Re: [Sidrops] Welcome your attention and any comments // FW: New Version Notification for draft-shen-sidrops-region-verification-00.txt

(for clarity, from a reading reader of the written words I wrote)

On Thu, Jul 15, 2021 at 1:38 PM Christopher Morrow <
christopher.morrow@gmail.com> wrote:

> My reading of this, admittedly quickly, is that the draft says basically:
>   "hey, you can do some leak prevention with ROA and some with ASPA, but
> these alone are not sufficient"
>
>
"hey, you can do some leak prevention with RouteOriginValidation (ROV,
meaning using the RPKI/ROA data to validate origins of prefixes seen in the
bgp stream)..."


> I think I agree, except that in all cases so far we've always said:
>   "You should keep RPKI data updated, and IRR data updated and filter your
> bgp peerings"
>
>
So, without filters there's not a clear way to prevent leaks... Does this
> draft basically need to say:
>   "Hey, rpki is cool, but you still must filter!!"
>
>
"Hey, RPKI-based  ROV, ASPA are cool, but you still must filter!!"

apologies for being less than clear...as much as a complain about other
people with their loose words you'd think I'd learn :(

and yes aspa may help you get better filters...
>
> On Thu, Jul 8, 2021 at 10:05 PM Wanghaibo (Rainsword) <
> rainsword.wang@huawei.com> wrote:
>
>> Hi All,
>>
>> We have published a new draft of region verifcation recently.
>> https://datatracker.ietf.org/doc/draft-shen-sidrops-region-verification/
>>
>> This is also introduced in the APNIC 50.
>>
>> https://conference.apnic.net/50/assets/files/APCS790/BGP-Routing-Security-Region-based-Trust-Alliance-Validation.pdf
>>
>> Welcome your comments and suggestions
>>
>>
>> Abstract:
>>    BGP routing security is becoming a major issue that affects the
>>    normal running of Internet services.  Currently, there are many
>>    solutions, including ROA authentication and ASPA authentication, to
>>    prevent route source hijacking, path hijacking, and route leaking.
>>    However, on an actual network, large ISPs with multiple ASes can use
>>    carefully constructed routes to bypass ROA and ASPA authentication to
>>    attack the target network.
>>
>>    This document defines an region-based authentication method for large
>>    ISPs with many ASes to prevent traffic hijacking within ISPs.
>>
>>
>> _______________________________________________
>> Sidrops mailing list
>> Sidrops@ietf.org
>> https://www.ietf.org/mailman/listinfo/sidrops
>>
>