Subject: RE: [RPSEC] Re: draft-convery-bgpattack-00

From: Joachim Jensen <[email-masked]>
Date: Mon, 4 Nov 2002 10:49:00 +0100

I can comment on that David,

We Orange DK is fairly large ISP. And we don't have even one encrypted BGP
session, either in IBGP or in EBGP.
and our IGP (OSPF) is not using md5 either. I think it's to difficult to
implemet md5 in a big IGP, if it's not implementet from the beginning, and
BGP encryption is not normal "praksis" -maybe because it's not seen as
sequrity issue, or all the password handling is to much work.

Venlig hilsen/Best regards

Joachim Jerberg Jensen
Orange A/S
AS_12435

 - Never make anything simple and efficient,
when a way can be found to make it complex and wonderful -

Are there any implementations with MD5? Does anyone even use it in practice?

I recently talked with the former founder of a small ISP. His response was
roughly, "Crypto?" They did not use it. Furthermore, there was no encryption
in the routing protocols with their upstream providers, UUNET or Sprint.

I think a survey of who is actually using any of the encryption features of
any routing protocols would be informative.

Sincerely,
David G. Boney

Department of Electrical and Computer Engineering
The George Washington University
Phillips Hall, Suite 607
801 22nd Street, N.W.
Washington, DC 20052

http://student.seas.gwu.edu/~dboney
mailto:[email-masked]
Department Phone (202) 994-6083
Department Fax (202) 994-0227

Damir Rajnovic wrote:

At 15:43 01/11/2002 -0800, Sean Convery wrote:
  
 OR  1. Use social engineering to obtain MD5 password

Does anybody knows how often ISPs are changing the 'secret key'
on a single link between two peers? Also, how diverse keys are
between multiple links (towards the same ISP and across all peering
points)?

If the answers to the above questions are not positive we may think
about replacing the whole secret key scheme with another one where
the secret key is a master key and we have separate session keys
which are expired and changed after some period of time.

Gaus
==============
Damir Rajnovic <[email-masked]>, PSIRT Incident Manager, Cisco Systems
<http://www.cisco.com/go/psirt>      Telephone: +44 7715 546 033
200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB
==============
There is no insolvable problems. 
The question is can you accept the solution? 

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec