Subject: RE: [RPSEC] Discontiguous Deployment...

From: "Tony Li" <[email-masked]>
Date: Thu, 20 Jul 2006 19:11:28 -0700

> Should there be a requirement that any proposed security 
> system must be
> useful even if deployed in a noncontiguous way? Or should 
> this not be a
> requirement?

IMHO, the requirement should be that it be possible to have incremental
deployment, with benefit at least proportional to the extent of the
deployment.

The very nature of BGP implies that you will end up with incremental
noncontiguous deployments.  If there are no benefits until contiguity is
restored, then there will be no adoption, and hence no point in creating
the solution in the first place.

Tony

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Blaine Christian <[email-masked]>
Date: Thu, 20 Jul 2006 21:40:04 -0700

> the solution in the first place.

Agreed,

A successful standard will allow for deployments that are not yet  
interconnected.   Those folks doing BGP in support of the Internet  
will appreciate the ability to secure local sections of the Internet  
and at least offer a higher degree of probability that they will not  
have prefixes hijacked etc...  BTW, we also discussed the likelihood  
of making the selection of a "secure" route part of the BGP path  
selection process.

The specific paragraph that started this was intended to note the  
fact that we will be unable to have a "flag day" for BGP.     It is  
highly unlikely we will have the entire Internet converted quickly.   
There will be pockets of "insecure" and areas that are "secure" that  
are connected to/through insecure networks.

The folks "not" doing BGP for the Internet are likely to have some  
needs WRT partial deployment as well and I believe that most of us  
have seen or will see cases where a partial deployment aids in a full  
deployment later.

Regards,

Blaine

---

From: Cat Okita <[email-masked]>
Date: Fri, 21 Jul 2006 01:33:34 -0400 (EDT)

> the solution in the first place.

Agreed - most of us can't get solutions rolled out across our employer in
a short period of time, never mind across different administrative
domains.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 21 Jul 2006 12:37:29 +0200

On 21-jul-2006, at 3:21, Russ White wrote:

> Okay, before we get too far into wording, I want to check on list and
> see what everyone's opinion is....

> Should there be a requirement that any proposed security system  
> must be
> useful even if deployed in a noncontiguous way? Or should this not  
> be a
> requirement?

Obviously that would be useful, but what I'm afraid of is that making  
this a hard requirement may lead people to come up with solutions  
that are technically inferior in order to meet this requirement.

Deployment only happens once, and it's reasonable to assume that when  
some kind of more secure BGP takes off the situation where two parts  
of the network that both implement the new stuff are separated by a  
part of the network that doesn't won't be a situation that is common  
and persists for a long time.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 21 Jul 2006 09:21:36 -0400

At 9:21 PM -0400 7/20/06, Russ White wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
>Should there be a requirement that any proposed security system must be
>useful even if deployed in a noncontiguous way? Or should this not be a
>requirement?
>
>One we settle this, it should be easier to come to concensus on actual
>wording, I hope (?)....
>
>:-)
>
>Russ
>

Russ,

I think non-contiguous deployment of a BGP security system should 
yield some improvement in security over lack of deployment of that 
system. However, I also think it is reasonable to expect that 
non-contiguous deployment will yield less improvement vs. contiguous 
deployment.  Trying to characterize the nature of the improvement, or 
the differences in security between contiguous and non-contiguous 
deployment is where I think we will get into trouble.

Steve

---

From: Paul Jakma <[email-masked]>
Date: Sat, 22 Jul 2006 00:28:31 +0100 (IST)

On Thu, 20 Jul 2006, Russ White wrote:

> must be useful even if deployed in a noncontiguous way? Or should 
> this not be a requirement?

As a requirement: No, it would predispose the requirements towards 
certain solutions.

However, it would obviously be highly desireable if a solution could 
provide partial security benefits even across speakers not capable of 
participating.

regards,
- -- 
Paul Jakma	[email-masked]	[email-masked]	Key ID: 64A2FF6A
Fortune:
Freedom begins when you tell Mrs. Grundy to go fly a kite.

---

From: Russ White <[email-masked]>
Date: Sun, 23 Jul 2006 08:28:47 -0400

>> useful even if deployed in a noncontiguous way? Or should 

After waiting a couple of days for this to settle down, we have:

o In favor: Tony Li, Bora, Blaine, Cat
o Against: Sandy
o Useful, but no definite way to characterize: Steve Kent
o Useful, but could be too difficult/bias the mechanism choice:
  Iljitsch , Paul J

Perhaps we should agree to make it a "SHOULD?," and figure how to word
such a beast?

:-)

Russ

- --
[email-masked] CCIE <>< Grace Alone

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sun, 23 Jul 2006 15:00:05 +0200

> Perhaps we should agree to make it a "SHOULD?," and figure how to word

Why not explain that this is a desirable feature, but not make it a  
requirement?

That way, we can see what kind of solutions people come up with, and  
then determine which are better, the ones with this feature or the  
ones without.

---

From: Curtis Villamizar <[email-masked]>
Date: Sun, 23 Jul 2006 14:22:40 -0400

> Perhaps we should agree to make it a "SHOULD?," and figure how to word

We have to deal with the fact that there are going to be conflicting
requirements.  A potential knee jerk reaction to a requirement that
doesn't allow for one's favorite solution is to say that the
requirement should not exist.

Whenever there are conflicting requirements there is a tradeoff.
Trying to force a decision one way when one large community is
unwilling to drop a given requirement that favors another solution is
usually futile.

There are certain proposed solutions that will not any time soon get
widely deployed.  Stating that solutions SHOULD be useful in a
noncontiguous deplyment just makes that sort of solution more useful.
If a solution *can't* be made useful in a noncontiguous deplyment then
it is just less useful, but not useless.

Curtis

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 21 Jul 2006 21:16:40 +0200

Yes discontiguous deployment should provide improved security and should bea
requirement.

I am assuming that the 'unit' here it the AS, not an individual router.

Tom Petch

----- Original Message -----
From: "Russ White" <[email-masked]>
To: <[email-masked]>
Sent: Friday, July 21, 2006 3:21 AM
Subject: [RPSEC] Discontiguous Deployment...

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2.2 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFEwCwXER27sUhU9OQRAi7sAJ0QemwdRCmCc+/xOx8EtF8zuP4XyQCg96L5
> ouOX1IKuwrAXhuBJudmnRLc=
> =e/0P
> -----END PGP SIGNATURE-----
>

---

From: Geoff Huston <[email-masked]>
Date: Mon, 24 Jul 2006 06:54:07 +1000

>Perhaps we should agree to make it a "SHOULD?," and figure how to word

I am in favour of a SHOULD here

   Geoff

---

From: Geoff Huston <[email-masked]>
Date: Mon, 24 Jul 2006 06:55:22 +1000

>then determine which are better, the ones with this feature or the

Because this is a requirements WG, not a solutions WG

   Geoff

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Sun, 23 Jul 2006 23:08:44 +0200

> Yes discontiguous deployment should provide improved security and  

Sigh.

Don't you get that too many requirements makes for bad solutions?!

We should reserve the word "requirement" only for those things that  
are so essential that without them, a solution isn't worth having.

This doesn't qualify.

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 24 Jul 2006 11:35:27 -0400

> useful even if deployed in a noncontiguous way? Or should this not be a

IMO, a mechanism that supports non-contiguous deployment SHOULD be
a goal (in the RFC SHOULD sense).

Also, IMO, a solution MUST discuss the implications of having
or not having support for a non-contiguous security environment.

The implementation will need this as part of its normative language for
interoperating (or not) with a "standard" BGP implementation.

-- Jeff