5 ms·

There is an obvious solution, but it's an enormous undertaking. Each level of delegation must be cryptographically validated. Route announcements not signed us

There is an obvious solution, but it's an enormous undertaking. Each level of delegation must be cryptographically validated. Route announcements not signed using a certificate to which authority for that block has been delegated must be rejected.

bcoates 12y ago
How would that work? You could sign that you trust your next-to-last hops to deliver traffic to you but transitive delivery isn't guaranteed and not every chain of valid hops is actually workable as a route capacity-wise. A completely signature-valid route with near 100% packet loss isn't much better than an undeliverable leak.
- nknighthb 12y ago
  The entirety of all possible AS paths don't need to be signed to make a difference. Even just signing the last 1-2 ASs would stop most of the big screwups.
- noselasd 12y ago
  There's an architecture for doing orignation validation in BGP, lot's of info if you want to listen to http://packetpushers.net/show-105-bgp-origin-validation-with-resource-public-key-infrastructure-rpki/ http://packetpushers.net/show-105-bgp-origin-validation-with... However, it pretty much requires everyone to do it.
Someone1234 12y ago
That would work but as they say the devil is in the details. For example, are we checking CRLs & would this slow propagation (and what if the server is down), what about countries unable to get CA generated certificates due to political embargos (on either their money or businesses are just restricted from doing business with them e.g. Iran, NK, etc), it would grant the US government even more control over the internet (as now they control many root DNS servers and root CAs) which they could use for military or political purposes, and so on. I'm not saying that the concept doesn't have merit. BGP is quite evidently deeply flawed. However this solution has so many gotchas, question marks, and complexity to it you really need to dig deep down into the proposal before knowing if it is even a good plan.

bcoates 12y ago

How would that work? You could sign that you trust your next-to-last hops to deliver traffic to you but transitive delivery isn't guaranteed and not every chain of valid hops is actually workable as a route capacity-wise. A completely signature-valid route with near 100% packet loss isn't much better than an undeliverable leak.

nknighthb 12y ago
The entirety of all possible AS paths don't need to be signed to make a difference. Even just signing the last 1-2 ASs would stop most of the big screwups.
noselasd 12y ago
There's an architecture for doing orignation validation in BGP, lot's of info if you want to listen to http://packetpushers.net/show-105-bgp-origin-validation-with-resource-public-key-infrastructure-rpki/ http://packetpushers.net/show-105-bgp-origin-validation-with... However, it pretty much requires everyone to do it.

Someone1234 12y ago

That would work but as they say the devil is in the details. For example, are we checking CRLs & would this slow propagation (and what if the server is down), what about countries unable to get CA generated certificates due to political embargos (on either their money or businesses are just restricted from doing business with them e.g. Iran, NK, etc), it would grant the US government even more control over the internet (as now they control many root DNS servers and root CAs) which they could use for military or political purposes, and so on. I'm not saying that the concept doesn't have merit. BGP is quite evidently deeply flawed. However this solution has so many gotchas, question marks, and complexity to it you really need to dig deep down into the proposal before knowing if it is even a good plan.