Re: [Sidrops] [routing-wg] misconceptions about ROV

[Randy Bush <[e-mail]>]

> Am I correct though that if BGPSec *Path* validation were to be
> applied to unsigned paths they would be considered 'Not Valid'?

no.  not validatable, if you wish.  not valid is a result of
validating the signature chain.  as one can not do that with
a non-bgpsec path, it can be neither valid or not valid.

> And isn't this what the downgrade issue (for which I cannot
> find a ref now) is about? Rather than violating signatures, the
> signatures can just be stripped.

the downgrade attack is a router accepting a bgpsec path and
producing a bgp4 path toward the 'victim'.  in a more likely
operational scenario, the router simply refuses bgpsec from its
incoming peer, so that peer sends it bgp4 which it then sends on
to the 'victim'.  though that make a louder signal of the attack.

> Meaning that even if you would call such a path 'not signed',
> rather than 'not valid' accepting those paths would mean that
> 'not valid' can be easily avoided by adversaries.

yes

> Hence, I believe, the idea to only accept BGPSec *path* 'Valid'
> on BGPSec "islands".

no.  routers on those islands still need to reach non-bgpsec
destinations and even bgpsec speaking destinations on other
islands.  this means they must also accept unsigned paths.

> Is there a way that these "islands" can be recognised
> automatically, and cross transit (i.e. include unknown
> parties)?

you could tunnel between islands; but that is operationally
unlikely.  i remember uucp :)

and you can not take an unsigned path and start signing.  to what
are you attesting?

randy