Subject: Re: [RPSEC] BGP Requirements Draft

From: Sandy Murphy <[email-masked]>
Date: Mon, 26 Sep 2005 10:39:20 -0400 (EDT)

>It
>currently proposes to validate only the peerings (AIUI), however I
>don't see why you could not include prefix information.

So you are suggesting that in an AS_PATH of [A B C D], N,
you check if D originates N, (signed of course)
C and D peer and C will pass N traffic to D, (signed of course)
B and C peer and B will pass N traffic to C, (signed of course)
A and B peer and A will pass N traffic to B, (signed of course)

I think this is pretty much what (one version I've seen) of SoBGP does.
The current BGP security spec does not get into the communication of
policy.  I think.

But note how close you are coming to producing exactly the
per-hop signing of the AS_PATH.

Now if your policies become any more explicit about "B will pass A's
traffic for N but not Q's", then it gets even closer.  I don't know
if policies like that exist.
--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Mon, 26 Sep 2005 11:15:34 -0400

> per-hop signing of the AS_PATH.

No, you're not.... But that's an implementation issue, not a 
requirements issue.

> if policies like that exist.

Yes, they do....

But, you're moving into the solution space, really. It's enough that it 
is possible to provide this sort of "authorization" in more than one 
system, to say that it's improper to say: "one is more secure than the 
other."

:-)

Russ

- -- 
[email-masked] CCIE <>< Grace Alone