Subject: [sidr] signaling origin validity state

From: Randy Bush <[email-masked]>
Date: Wed, 09 Mar 2011 08:39:45 +0900

draft-retana-bgp-security-state-diagnostic-00.txt

   This document describes an extension to the BGP Diagnostic Message to
   communicate the security state of a route.  An application of this
   extension is to propagate information about non-secure advertisements
   back to the eBGP peer from where the information was received.

aside from this being a major change in the trust model (from rpki to
peer), there was prior art presented at the last meeting, see
draft-zhang-idr-decoupling-01.txt

   This draft proposes a novel mitigation scheme to protect the inter-
   domain data delivery during false routing announcements. A new path
   attribute is defined to Decouple propagation of a path and adoption
   of a path for data forwarding in BGP (DBGP). DBGP does not use
   suspicious paths for data forwarding, but still propagates them in
   the routing system to facilitate attack detection. It can extensively
   protect data delivery from routing announcements of false sub-
   prefixes, false origins, false nodes and false links and works well
   with ongoing attack detection and prevention systems.

the comments at the time were mostly that the wg's job was to validate
and propagate good data, not bad.

perhaps it's worth agenda time to discuss this whole trend and various
flavors to climb on the origin validation bandwagon.

randy