Subject: Fwd: Re: [RPSEC] Definition of Routing Protocol - Routing System

From: "Ioannis C. Avramopoulos" <[email-masked]>
Date: Thu, 14 Nov 2002 17:22:46 -0500

Subject: Re: [RPSEC] Definition of Routing Protocol - Routing System
From: <[email-masked]>
To: Russ White <[email-masked]>
Date: Thu, 14 Nov 2002 17:04:39 -0500

IPsec does not protect against a subverted router that drops the
traffic it receives. I am wondering why this aspect of routing is not
emphasized in the WG. Is it because it is not within the scope,
or because of its expected overhead?

How is Byzantine robustness for routing defined
(as opposed for example to Byzantine robustness
of the network layer)?

Yannis

----- Original Message -----
From: Russ White <[email-masked]>
Date: Thursday, November 14, 2002 4:34 pm
Subject: Re: [RPSEC] Definition of Routing Protocol - Routing System

> 
> This working group really only covers the secuiryt of routing,
> not forwarding traffic. I think for forwarding traffic, the
> general concensus is to encrypt the data flows, through something
> like IPsec.
> 
> Byzantine robustness for routing would be a valid requirement.
> 
> :-)
> 
> Russ
> 
> On Thu, 14 Nov 2002, Ioannis C. Avramopoulos wrote:
> 
> >  Dear Security Researchers,
> > 
> >  is the protection of data packet forwarding a 
> >  legitimate requirement within this working group?
> > 
> >  Does the term "routing protocol" refer only to the
> >  acquisition of topological information and the 
> >  building of forwarding tables? Or it includes
> >  the data plane as well? Are the terms "routing
> >  protocol" and "routing system" defined somewhere
> >  and if not should they be?
> > 
> >  Are "Byzantine Robustness" and "Byzantine
> >  Detection", as defined in Radia Perlman's thesis,
> >  legitimate requirements?
> > 
> >  Regards
> >  Yannis
> > 
> > _______________________________________________
> > RPSEC mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/rpsec
> > 
> 
> __________________________________
> [email-masked] CCIE <>< Grace Alone
> 
> 
>

---

From: "Ioannis C. Avramopoulos" <[email-masked]>
Date: Thu, 14 Nov 2002 19:10:50 -0500

However data packet forwarding may provide feedback to 
topology discovery. As an example the AODV protocol
uses data packets to identify broken links and 
propagate Route Error messages. Route Error messages
are then fed into topological state. My point is that
there is no clear boundary between topology discovery
and data packet forwarding.

Thank you for kind response though.
Yannis

----- Original Message -----
From: Russ White <[email-masked]>
Date: Thursday, November 14, 2002 5:49 pm
Subject: Re: [RPSEC] Definition of Routing Protocol - Routing System

> 
> > IPsec does not protect against a subverted router that drops
> > the traffic it receives. I am wondering why this aspect of
> > routing is not emphasized in the WG. Is it because it is not
> > within the scope, or because of its expected overhead?
> 
> Because it isn't in scope--we are dealing with building the
> topology, not with forwarding packets.
> 
> > How is Byzantine robustness for routing defined (as opposed
> > for example to Byzantine robustness of the network layer)?
> 
> Bynzantine robustness in the sense of devices injecting false or
> bad information in the routing domain.
> 
> :-)
> 
> Russ
> 
>

---

From: [email-masked]
Date: Fri, 15 Nov 2002 16:07:52 -0500 (EST)

>In this case, advertising reachability and not delivering on that
>promise is clearly one of the threats we're already considering.

What would you envision being the requirement that we state to the
routing protocol designers?  "Whatever you do, make sure the router
follows the forwarding implied by the advertised reachability"?
Can you see the idr group taking that on as an additional requirement for the
next version of BGP?  Should DSR be rejected until it can meet that
requirement wrt the source routes it determines?

If this requirement is not a requirement the routing protocol designers
have to meet, whose responsibility is it?

--Sandy

---

From: [email-masked]
Date: Fri, 15 Nov 2002 16:01:35 -0500 (EST)

>Actually, I think that forwarding of data counts as "part of the routing
>algorithm", since if we are concerned about a Byzantine failure of a router,
>malicious behavior in forwarding can mess things up.

First, errors in forwarding have a much more localized effect than
errors in the routing protocol distribution of topology information.
One router can only mis-forward packets that come to it specifically.
One router can affect the flow of data traffic over a very wide area
if it makes errors in the routing protocol.

Second, (here I am on my soap box again), there's not a whole lot
we can advise routing protocol designers about the security of their
routing protocol that would prevent the routers from mis-forwarding
packets.  It's not a routing *protocol* security issue.

--Sandy

---

From: "Ioannis C. Avramopoulos" <[email-masked]>
Date: Sat, 16 Nov 2002 14:16:43 -0500

> if it makes errors in the routing protocol.

There is a trade-off between automatic configuration and security.
If routers do topology discovery rather than be configured with a map
then subverted routers can inject a lot of false connectivity even
if routing updates are cryptographically protected. One possibility is
to prune false connectivity by using data packets. 

> packets.  It's not a routing *protocol* security issue.
 
The requirement can be to either be able to deliver packets despite
having routers that mis-forward packets and possibly detect those
routers.

Another requirement might be to provide different levels of assurance.

Yannis

PhD student
Electrical Engineering Department
Princeton University

---

From: "Ioannis C. Avramopoulos" <[email-masked]>
Date: Sat, 16 Nov 2002 14:24:21 -0500

The network can provide different levels of security. At one extreme
there can be no security. At the other extreme it will deliver packets
as long as a non-faulty path exists. Consumers of the infrastructure
should be able to choose. Performance is the driving factor for those
different levels.

> If this requirement is not a requirement the routing protocol 
> designershave to meet, whose responsibility is it?
> 

Yannis

---

From: [email-masked]
Date: Sun, 17 Nov 2002 15:36:48 -0500 (EST)

>Consumers of the infrastructure
>should be able to choose. 

Trouble is, this is kind of like public health matters between countries.
If one country decides not to immunize its citizens, then the countries
around have to keep facilities in place for dealing with outbreaks.

Routing security decisions affect not only the ISP making them but the
ISP's that peer (or not).

--Sandy