Subject: Re: [RPSEC] Questions....

From: Russ White <[email-masked]>
Date: Thu, 9 May 2002 06:12:43 -0400 (EDT)

> There is a very big difference between claiming to be part of
> a certain AS and claiming to be on the path to a certain AS.  
> In link state systems that distinction is intrinsic to the
> system.  Even with vector based systems, there are a range of
> counter-measures that are different in dealing with the two
> issues.  I suggest that they be treated separately.

So, you think we should treat the link state igp's different than
the path vector bgp.... I would tend to agree that we are going
to see a completely different set of problems, and thus should
treat them in two seperate sets of drafts, probably.

How well can we _really_ secure the concept of "being on a path
to a given as?" I've been looking at this problem for some
time--while it seems easy enough to verify where an advertisement
has gone, it seems much more difficult to actually verify that
the path shown is actually a valid and good path to the given
destination. In fact, I think we wander into trying to get
trust that needs to be based on a relationship out of simple
electronic signatures, and I'm not certain it's going to work.

The only apparent way to do this is to provide the ability to map
the topology of a network, and verify the path against a known
topology database maintained by a trusted thrid party. This seems
to run counter to good network design (hiding information) and to
good business tactics (hiding information). In fact, you could so
far as to say that netowrks scale by hiding topology information,
while propogating reachability information. Aggregation, as
boundaries, area bounderies--they all serve this (implicit)
purpose--to hide topology while exposing reachability.

I'm not quite certain what the solution is to this apparent
contradiction (?).

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Joel M. Halpern" <[email-masked]>
Date: Thu, 09 May 2002 08:23:51 -0400

Yes, I think there are significant threat differences affected by the style 
of protocol used.
However, I was more focussing on the issue you got to in the later portion 
of your note.  We can talk about whether someone has the right to advertise 
certain internal properties (has internal reachability to certain address 
blocks for example.)  We can talk about whether some can speak on behalf of 
a given entity (speak for an AS, legitimately introduce an advertisement in 
either vector or map systems claiming to have been originated by a specific 
entity, ...)  However, in path systems the amount we can practically 
accomplish with regard to manipulations of the path portion of the 
advertisement is moderately limitted, and tends to end up with things that 
are in the earlier set.  Trying for example to ensure that an intermediate 
node in a path does not remove some elements of the path information (but 
retain the origination) or that the node correctly represents cumulative 
QoS quantities of the path as it sees them, require MUCH heavier weight 
mechanisms an specifically require very different mechanisms than the first 
set of issues.

Yours,
Joel M. Halpern