Re: [sidr] Burstiness of BGP updates

[Russ White <[e-mail]>]

> Most security policies focus on aspects of system operation that are
> perceived as "secruity critical."  The WG charter articulates a security
> policy, focusing on origin validation and path authenticity. These
> aspects of routing security are visible and this avoid the more
> problematic question of what the system "should look like."

Path authenticity is a check of precisely what?

What the AS Path should look like.

Once you put timers in there, and then do lazy verification, and then do
beacons, and then... You've left the realm of ensuring a received route
has a "valid" AS Path from the perspective of what the AS Path should
look like. It might have looked like that a week ago, but who knows what
it should look like right now?

As you even said:

> The usual characterization of a secruity system is a set of mechanisms that
> are intended to enforce a secruity policy.

A policy is what someone, someplace, intends. What someone intends is
simply an expression of "what the system should look like." You can't
get away from intent.

:-)

Russ