Subject: [sidr] New Version: draft-ietf-sidr-bgpsec-protocol-11

From: Matthew Lepinski <[email-masked]>
Date: Mon, 19 Jan 2015 19:50:03 -0500

I have just submitted a new version of the BGPsec protocol document. This
version includes text changes to improve the security considerations
section of the document as well as review comments based on the previous
version of the document. (In particular, many thanks to Sriram -- for his
very  thorough review -- and to everyone who made helpful comments on the
list.) Also, to make this document consistent with other documents in the
document suite, this document now specifies a BGPsec_Path attribute instead
of a BGPSEC_Path attribute.

====================
One minor issue that arose in making these revisions:

Consider the case where you are creating a new update message somewhere
within your AS (to originate a route to one of your own prefixes) and you
are sending this new update message via iBGP to an internal peer. The
document currently says that you omit the Secure_Path attribute (that is,
the BGPsec_Path attribute is added by your edge router ... since the
signature depends on the eBGP peer to whom an update is being sent).

An alternative would be to include an 'empty' BGPsec_Path attribute ...
that is, one with zero Secure_Path segments and zero Signature segments.

If you think sending an empty BGPsec_Path is better than omitting the
BGPsec_Path, please speak up now. (Both approaches seem perfectly fine to
me.)

---

From: Randy Bush <[email-masked]>
Date: Tue, 20 Jan 2015 16:11:09 +0900

> BGPsec_Path, please speak up now. (Both approaches seem perfectly fine to

the iBGPsec originator creates an empty BGPsec_Path and sends the update
to

  o whether the iBGPsec speaker might send a BGPsec_Path to a iBGP peer
    is a per-peer decision determined at BGP_OPEN.

  o an eBGP edge which has >0 peers who do not speak BGPsec has to strip
    to non-speakers, which may be pretty common in early daze.

  o iBGP originators which are not BGPsec enabled will need the eBGPsec
    edge to create the BGPsec_Path anyway.

where's the win?

randy