Subject: RE: [Asrg] Re: Documents for LMAP BOF

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 7 Feb 2004 14:01:41 -0800

Some comments:

1) BGP Security Concerns

	The primary security concern that needs to be addressed is the
incentive to hijack legitimate IP address blocks via BGP spoofing.

	This is something the IAB should consider as a matter of urgency.
The only proposal made in the area (Kent) is undeployable, it requires
adding IPSEC to every router on the backbone which ain't happening and is
not necessary.

	It is very clear that the ISPs will be deploying IP based
authentication schemes in the near future regardless of concerns raised by
the IETF.

2) DNS Security Concerns

	The DNS statement is incorrect. The DNS does have security, it just
is not very good and it is not cryptographically based.

	The cookie mechanism is limited to a 16 bit cookie. This could be
easily extended to 128 bits by means of a dummy resource request.

	DNSSEC is undeployable as currently specified. The IESG is aware of
this issue.

3) We do not need yet another IP authentication scheme.

	At this point proposing yet another scheme based on the same
principles does not contribute to the discussion.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 07 Feb 2004 22:49:50 -0500

> incentive to hijack legitimate IP address blocks via BGP spoofing.

Is this the same IP spoofing issue being addressed in the end of this 
message:

http://www1.ietf.org/mail-archive/working-groups/asrg/current/msg08549.html
> is not very good and it is not cryptographically based.

Doesn't this cover this:

"2.3.2 Increased incentive for DNS cracks

    LMAP will also have the effect of increasing the incentives
    for spammers to crack and subvert DNS servers (in order to
    spoof receivers doing LMAP checks against the DNS database).
"

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Some lies are easier to believe than the truth" (Dune)
-------