Re: [v6ops] [GROW] Deaggregation by large organizations

["Alvaro Retana (aretana)" <[e-mail]>]

On 10/15/14, 11:14 AM, "Ted Lemon" <[e-mail]> wrote:

>On Oct 15, 2014, at 7:29 AM, Iljitsch van Beijnum <[e-mail]>
>wrote:
>> However, rather than advertising that block in BGP as a single prefix,
>>or perhaps a handful of prefixes, like an ISP would, they subdivide this
>>block within the organization and then many subunits advertise
>>subprefixes though different ISPs. The aggregate may or may not be
>>advertised.
>
>Yuck.   Has anybody done an analysis of how this works with RPKI?   Seems
>like an obvious attack surface if the RPKI isn't present or isn't done
>right.

Yup.

I don¹t have an analysis, but it is a common discussion point when
creating ROAs: what should the ROA cover?  Both the max-length of the
advertisement and the origin ASNs could result in a ³validated² attack.

On one hand, creating ROAs that cover exactly what is advertised reduces
the surface, but it can result in a higher operational cost and maybe some
hassle if something different (like a more specific) needs to be
advertised *right now*.  OTOH, creating a more ³flexible² ROA (2100::5/32
-> /48, for example) provides more operational flexibility, but it may in
fact open up the door to ³valid² announcements.

I¹ve worked with LACNIC in some of their RPKI deployments in Latin America
and I suspect that a significant number of people opt for the ³flexible
ROA²..even after we explain the risks.  LACNIC may have some insight in
what is being created right now (with the caveat of course that there¹s
just one place in the world that is in fact filtering).

Alvaro.