Re: [Sidrops] draft-sidrops-maxlen - questions from 110 session

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

I understand Alexander's point of view and Ben's detailed analysis. Yet I think it would never make sense to not implement minimal ROAs because of the following reasons:

1. Looking at the available long history of events, it would be generally correct to say that the vast majority of hijacks of more specific prefixes are accidental (invalid origin AS) rather than malicious (forged-origin). For example, accidental leaks of more specific prefixes from route optimizers. For that reason, keeping the attack surface minimal is crucial.

2. “65666 is a relatively sophisticated adversary” per Ben's characterization. Scenario C could play out quite differently than how Ben envisioned it. The adversary sees a large attack surface – there are s = 2^(m-k) choices of vulnerable more specific prefixes of length k. Example: m = 18, k = 24, then s = 64. Let us say, the vulnerable /24 subprefixes are q(1)/24, q(2)/24, …, q(64)/24. The adversary announces q(1)/24 (forged-origin attack), conducts spam, and then withdraws it. They keep the duration of this attack cycle comparable to the time taken for the defensive announcement (by the victim) of the q(1)/24 and its ballpark propagation time. Then the adversary repeats the attack exploiting q(2)/24 and rotates through all 64 available q(i)/24 subprefixes. The victim’s defensive announcements are rendered ineffective (adversary already withdrew the /24 seeking to stay under the radar). There will be a much larger attack surface that the adversary can rotate through if he/she chooses to randomly mix the vulnerable subprefixes of many potential victims who have non-minimal ROAs. The victims’ defensive announcements would be useless (redundant). So, I think this scenario analysis also weighs in for keeping the attack surface minimal.    
     
Sriram