5 ms·

But, with RPKI getting the cert infra in place, would that not then make it relatively easier to take that 2nd step, than when not even RPKI was in place?

topranks 7y ago
The problem is the number of updates / changes that happen all the time in BGP, and having each router cryptographically validate each one / sign every update it sends.... it doesn’t scale well. The BGPSEC theory is there but not sure if we can make a workable system. https://www.potaroo.net/ispcol/2011-07/bgpsec.pdf https://www.potaroo.net/ispcol/2011-07/bgpsec.pdf
- mlyle 7y ago
  Current routers can't handle it, but ... it's not like routes changes that much that we're talking about an intolerable amount of RSA operations. We're really talking about fewer operations per day per router than some web frontends do in a second.
  - tptacek 7y ago
    That doesn't sound right? In 2018 there were, according to Geoff Huston, days with 700,000 updates per day. That sounds high for handshakes/second.
    - mlyle 7y ago
      OK, OK, my bad; a single large multicore NGINX box can only do about 100k full TLS handshakes per second with 2048 RSA. So it'd be several seconds. On the other hand, verify is cheaper. My crappy laptop will do ~320k RSA-2048 verifications per second...
      - deleted 7y ago
        [deleted]
      - mititelu 7y ago
        https://www.nginx.com/wp-content/uploads/2014/07/NGINX-SSL-P.. https://www.nginx.com/wp-content/uploads/2014/07/NGINX-SSL-P.... 350 per core per second... you are way off at 100k/s. If there is such a thing I'd really like to see setup to get it running / try it out myself as well. do note there are ways to cache ssl data so connections are resumed / avoid handshake again for same user
        mlyle 7y ago
        https://www.nginx.com/blog/testing-performance-nginx-ingress-controller-kubernetes/ https://www.nginx.com/blog/testing-performance-nginx-ingress... 60k/second across 24 cores, admittedly on very fast hardware (though not using all the cores that hardware has). Pretty much the same number on 16 cores. In general, telling someone they're "way off" about performance and citing 6 year old benchmarks isn't a winning plan. In any case, it's immaterial to what we're discussing. My slow laptop could verify all the signatures for a busy day of updates in a couple seconds, and it's clearly -possible- to put a big fraction of this horsepower in a router.
        mititelu 7y ago
        Thanks for the reference, new benchmark looks nice. Apologize for the 'way off', its reach-able. And agree its immaterial to signature checks, but since it was brought up... Either way, there is probably something holding routers back from reaching that, would be fun to speculate.

topranks 7y ago

The problem is the number of updates / changes that happen all the time in BGP, and having each router cryptographically validate each one / sign every update it sends.... it doesn’t scale well. The BGPSEC theory is there but not sure if we can make a workable system. https://www.potaroo.net/ispcol/2011-07/bgpsec.pdf https://www.potaroo.net/ispcol/2011-07/bgpsec.pdf

mlyle 7y ago
Current routers can't handle it, but ... it's not like routes changes that much that we're talking about an intolerable amount of RSA operations. We're really talking about fewer operations per day per router than some web frontends do in a second.
- tptacek 7y ago
  That doesn't sound right? In 2018 there were, according to Geoff Huston, days with 700,000 updates per day. That sounds high for handshakes/second.
  - mlyle 7y ago
    OK, OK, my bad; a single large multicore NGINX box can only do about 100k full TLS handshakes per second with 2048 RSA. So it'd be several seconds. On the other hand, verify is cheaper. My crappy laptop will do ~320k RSA-2048 verifications per second...
    - deleted 7y ago
      [deleted]
    - mititelu 7y ago
      https://www.nginx.com/wp-content/uploads/2014/07/NGINX-SSL-P.. https://www.nginx.com/wp-content/uploads/2014/07/NGINX-SSL-P.... 350 per core per second... you are way off at 100k/s. If there is such a thing I'd really like to see setup to get it running / try it out myself as well. do note there are ways to cache ssl data so connections are resumed / avoid handshake again for same user
      - mlyle 7y ago
        https://www.nginx.com/blog/testing-performance-nginx-ingress-controller-kubernetes/ https://www.nginx.com/blog/testing-performance-nginx-ingress... 60k/second across 24 cores, admittedly on very fast hardware (though not using all the cores that hardware has). Pretty much the same number on 16 cores. In general, telling someone they're "way off" about performance and citing 6 year old benchmarks isn't a winning plan. In any case, it's immaterial to what we're discussing. My slow laptop could verify all the signatures for a busy day of updates in a couple seconds, and it's clearly -possible- to put a big fraction of this horsepower in a router.
        mititelu 7y ago
        Thanks for the reference, new benchmark looks nice. Apologize for the 'way off', its reach-able. And agree its immaterial to signature checks, but since it was brought up... Either way, there is probably something holding routers back from reaching that, would be fun to speculate.