Subject: Re: [RPSEC] Basis of Requirements?

From: Sandy Murphy <[email-masked]>
Date: Fri, 30 Sep 2005 14:17:15 -0400 (EDT)

>From a pragmatic  
>point of view, a validated advertisement that is coupled to corrupt  
>forwarding is just as effective an attack as a bogus advertisement.   
>Thus, any effort spent on validating the AS path is largely futile.   

Speaking of subtle (but incredibly important) differences.

Here's an analogy:

People die all the time.
We could never hope to produce a society that would ensure that people
never die.
But being able to prevent the bad guys from MAKING people die whenever
they want - now that we are indeed interested in.  (FDA, gun control,
law enforcement, DHS, etc.)

So:

Forwarding anomalies happen all the time.
We could never hope to produce a routing system that would ensure that
forwarding anomalies never happen.
But being able to prevent the bad guys from MAKING forwarding anomalies
happen whenever they want - now that we are indeed interested in.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Paul Jakma <[email-masked]>
Date: Fri, 30 Sep 2005 20:52:59 +0100 (IST)

On Fri, 30 Sep 2005, Sandy Murphy wrote:

> Forwarding anomalies happen all the time. We could never hope to 
> produce a routing system that would ensure that forwarding 
> anomalies never happen. But being able to prevent the bad guys from 
> MAKING forwarding anomalies happen whenever they want - now that we 
> are indeed interested in.

If the bad guys won't be able to make routing anomolies happen, but 
they can still happen, then these must happen because of the good 
guys, how do we tell them apart? :).

The operator always has control of the forwarding plane. Even with a 
DRM enforced routing plane that would still be true, unless we 
somehow find a way to banish the various "route add" commands.

More to the point, societies impose conditions and restrictions upon 
their members because it is supposed there will be a net-benefit[1], 
that the costs outweigh the gains.

Even if we could construct a BGP that was provably secure within 
itself, if it comes at a huge cost (every router having to do 
expensive checks for every UPDATE - ie near enough to continually), 
exactly what is the point if it rests on top of an insecure system?

That's not to say that I don't think we can achieve at least 
/something/. But it has to be reasonably cheap (netto at least), even 
if it achieves it by not being 100% perfect (eg by only being able to 
respond reactively because it is an out-band mechanism that doesn't 
need to sit on every router.).

Anyway.

1. Sometimes the benefit is quite illusionary, and hence just for 
political gain. But hopefully we can avoid that kind of thing ;).

regards,
-- 
Paul Jakma	[email-masked]	[email-masked]	Key ID: 64A2FF6A
Fortune:
Truth will out this morning.  (Which may really mess things up.)