Subject: comment on protecting BGP update security

From: Sandy Murphy <[email-masked]>
Date: Fri, 13 Mar 1998 13:19:50 -0500 (EST)

At the DC IETF, I presented a draft discussing different protections
for the security of BGP updates.  I promised a new draft with some
increased emphasis on issues I did not cover thoroughly.  But I've not
been able to break free and this last all important week I've been at a
meeting with connection problems, so I doubt I'll be able to meet the
deadline today.

But there is one point that I wanted to make.  Someone who was at the
meeting told me that I left the group with some confusion about the
vulnerabilities in the various approaches.  One of the protections
was to sign the original announcement of a network by the announcing
AS.  This can help protect against spurious announcements of networks
by AS's that have no business doing so IF you couple checking the
singature with checking an authority that can attest that the AS is
authorized to speak for that address.  But.  Anyone can cut and paste
this signed announcement into their update.  So you know that the
announcement is genuine and authorized, but you do not know that the
path in between is genuine.

Another protection was to sign the original announcement but to also
sign the AS-PATH at each router that passes the route on.  It was
suggested to me that I left the impression that this is also subject
to the cut and paste attack.  It's not - what you sign at each router
is the AS-PATH you're exporting *AND* the neighbor you are sending it
to.  So you can check the path against the nested signatures to guard
against anyone snipping a piece out of the path and attempting to 
paste it into a path they export.

Clear as mud?  Send mail.

Finally, I'd like to point to the work that got posted last week
that proposes how to add authorization protection to the routing
registries.  (This is not me, it's mostly Curtis Villamizer and
Carol Orange.)  An authenticated authorized routing registry is
yet another (probably more palatable) technique to judging the
validity of received updates.

--Sandy Murphy