Subject: RE: BGP security in practice

From: "Martin, Christian" <[email-masked]>
Date: Mon, 4 Nov 2002 10:42:58 -0500

Randy,

I was referring to 3) more for config generation, but are you suggesting
that if we have signed routes, then we don't need detailed filters?  I can
see this being a large leap of faith for many providers.   Perhaps more of a
mental block than anything, but we need to develop a level of trust.
Something transitional would be needed, I would think.

Thanks,
chris

> that is not clear.  e.g. why do the data need privacy?  why do
> all relationships need to be represented in routing registries?
> 
> for an example, think about a modified s-bgp where
>   o the 'pki' is pgp-like or even real pgp
>   o basic ownership of ip space is attested to by registries
>   o sub-allocation of ip space is attested to by the basic owner,
>     and so forth
>   o the origination of the routing announcement is attested to by
>     an address space owner
>   o an announcement is signed contains
>     - the normal attributes
>     - an attribute saying to what ASn the route is being forwarded
>       (prevents monkey in the middle attacks)
>     - and all this is signed by the announcing AS
> 
> randy
>

---

From: Randy Bush <[email-masked]>
Date: Mon, 04 Nov 2002 07:45:20 -0800

> that if we have signed routes, then we don't need detailed filters?

it's worth the thought.  and note that not only is the origin signed,
but also the forwarding path, i.e. "yes, i gave this announcement to
mary."

randy

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 4 Nov 2002 10:50:02 -0500

> but also the forwarding path, i.e. "yes, i gave this announcement to

Right, but if we're only talking as paths, that might be doable.
But if we're talking about "he did *foo* to this route here", it
becomes more problematic.  Consider a change of other transitive
attributes.

-- 
Jeff Haas 
NextHop Technologies