Subject: [Sidr] a proposal

From: zhaoye <[email-masked]>
Date: Thu, 11 May 2006 16:29:55 +0800

Hi Geoff,

Current SIDR proposals focus on validation of BGP UPDATEs. I think the way
to prevent an AS from advertising error information is another important
aspect. Since manual configuration and misconfiguration is an important
reason of the problem, to solve the problem in the first place is necessary
to mitigate possible sufferings. 
Therefore, I propose that relative task should be included in SIDR.

thanks

Zhao Ye

_______________________________________________
Sidr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sidr

---

From: Geoff Huston <[email-masked]>
Date: Thu, 11 May 2006 20:36:14 +1000

Hi,

I should note that the current SIDR work actually does not focus on BGP 
updates - indeed the current focus is on information origination, as this 
aspect of securing the inter-domain  routing system is one where the RPSEC 
WG  requirement work does appear to have reached clear consensus.

So we have a charter and we are assembling material to consider relating to 
the ability to validate the origination of routing information. The ability 
to validate origination encompasses the ability to detect attempts to 
originate incorrect information, including the outcomes of misconfiguration 
you mention in your note.

The next step is to ask if yoiu have a specific proposal here that 
addresses these requirements for validation of origination in routing, and 
if so are you willing to submit this as an Internet draft so that the 
working group can review it, or have you already submitted your ideas as a 
draft?

regards,

     Geoff

---

From: zhaoye <[email-masked]>
Date: Fri, 12 May 2006 14:41:23 +0800

> -----Original Message-----
> From: Geoff Huston [mailto:[email-masked]] 
> Sent: Thursday, May 11, 2006 6:36 PM
> To: zhaoye
> Cc: Sidr
> Subject: Re: a proposal
> 
> Hi,
> 
> I should note that the current SIDR work actually does not 
> focus on BGP updates - indeed the current focus is on 
> information origination, as this aspect of securing the 
> inter-domain  routing system is one where the RPSEC WG  
> requirement work does appear to have reached clear consensus.
> 

OK, I did not select an appropriate term. What I said is about 
origination authentication of a route.

> So we have a charter and we are assembling material to 
> consider relating to the ability to validate the origination 
> of routing information. The ability to validate origination 
> encompasses the ability to detect attempts to originate 
> incorrect information, including the outcomes of 
> misconfiguration you mention in your note.
> 

After reading the SIDR charter and PRSEC BGP security requirement, 
I did not make sure whether "the ability to detect attempts to originate 
 incorrect information" is a work group task before. 
I think validation of an incoming route and prevention of originating an 
invalid route are different function modules. Although both may be  included
in a completed BGP security solution, the latter can be implemented  solely.

I have not considered specific modification of BGP, but I think such
implement is low cost and 
suits for routers with limited resource.

> The next step is to ask if yoiu have a specific proposal here 
> that addresses these requirements for validation of 
> origination in routing, and if so are you willing to submit 
> this as an Internet draft so that the working group can 
> review it, or have you already submitted your ideas as a draft?

>      Geoff

Yes, I am preparing a draft and will submit it in a few days.