Re: [sidr] Presentations on non-working group documents

Hi Matt, and others,

I agree with you that we should concentrate to the charter of SIDR.
However, I also have some different opinions.

1.

Firstly, expiration-date almost can not restrict replay attack, since
route failures are frequently occurred.
And the expiration-date can not be very short.
>From this aspect, I think BGPSEC is also a "feasible path authentication"
method.

Actually, I just proposed a method to restrict the replay attack.
That is the Suppressed Path Padding (or we can call it Non-optimal path
padding).
With SPP we can grantee that all non-optimal path will no shorter than
optimal path.
Since optimal path usually has an obvious longer use-time,
SPP actually protect the most important optimal path.

2.

Secondly, if guys think that BGPSEC has no need to cover AS Path
Pre-pending,
It means that BGPSEC also can not defend many "AS removal“ attacks, since
ASPP is widely used.
>From this aspect, even if BGPSEC grantees that the AS-Path represented in
the route is the same as the path through,
it has no significance since it can not defend very simple attacks.

If guys think these simple attacks are acceptable,
then we also should be able to adopt the tiny security loss in FS-BGP.
Actually the full version of FS-BGP (armed with SPP) is more security than
S-BGP.

3.

Thirdly, the cost of S-BGP is unbearable.
I remembered that Sandy said,
"if the router can not bear, then we can choose only signs some of k path
suffix from the entire n path suffixes."

So guys, if we think selectively signing path suffixes is acceptable,
I think we also can accept signing the adjacent AS triples using FS-BGP.

Because --- neighbor based routing, this is indeed how BGP works.

--

OK, I just a new guy here, and hope can make some contribution to the SIDR
WG.

Regards.
_____________________________________________________
Yang Xiang, PhD student, Tsinghua Univ., about.me/xiangyang

2011/7/29 Matt Lepinski <mlepinsk@bbn.com>

> At the end of the SIDR session there were a couple of presentations on
> drafts that were not working group documents. I just wanted to agree with
> something that Wes had said at the microphone near the end of the meeting.
>
> SIDR has a lot of work on its plate right now, and the area directors have
> indicated that presently they are not willing to expand the charter to take
> on additional work. Therefore, if folks have ideas about improving routing
> security, I believe it is most helpful to the working group if these
> suggestions can be cast in terms of improvements/enhancements/**extensions/optimizations
> to existing SIDR work items (either RPKI origin validation or BGPSEC path
> validation).
>
>
> ______________________________**_________________
> sidr mailing list
> sidr@ietf.org
> https://www.ietf.org/mailman/**listinfo/sidr<https://www.ietf.org/mailman/listinfo/sidr>
>