Subject: Re: [RPSEC] Questions....

From: "Steven M. Bellovin" <[email-masked]>
Date: Sun, 12 May 2002 21:10:57 -0400

In message <[email-masked]>, Rus
s White writes:
>
>I don't know of any--I'm a novice at the security side of
>this.... :-) Maybe someone on list can recommand some good
>security reading for the routing geeks on the list (?).
>

Are you asking for general security or routing security?  For the 
former, the mechanisms are the easy part; it's learning to think 
paranoid that's hard...

For routing security, there are a number of sources.  The oldest that I 
know of is Radia Perlman's dissertation:

@phdthesis{perlman88,
        author = {Radia Perlman},
        school = {M.I.T.},
        year = 1988,
        title = {Network Layer Protocols with Byzantine Robustness}
}

I discussed some routing security issues a bit later:

@article{iphole, 
   author = {Steven M. Bellovin},
   journal = {Computer Communications Review},
   month = {April}, 
   number = {2}, 
   pages = {32--48},
   title = {Security Problems in the {TCP/IP} Protocol Suite},
   volume = {19}, 
   year = {1989},
   annote = {An early paper describing some security risks from the
        then-standard protocols in TCP/IP.  Not
        all of the attacks have happened yet\ldots.},
   url = "ftp://ftp.research.att.com/dist/internet\_security/ipext.ps.Z"
}

For some defenses, see RFC 2328, 2154, 2385.  For BGP defenses, see

@article{sbgp1,
        author = {Stephen Kent and Charles Lynn and Karen Seo},
        title = {Secure Border Gateway Protocol {(Secure-BGP)}},
        journal = {IEEE Journal on Selected Areas in Communications},
        volume = 18,
        number = 4,
        month = {April},
        year = 2000,
        pages = {582--592}
}       
        
@inproceedings{sbgp2,
        author = {Stephen Kent and Charles Lynn and Joanne Mikkelson and Karen Seo},
        title = {Secure Border Gateway Protocol {(S-BGP)} -- Real World Performance and Deployment Issues}, 
        booktitle = {Proceedings of the IEEE Network and Distributed System Security 
Symposium},
        year = 2000,
        month = {February}
}       

Other papers include

Badger, M.R., and S.L. Murphy. 1996. "Digital Signature Protection of the OSPF Routing Protocol," pp. 93-102 in Proceedings of the Symposium on Network and Distributed System Security. Los Alamitos, CA: IEEE Computer Society Press.

Hauser, R., T. Przygienda, and G. Tsudik. 1997. "Reducing the Cost of Security in Link-State Routing," pp. 93-101 in Proceedings of the Symposium on Network and Distributed System Security. Los Alamitos, CA: IEEE Computer Society Press.

Sirois, K.E., and Stephen T. Kent. 1997. "Securing the Nimrod Routing Architecture," pp. 74-84 in Proceedings of the Annual Internet Society (ISOC) Symposium on Network and Distributed System Security. Los Alamitos, CA: IEEE Computer Society Press.

Smith, B.R., S. Murthy, and J.J. Garcia-Luna-Aceves. 1997. "Securing Distance-Vector Routing Protocols," pp. 85-92 in Proceedings of the Annual Internet Society (ISOC) Symposium on Network and Distributed System Security. Los Alamitos, CA: IEEE Computer Society Press.

		--Steve Bellovin, http://www.research.att.com/~smb
		Full text of "Firewalls" book now at http://www.wilyhacker.com

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec