Subject: [RPSEC] Use of external information for RP security

From: Charles Lynn <[email-masked]>
Date: Fri, 7 Nov 2003 10:33:07 -0500 (EST)

Trying to step back from the recent dialog on the subject of:
    Considerations in Path Security for BGP
do folks think that there is an issue with using information not
carried in a given RP's PDUs to increase the security of the RP?

A few examples of possible information or databases are:
 * Certificates (of whatever flavor)
 * DNS[SEC]
 * Internet Routing Registry
 * NOC "configuration" files (at least for intra-AS RPs)
 * RADIUS/Diameter/IPsec
 * Regional Internet Registry
 * etc.

If such "external" sources of information are used, I think that they
would need to be included within the "security perimeter"; their
integrity, correctness, authentication, availability, and "freshness"
would have to be considered when evaluating risks and threats for an RP.
				   
Should such external sources be "in scope" or "out of scope" as
mechanisms that to be be considered when securing an RP?

If some are in scope, but others out of scope, where should the line
be drawn?  A la "there is more to a protocol than PDU formats", but
how much more.

Charlie

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Jean-Jacques Puig <[email-masked]>
Date: Fri, 7 Nov 2003 17:25:02 +0100

Hi !

> carried in a given RP's PDUs to increase the security of the RP?

Availability of the information when there are no routes may be :).
There may also be stupid locks (I want to check the cert server for
validity of the route leading to the cert server...). However, I'm also
interested in these methods. I think there is very little hope to get
some inter-domain security without these.

> would have to be considered when evaluating risks and threats for an RP.

True. I plan to develop on this in the requirements doc. 

> mechanisms that to be be considered when securing an RP?

I think so. But may be we should discuss on this in the rpsec session ?

-- 
Jean-Jacques Puig

[homepage] http://www-lor.int-evry.fr/~puig/

---

From: Russ White <[email-masked]>
Date: Fri, 7 Nov 2003 19:31:02 -0500 (Eastern Standard Time)

> Availability of the information when there are no routes may be :). There
> may also be stupid locks (I want to check the cert server for validity of
> the route leading to the cert server...). However, I'm also interested in
> these methods. I think there is very little hope to get some inter-domain
> security without these.

I would never want to depend on interdomain routing to secure interdomain
routing, I don't think. Adding this dimension to the problem opens a number
of alternate places where the security mechanism itself can be attacked,
and since these sorts of security systems are bound to be fail safe, you
wind up with more opportunities for denial of service, it seems to me (?).

And, I'm not positive there's no way to get interdomain security without
some sort of "master server." In fact, I would argue the opposite is
true--the more a security mechanism relies on a "settled infrastructure,"
the less likely it is to be deployed. The more distributed a system is, the
more likely it is to be deployed, I think.

But, those are just guesses, from talking to providers and others, and
trying to ask that specific question, rather than information from any sort
of "scientific survey." :-)

> True. I plan to develop on this in the requirements doc.

I would think that any such databases which a security system relies on
should be included within the purview of threats and requirements.

> I think so. But may be we should discuss on this in the rpsec session ?

I would say in scope.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone