Re: [Sidrops] [routing-wg] misconceptions about ROV

> On 23 Feb 2022, at 01:25, Randy Bush <randy@psg.com> wrote:
> 
>> BGPSec path validation procedure results in one of two states: 'Valid'
>> and 'Not Valid'. (section 5.1 of 8205).
>> 
>> A BGPSec path as a whole can only be 'Valid' if all signatures are
>> present, and they are all valid.
>> 
>> The absence of any signature, whether it's because the update left a
>> capable island, or an adversary removed signatures, results in 'Not
>> Valid'.
> 
> almost.  there is also NotSigned aka BGP4.
> 
> as it leaves an island, it becomes Unsigned.  it can not become signed
> at any further hop.

I know they cannot become signed again.

I was talking about 'Valid' and 'Not Valid' paths, not signatures.

> 
>> Rejecting 'Not Valid' is therefore only safe on known islands.
>> 
>> Outside of these islands all paths are BGPSec 'Not Valid'.
> 
> not exactly, they are Unsigned

Am I correct though that if BGPSec *Path* validation were to be applied to
unsigned paths they would be considered 'Not Valid'?

And isn't this what the downgrade issue (for which I cannot find a ref now)
is about? Rather than violating signatures, the signatures can just be
stripped.

Meaning that even if you would call such a path 'not signed', rather than
'not valid' accepting those paths would mean that 'not valid' can be
easily avoided by adversaries.

Hence, I believe, the idea to only accept BGPSec *path* 'Valid' on BGPSec
"islands".

Is there a way that these "islands" can be recognised automatically, and
cross transit (i.e. include unknown parties)? See the second part of the
email I sent earlier.

Tim

> 
> randy
> 
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops