Subject: Re: [Idr] Next revision of AS_HOPCOUNT

From: [email-masked]
Date: Thu, 12 Jan 2006 10:07:08 -0500 (EST)

>Can we please take it to RPSEC?
>...
>PATHLIMIT is certainly intended to be one of those mutable attributes,
>either because it is being decrement, applied by proxy, or both.

If the PATHLIMIT is intended to be mutable, then the conversation
can cease here and you don't need to take anything to RPSEC -
if the intent is to let anyone modify the attribute in any way,
there there is no integrity security needed.

Making that clear in the spec would, IMHO, a good thing.
It would be easy to read "PATHLIMIT" and "MUST advertise
an AS_HOPCOUNT atribute of one less than the value received"
and "If the attribute value is zero, the path MUST be ignored
without further processing" and think something more deterministic
was going on than a mutable attribute that was advice only.

>The entire issue of what RPSEC will
>protect, how it can protect mutable attributes and not force a full  
>re-engineering
>of the entire Internet is NOT something that we should be solving here.

RPSEC is charged with threat models and security analysis and
requirements, with "routing protocol designers" charged with
using the RPSEC products to ensure security in their protocols.
At least, that's what the charter says now.

--Sandy

_______________________________________________
Idr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/idr

---

From: Tony Li <[email-masked]>
Date: Thu, 12 Jan 2006 15:00:11 -0800

> was going on than a mutable attribute that was advice only.

Please see section 5.2.  We clearly state that AS_HOPCOUNT may
be used in a proxy fashion.

I believe that it's a rush to the other side of the spectrum to say that
no integrity security is needed.  There are a number of mutable
attributes necessary for fully functioning BGP (e.g., AS_PATH,
communities).  Hopefully whatever solution RPSEC selects to
protect these attributes will also be useable for AS_HOPCOUNT or
AS_PATHLIMIT.

> At least, that's what the charter says now.

Hopefully someone, somewhere will actually have responsibility for
coming up with some actual, workable security mechanisms and
specifications for implementations that still provide inter-domain
routing functionality in a manner that is actually useful and deployable
sometime before the heat death of the universe.

Tony