Subject: Re: [RPSEC] Re: draft-convery-bgpattack-00

From: [email-masked]
Date: Wed, 6 Nov 2002 10:34:15 -0500 (EST)

>> (a) See recent discussion on idr list about whether AS's always, always,
>> always add their own AS to the AS_PATH before transmitting updates.
>
>The only typical (and extremely a-typical at that) example of this
>situation is with a route server.
>...
>Thus, I authorize the server to sign my updates (which I have already
>signed) with something weaker that says that "I am authorized to
>transparently proxy this route.  Once you validate me, ignore me."

Yes, something like this might be introduced to allow for route servers.
There are other checks and balances (I've been watching too much election
news) in SBGP that ensure that a router is truly authorized to speak
for an AS and such that would have to be accounted for.

But I don't want to get segued into talking about route servers.  The
conversation had to do with the need to include your neighbor id in what
you sign for an update and Iljitsch's response implied that this had
something to do with checking the AS that is on top of the list.
It doesn't, as I tried to point out.  But I noted the coincidence of the
discussion on the idr list.  I brought it up only for the purpose of
noting the coincidence.

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Jeffrey Haas <[email-masked]>
Date: Wed, 6 Nov 2002 10:49:16 -0500

On Wed, Nov 06, 2002 at 10:34:15AM -0500, [email-masked] wrote:
> But I don't want to get segued into talking about route servers.

Then lets not.  They are an extremely edge case. :-)

-- 
Jeff Haas 
NextHop Technologies