Subject: [Sidrops] Hi all, about the prensetation of draft-shen-sidrops-region-verification, some reply are here

From: "Wanghaibo (Rainsword)" <[email-masked]>
Date: Mon, 2 Aug 2021 11:36:42 +0000

Hi all,

4) Haibo Wang - [10 minutes] Region Verification
draft-shen-sidrops-region-verification

Randy Bush:
This model assumes in region “no routers are compromised” - if this is true with neighbors then no body on the internet is compromised.

[Reply]： Our model does not assume that region routers are not compromised. This feature protects routes in the region to improve the region's security. If an external route enters the region, whether the route is still secure is beyond the protection scope of this model.

Ben Maddison:
There are a lot of problems with this approach. The two most problemmatic are: The first one is the one Randy just called out, no operator in the DFZ is trusted enough not to be capable of making a configuration error, this is unworkable since few operators will establish a regional confederation and work on the assumption of trust inside the region.

[Reply]: Configuration mistakes are inevitable, and the model here is used to measure the impact of others' actions on their own routing.

The second problem is that it makes the internet topology as a whole extremely fragile: the rules as enumerated would cause valid routes, transiting to be rejected as well. If peering broke, the “outside” routes would be rejected. ASPA objects in system to confirm the AS is a legit. transit provider, then there seems to be a very corner-case attack vector. I don’t think this approach is worth pursuing.

[Reply]:  Of course, the scenarios listed here are simplified scenarios. There are multiple links between ISP1 and ISP2, which can provide sufficient protection or can be protected by other confederation members, perhaps ISP4, ISP5. Traffic is not expected to be detoured through ISP1.
This method does not result in rejection of valid routes. It protects only the routes belong to local region and does not assume external routes. The model here protects the learning paths of these local region routes. In practice, some carriers also deploy many as-path-filters to perform similar path filtering.

Rudiger Volk: problem scenario was “route propagation between various ASN not secure” then create fairly complex scheme of data, checks to secure things. not questioning, what checks are done and what checks would be reasonable to do, at the various places, is missing. I have trouble to believe you really assume within one ISP 2 dozen AS are fully interconnected without any checks and thats reasonable policy. Randy was succinct, but please explain exactly what checks and guarantees you are assuming or dropping within your starting scenario

[Reply]：The model here does not reduce the existing protection measures, but adds new method to strengthen the protection of itself.
The data model here is not complex. Only need to specify the ISP's own ASes. These ASes are public information, but they are not aggregated for use before.

Job Snijders: it appears to me your users are not like those in Europe, you are needing to form “aggregates” of some kind. I think you might need to go IDR to discuss. Encourage you to specify in ASN.1 how you envision the objects, to facilitate the discussion.

[Reply]：Thanks, we will consider your suggestions.

Regards,
Haibo