Subject: Re: [RPSEC] Quesitons....

From: "Joel M. Halpern" <[email-masked]>
Date: Thu, 09 May 2002 08:17:19 -0400

There is a very big difference between claiming to be part of a certain AS 
and claiming to be on the path to a certain AS.  In link state systems that 
distinction is intrinsic to the system.  Even with vector based systems, 
there are a range of counter-measures that are different in dealing with 
the two issues.  I suggest that they be treated separately.

Yours,
Joel M. Halpern

At 06:01 AM 5/9/2002 -0400, Russ White wrote:

>Okay, this list is too quiet. So BOO!
>
>I think we need to get some discussion rolling here, and decide
>how we are going to get some drafts up and going. So, to that
>end, some questions:
>
>-- There appear to be several seperate problems in securing
>routing systems:
>
>-- Knowing for certain the the device/as advertising a given
>address actually should be advertising that address. For
>instance, you are receiving an advertisement for 10/8 from AS
>65000. Should as 6500 really be advertising this destination as
>reachable?
>
>-- Knowing for certain that a device/as advertising a given
>address is who it claims to be. For instance, some device
>claiming to be part of as 65000 is advertising 10/8. Is it really
>part of that as?
>
>The second aspect is represented in a couple of ways--a "man in
>the middls" can grab your traffic (or misdirect it) by claiming
>as 65000 is behind them, or by stating that they are as
>65000. Either one seems to work equally as well.
>
>Are these two seperate problems which need to be solved in two
>seperate ways? Are they applicable to all protocols? How much of
>a chunk of these two problems does securing the interrouter
>communications within a given protocol solve any of these
>problems?
>
>Should we address these as seperate problems in seperate
>documents, or should an entire system stand or fall as one unit?
>
>On another topic, should we have two seperate sets of drafts for
>requirements docs, one for interior protocols, and one for
>exterior protocols? Should we form technical subgroups to work on
>these?
>
>:-)
>
>Russ
>
>
>__________________________________
>[email-masked] CCIE <>< Grace Alone
>
>
>
>_______________________________________________
>RPSEC mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/rpsec

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec