Subject: [RPSEC] Rpsec update, seen from ISP point of view.

From: Joachim Jensen <[email-masked]>
Date: Tue, 23 Jul 2002 10:59:47 +0200

I feel like this conversation is about to forget the milestones and goals :)

To get the 'Internet Draft' point 1 clear 'which details the threats to
routing systems', I think we need to set up some points of action.

Draft:
Like what kind of protocols do we have to distinguish between? IGP/EGP,
DV/LS (as we started out)?
What kind of security issues do we have in the respective protocols?

How about listing all thinkable protocols, and then figure out which
security issues is related to the 
individual protocol, and which are general for some types..

Like for instance OSPF.. OSPF is an IGP using TCP as communication, working
on layer-3..

Okay, What kind of threats do we see here? -Hmmm. OSPF is encapsulated in
IP, which makes it subject
to spoofing and Denial Of Service attacks. These vulnerabilities is
sometimes more theoretical than
actually problems, but you could imagine some kind of 'TCP RST' by
bruteforcing TCP seq number..
or maybe creating 'fake' OSPF neighbors and sending LSA packets with fake
network statements..

On the contrary this is not possible when using IS-IS, because IS-IS does
not work on the networklayer (using OSI instead). This makes it more the
less impossible for outsiders to destroy your IGP, unless they
have physical access to your network and makes some kind of NSAP poisoning..

When we talk about BGP-4, also using TCP, we have more the less the same
security issues as in OSPF..
The idea of MD5 hashing (RFC 2385) solves this problem. But as this is
mostly used in IBGP, it's not of much use. I have never seen this used
between upstreamers or at Internet eXchanges.. Maybe this could be
somehow standard in the protocol?? -like some kind of RSA key being
exchanged and negotiated during handshake? hmmm..

-seen from an ISP point of view. :-}

Joachim Jerberg Jensen
Orange Denmark
AS_12435

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec