Subject: Re: [RPSEC] Situation with BGP security reqs draft

From: Sandy Murphy <[email-masked]>
Date: Wed, 26 Jan 2005 12:19:57 -0500 (EST)

>     b3) It SHOULD be verifyable that each party on the path
>         was authorized to readvertise the route to exactly
>         the next AS. ("transit authorization")

Could you expand on this?  A sends something to B and says
"you may advertise this to C and D but not E"?

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stefan Mink <[email-masked]>
Date: Wed, 26 Jan 2005 21:21:34 +0100

>"you may advertise this to C and D but not E"?

e.g. a transit customer is not allowed to readvertise prefixes to peers or
other transits, but he is allowed to readvertise them to hist transit 
customers.
b3 aims at checking exactly that authorization..

I tried to build a checking system build on community markings, but it's
not real security. Just in case you want wo have a look at it:
http://www.mink.de/academics/self/IDRWS_2004_mink.pdf

   tschuess
             Stefan Mink
-- 
Stefan Mink, Schlund+Partner AG (AS 8560)
Primary key fingerprint: 389E 5DC9 751F A6EB B974  DC3F 7A1B CF62 F0D4 D2BA