEBAQEBAQEBARyGPoF9CIJWhDaDFi2CMAWUfIVqAZEXkD+SEAEfN4EZMQEBhSJyhlMrgQOBDQEBAQ
X-IronPort-AV: E=Sophos;i="5.33,310,1477958400"; d="scan'208,217";a="357539498"
Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 06 Dec 2016 22:31:34 +0000
Received: from XCH-RCD-001.cisco.com (xch-rcd-001.cisco.com [173.37.102.11]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id uB6MVYxk008871 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 6 Dec 2016 22:31:34 GMT
Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-RCD-001.cisco.com (173.37.102.11) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 6 Dec 2016 16:31:34 -0600
Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Tue, 6 Dec 2016 16:31:33 -0600
From: "Alvaro Retana (aretana)" <aretana@cisco.com>
To: Randy Bush <randy@psg.com>
Thread-Topic: AD Review of draft-ietf-sidr-bgpsec-ops-10
Thread-Index: AQHSNR62bJsPySrh80ivtkDVsKGkYA==
Date: Tue, 06 Dec 2016 22:31:33 +0000
Message-ID: <C7A005B5-7550-4B74-8C80-C32C60093CD9@cisco.com>
References: <1FBAD3F8-5387-47A3-9988-A49A3133490A@cisco.com> <m2d1ha2ul2.wl-randy@psg.com>
In-Reply-To: <m2d1ha2ul2.wl-randy@psg.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/f.1a.0.160910
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.24.230.46]
Content-Type: multipart/alternative; boundary="_000_C7A005B575504B748C80C32C60093CD9ciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidr/dH6aNgAkXN4XDiIktTFklBna2A0>
Cc: "sidr-chairs@ietf.org" <sidr-chairs@ietf.org>, sidr wg list <sidr@ietf.org>
Subject: Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidr/>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Dec 2016 22:31:44 -0000

Randy:

Hi!

In thinking about this point some more…what about draft-ietf-sidr-slurm?  Isn’t that supposed to address the private space?

Thanks!

Alvaro.

On 12/2/16, 12:56 PM, "Randy Bush" <randy@psg.com<mailto:randy@psg.com>> wrote:


M4. Still in Section 7: “To prevent exposure of the internals of BGP
Confederations [RFC5065], a BGPsec speaker which is a Member-AS of a
Confederation MUST NOT sign updates sent to another Member-AS of the
same Confederation.”  This is another case where the BGPSec spec says
something different: Section 4.3. (Processing Instructions for
Confederation Members) presents a mandatory mechanism that includes
signing, but not necessarily validating.  BTW, if the updates are not
signed, then the signed path would be broken, even if all the routers
in the path support BGPSec, right?  Is that the recommendation?

it is common for a bgp confederation to include private ASs for which
there can be no unique authorative router credentials in the rpki.
hence i am suspicious of the protocol spec.

v2.46.0 | Report a Bug | By Email | System Status