Subject: RE: [RPSEC] Discontiguous Deployment...

From: "Bora Akyol" <[email-masked]>
Date: Thu, 20 Jul 2006 19:34:03 -0700

>From the beginning of the draft, incremental, non-contiguous
deployment was a requirement.

And IMHO, it should remain so.

Bora

> -----Original Message-----
> From: Russ White [mailto:[email-masked]] 
> Sent: Thursday, July 20, 2006 6:21 PM
> To: [email-masked]
> Subject: [RPSEC] Discontiguous Deployment...
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> Okay, before we get too far into wording, I want to check on 
> list and see what everyone's opinion is....
> 
> Should there be a requirement that any proposed security 
> system must be useful even if deployed in a noncontiguous 
> way? Or should this not be a requirement?
> 
> One we settle this, it should be easier to come to concensus 
> on actual wording, I hope (?)....
> 
> :-)
> 
> Russ
>

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: [email-masked]
Date: Fri, 21 Jul 2006 13:29:02 -0400 (EDT)

Russ White said:

>Should there be a requirement that any proposed security system must be
>useful even if deployed in a noncontiguous way? Or should this not be a
>requirement?

I do not agree that this should be a requirement.

I also don't know how one would meet a requirement of "useful",
or judge whether a mechanism met the requirement of "useful".
Certainly, in each contiguous island of deployment, a mechanism
could be "useful".

--Sandy

---

From: [email-masked]
Date: Mon, 31 Jul 2006 10:14:38 -0400 (EDT)

Iljitsch said:

>There are several ways to solve this, including having a small new
>path attribute that signals the new securit capability and maybe
>points to a rendezvous point where the security information can be
>obtained.
>...
>At the same time, IDR shouldn't be dependent on external services

So it sounds like you are arguing against yourself, here.

I understand the issues with carrying security info in-band through
the unaware gaps.

I also understand the issues with necessitating BGP contact external
(aka out of band) services in order to function.

I don't see an easy resolution.  Do you?
--Sandy