Subject: Re: [RPSEC] Quesitons....

From: [email-masked]
Date: Thu, 9 May 2002 10:10:17 -0400 (EDT)

>> There is a very big difference between claiming to be part of
>> a certain AS and claiming to be on the path to a certain AS.  
>> In link state systems that distinction is intrinsic to the
>> system.  Even with vector based systems, there are a range of
>> counter-measures that are different in dealing with the two
>> issues.  I suggest that they be treated separately.
>
>So, you think we should treat the link state igp's different than
>the path vector bgp.... I would tend to agree that we are going
>to see a completely different set of problems, and thus should
>treat them in two seperate sets of drafts, probably.

I agree that link state and distance/path vector systems have very
different security issues.  Link state systems are vulnerable because
of the flooding aspect of link state systems - you are communicating
the same info everywhere but by relying on intermediate systems to
serve as a reliable communication medium.  So the intermediate systems
have the opportunity to manipulate the flooded information to create any
arbitrary topology.  Coincidentally, this flooding of the same
(unchanged) information everywhere makes protecting link state
protocols simple: provide data source authentication protection for
the information.  Done.  (Well, not "done" exactly, the devil is always
in the details.)

But even link state systems have some aspect of the "is this
originator authorized to announce the routing information it is
announcing".  In OSPF, for example, you still have to have some way to
prove the authorization for a router to announce that it is directly
connected to a network N.  You want to be sure that a router that is
producing type 5 LSA's is truly an ASBR.  Etc.

Is the fact that the counter-measures would be different sufficient
reason to provide different security requirements drafts?

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec