3 ms·

RPKI doesn't make BGP safe, it makes it safer. BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to tha

RPKI doesn't make BGP safe, it makes it safer. BGP hijacks can still happen. RPKI only secures the ownership information of a given prefix, not the path to that prefix. Under RPKI, an attacker can still claim to be on the path to a victim AS, and get the victim's traffic sent to it. The solution to this was supposed to be BGPSec, but it's widely seen as un-deployable.

impl 6mo ago
I believe the current attempt at mitigation for this is ASPA[0]. It still has a long way to go, but there are some big names behind it. [0]: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-asp...
- greyface- 6mo ago
  It has a long way to go, in the same sense that ROA had a long way to go when Cloudflare first launched this site in 2020. ASPA records are fully supported by both RIPE and ARIN these days.
Retr0id 6mo ago
> and get the victim's traffic sent to it This sounds "obviously bad" but the intricacies of routing aren't really my field, could you expand on why this is bad? (i.e. what specific bad things does it enable)
- maltalex 6mo ago
  Here are some examples: The attacker can impersonate the victim, get a valid x509 certificate issued to it, and create a perfect replica of their website/api/whatever. The attacker can perform a man-in-the-middle attack on the victim - record traffic, inject traffic, manipulate traffic, etc. The attacker can just deny access to the victim - just drop packets meant for the victim.
rot256 6mo ago
I think that way to solve BGPs security problems might be to use a new cryptographic hammer, "Proof-Carraying Data", where messages come with cryptographic proofs that they were produced correctly. This allows you to basically just run BGP, but every AS proves that it ran it correctly. The proofs take constant time to verify, regardless of how large the network is, or how many hops the routing message has taken. Feasibility is helped by latency not being super critical in BGP and BGP being a pretty simple protocol; which makes computing these proofs plausible. https://rot256.dev/post/bgp-pcd/ https://rot256.dev/post/bgp-pcd/ Proof-carrying data has come a long way in the last 10 years. EDIT: you would still need RPKI, but not BGPSec
diablevv 6mo ago
[dead]
heyethan 6mo ago
[flagged]
- deleted 6mo ago
  [deleted]
hugo1789 6mo ago
I think RPKI is good enough. As we have TLS on top it doesn't need to be perfect.
- maltalex 6mo ago
  Only with certificate pinning or something similar. Otherwise, the attacker can get valid TLS certificates for any domain hosted on the hijacked IP addresses.
- rot256 6mo ago
  For LetsEncrypt, routing is authentication: if packets routed to the IP in the A record end up at your place, you can get a cert for that domain.
  - gerdesj 6mo ago
    DNSSEC and DNS-01 challenges might do the trick at the cost of significant effort, provided LE could be directed to check, similar to the way MTA-STS works.
    - fanf2 6mo ago
      Let’s Encrypt has been doing DNSSEC validation for years. DNSSEC could have prevented the jabber.ru MITM attack.
- zymhan 6mo ago
  Those two things address orthogonal issues
altairprime 6mo ago
“Safe” the platonic ideal is an impossibility. Any cryptographic solution depends ultimately on handshake agreements between fallible human executives and/or fallible human registries, and there’s no known alternative to that today. Is RPKI “safe”, relative to not RPKI? Yes, obviously, it is. Is it reasonable to interpret “safe” as ‘no further improvement is required’? Never: this is the Internet; one could expect the domain to be repurposed to cover more than RPKI someday. Yes, short-sighted leaders may use “RPKI is safe” as justification to withhold investment forward past it; but that outcome is certain regardless of how they justify it.

impl 6mo ago

I believe the current attempt at mitigation for this is ASPA[0]. It still has a long way to go, but there are some big names behind it. [0]: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-asp...

greyface- 6mo ago
It has a long way to go, in the same sense that ROA had a long way to go when Cloudflare first launched this site in 2020. ASPA records are fully supported by both RIPE and ARIN these days.

Retr0id 6mo ago

> and get the victim's traffic sent to it This sounds "obviously bad" but the intricacies of routing aren't really my field, could you expand on why this is bad? (i.e. what specific bad things does it enable)

maltalex 6mo ago
Here are some examples: The attacker can impersonate the victim, get a valid x509 certificate issued to it, and create a perfect replica of their website/api/whatever. The attacker can perform a man-in-the-middle attack on the victim - record traffic, inject traffic, manipulate traffic, etc. The attacker can just deny access to the victim - just drop packets meant for the victim.

rot256 6mo ago

I think that way to solve BGPs security problems might be to use a new cryptographic hammer, "Proof-Carraying Data", where messages come with cryptographic proofs that they were produced correctly. This allows you to basically just run BGP, but every AS proves that it ran it correctly. The proofs take constant time to verify, regardless of how large the network is, or how many hops the routing message has taken. Feasibility is helped by latency not being super critical in BGP and BGP being a pretty simple protocol; which makes computing these proofs plausible. https://rot256.dev/post/bgp-pcd/ https://rot256.dev/post/bgp-pcd/ Proof-carrying data has come a long way in the last 10 years. EDIT: you would still need RPKI, but not BGPSec

diablevv 6mo ago

[dead]

heyethan 6mo ago

[flagged]

deleted 6mo ago
[deleted]

hugo1789 6mo ago

I think RPKI is good enough. As we have TLS on top it doesn't need to be perfect.

maltalex 6mo ago
Only with certificate pinning or something similar. Otherwise, the attacker can get valid TLS certificates for any domain hosted on the hijacked IP addresses.
rot256 6mo ago
For LetsEncrypt, routing is authentication: if packets routed to the IP in the A record end up at your place, you can get a cert for that domain.
- gerdesj 6mo ago
  DNSSEC and DNS-01 challenges might do the trick at the cost of significant effort, provided LE could be directed to check, similar to the way MTA-STS works.
  - fanf2 6mo ago
    Let’s Encrypt has been doing DNSSEC validation for years. DNSSEC could have prevented the jabber.ru MITM attack.
zymhan 6mo ago
Those two things address orthogonal issues

altairprime 6mo ago

“Safe” the platonic ideal is an impossibility. Any cryptographic solution depends ultimately on handshake agreements between fallible human executives and/or fallible human registries, and there’s no known alternative to that today. Is RPKI “safe”, relative to not RPKI? Yes, obviously, it is. Is it reasonable to interpret “safe” as ‘no further improvement is required’? Never: this is the Internet; one could expect the domain to be repurposed to cover more than RPKI someday. Yes, short-sighted leaders may use “RPKI is safe” as justification to withhold investment forward past it; but that outcome is certain regardless of how they justify it.