Re: [tcpm] [mpls] LDP Security

[Joe Touch <[e-mail]>]

On 11/13/2017 1:24 AM, Ignas Bagdonas wrote:
>
> An operator’s view here. Addressing multiple points in a single
> message here.
>
> Yes, the issue is with adoption. It is not being adopted because the
> problem solution does not necessary address the actual problem.
>
> Taking BGP as an example (and most of this applies to LDP as well) –
> we need to differentiate what security means in BGP context. Is it BGP
> transport security – the confidentiality of BGP messages exchanged
> between the peers (which MD5 or AO can address), or BGP information
> security – whether the peer is authorized to advertise a prefix and
> with what attributes (to which the presence or absence of MD5 and AO
> is orthogonal).
>
I had thought it was widely understood that there are two components to
protecting BGP:

        - TCP-AO - to protect the TCP connections from attack and
authenticate the endpoint pairs
        - BGPsec - to validate the authenticity of relayed prefix
advertisements and ensure its legitimacy

Is there a third aspect that isn't included here that you feel is
missing? Or do you feel one of these inadequate in performing *the
function it is designed for*?

Joe