IETF Logo Mail Archive

[sidr] Key learning procedures in BGPsec?

Ross Anderson <Ross.Anderson@cl.cam.ac.uk> Tue, 31 January 2012 10:06 UTC

Return-Path: <rja14@cl.cam.ac.uk>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D84A21F865D for <sidr@ietfa.amsl.com>; Tue, 31 Jan 2012 02:06:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2cP8Zba-J1jO for <sidr@ietfa.amsl.com>; Tue, 31 Jan 2012 02:06:46 -0800 (PST)
Received: from mta0.cl.cam.ac.uk (mta0.cl.cam.ac.uk [128.232.25.20]) by ietfa.amsl.com (Postfix) with ESMTP id E7FBC21F8655 for <sidr@ietf.org>; Tue, 31 Jan 2012 02:06:45 -0800 (PST)
Received: from ssh-remote-0.cl.cam.ac.uk ([128.232.0.69] helo=cl.cam.ac.uk) by mta0.cl.cam.ac.uk with esmtp (Exim 4.63) (envelope-from <rja14@cl.cam.ac.uk>) id 1RsAbs-0008Hb-Ao for sidr@ietf.org; Tue, 31 Jan 2012 10:06:44 +0000
To: sidr@ietf.org
Date: Tue, 31 Jan 2012 10:06:44 +0000
From: Ross Anderson <Ross.Anderson@cl.cam.ac.uk>
Message-Id: <E1RsAbs-0008Hb-Ao@mta0.cl.cam.ac.uk>
Subject: [sidr] Key learning procedures in BGPsec?
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sidr>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 31 Jan 2012 10:15:23 -0000

Richard

You can get nonrepudiation from hash chains. See

  http://www.ietf.org/rfc/rfc4082.txt
  http://www.cl.cam.ac.uk/~rja14/Papers/fawkes.pdf

Ross

On 31 January 2012 09:36, Richard Barnes <rbarnes@bbn.com> wrote:
> "As simple as possible, and no simpler"
> 
> Your proposal is basically BGPSEC with MACs instead of digital
> signatures.  That doesn't work because another AS on the Internet can,
> e.g., poison a route by appending hashes computed with another AS's
> nonce.

v2.23.0 | Report a Bug | By Email