Re: [Sidrops] [routing-wg] misconceptions about ROV

[Geoff Huston <[e-mail]>]

>> 
>> Are there any scenarios in which one would want to accept BGPsec invalid
>> paths? Similarly, RP implementations discard malformed ROAs, network
>> operators reject RPKI ROV-invalid BGP updates.
> 
> Currently you need to accept BGPSec invalid path on any path where
> at least one ASN does NOT participate in BGPSec. Applying BGPSec path
> validation is only safe when you know that ALL ASNs on the path
> participate.


I can’t parse these two sentences Tim. They seem to contradict each other
when I read em. The AS signing chain is stripped as soon as an update leaves the
original BGPSEC “island”. I thought that an AS can’t just restart the signing chain
subsequently.


>> If people perceive risk: don't enable BGPsec, let others be the early
>> adaptors. It is early days, lots of software still has to be written,
>> lots of testing is required.
> 
> What I am hoping for, essentially, is that a partial deployment model
> would be more feasible where people are not expected to form islands,
> which merge, without specifying how those islands form or merge.

This desire seems rather inexplicable to me, in that if one allows routes where
the AS signing chain is broken then it could be broken becuase of
tampering or other malicious acts as much as they are broken for more
benign reasons. How would the BGP speaker receiving the route tell the 
difference? And if it can’t, then it seems to me that there is no point in
adding this additional workload to update processing if in fact it is
incapable of detecting tampered AS Paths.

Geoff