Subject: Re: [RPSEC] Quesitons....

From: [email-masked]
Date: Thu, 9 May 2002 10:13:31 -0400 (EDT)

>How well can we _really_ secure the concept of "being on a path
>to a given as?" I've been looking at this problem for some
>time--while it seems easy enough to verify where an advertisement
>has gone, it seems much more difficult to actually verify that
>the path shown is actually a valid and good path to the given
>destination.

"Gone"?  I would say you can verify where the advertisement has "come
from" - is that what you meant?  I don't know how one would verify
where something had gone.  The protocol could return acks, but that
would only give you a lower bound on receivers.

But I agree completely with the "much more difficult" part for vector
sorts of protocols.  And with Joel, who talked about "MUCH heavier
weight mechanisms".  Because each participant transmits the result of
a computation on its input data, and what you want is some assurance
that the computation is based on legitimate input.

>The only apparent way to do this is to provide the ability to map
>the topology of a network, and verify the path against a known
>topology database maintained by a trusted thrid party.

Two rhetorical questions:

If the trusted third party has a known topology database, why do you
need a routing protocol to transmit topology information around?  Why
not just download the trusted database?

If you say you need a routing protocol to transmit the up/down
status information, why transmit the topology information as well?

I think part of the problem at the inter-domain level is that routing
decisions are based not only on topology and status, but on business
arrangements.  So the the route may be exist and be up, but you and
your peering partner haven't agreed yet to transit that network's
traffic.  (If this were not the case, the Smith/Garcia-Lunes-Aceves
protections for BGP would be sufficient.)

>In fact, you could so
>far as to say that netowrks scale by hiding topology information,
>while propogating reachability information. Aggregation, as
>boundaries, area bounderies--they all serve this (implicit)
>purpose--to hide topology while exposing reachability.

But hiding information is exactly what makes the system vulnerable.
"I've got a path to network N, just trust me" affects not only the
receiver who believes it but everyplace that the receiver passes it
on to.

Peers trust their partners, but we're trying to protect the global
structure.  If that trust is misplaced, it's not just the trusting
partner who suffers, it's the global structure.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Thu, 9 May 2002 21:14:07 -0400 (EDT)

> from" - is that what you meant?  

Come from is correct.

> But I agree completely with the "much more difficult" part
> for vector sorts of protocols.  And with Joel, who talked
> about "MUCH heavier weight mechanisms".  Because each
> participant transmits the result of a computation on its
> input data, and what you want is some assurance that the
> computation is based on legitimate input.

> If the trusted third party has a known topology database, why
> do you need a routing protocol to transmit topology
> information around?  Why not just download the trusted
> database?

I'm not so certain this is rhetorical, actually. But we need to
seperate topology from reachability--any topology of the as'
would tell you what the network looks like, but it won't tell how
to reach a given host within that network.

The problem is to me that it's _precisely_ topology information
that is to be hidden in order to provide scalability, and a lot
of provider's aren't going to want topology information
distributed--that involves knowing who they are connected to and
where, pretty much, and it could be considered information which
is subject to security issues of its own.

> I think part of the problem at the inter-domain level is that
> routing decisions are based not only on topology and status,
> but on business arrangements.  So the the route may be exist
> and be up, but you and your peering partner haven't agreed
> yet to transit that network's traffic.  (If this were not the
> case, the Smith/Garcia-Lunes-Aceves protections for BGP would
> be sufficient.)

Right.

> But hiding information is exactly what makes the system
> vulnerable. "I've got a path to network N, just trust me"
> affects not only the receiver who believes it but everyplace
> that the receiver passes it on to.
> 
> Peers trust their partners, but we're trying to protect the
> global structure.  If that trust is misplaced, it's not just
> the trusting partner who suffers, it's the global structure.

I suppose my question is: At what point do we have to trust the
peering relationships, and at what point do we force information
into the open to verify the topology? One key difference between
igp's and egp's may just be that we have to work within the
bounds of what's an acceptable level of information to reveal in
terms of topology information within the egp world, while this is
not a big deal in the igp world.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone

---

From: Gwendolynn ferch Elydyr <[email-masked]>
Date: Fri, 10 May 2002 17:13:57 -0400 (EDT)

> protections for BGP would be sufficient.)

Not to point out the obvious, but dynamic routing protocols are fun and
useful - and imply that it's necessary to transmit both state and
topology information.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."