Subject: [lisp] Using Signed object to validate entries in Mapping Database: draft-lisp-rgaglian-ioa-00.txt

From: Roque Gagliano <[email-masked]>
Date: Sun, 22 Mar 2009 14:39:29 -0700

Hi,

As mentioned some months ago in the lisp-interest mailing list I  
believe that the work in SIDR WG can be somehow used to verify  
authority of the entries on the mapping database, particularly for  
LISP but in general for Map&Encap solutions.

I compiled a first draft and I am sorry that did not make it to the  
cut date. The draft can be downloaded at: http://iie.fing.edu.uy/~rgaglian/drafts/draft-lisp-rgaglian-ioa-00.txt

The idea is to generate a CMS signed object where an EID (or set of  
EID) address holder can sign the authority for a set of RLOC to be  
associated with them in the mapping database. I call this objects IOA.

The verification can be done by:
	- the mapping system before accepting an entry in the mapping database.
	- the mapping clients to verify the answers from the mapping system.

How would you use this in LISP?

I believe it can integrate well with the map-server as the number of  
signed object will probably be big. Be aware that I am not describing  
how to secure the channel to the map-server (that should be internal  
to the ISP).

Another option is to load the xTR with map filters with the data from  
the IOAs.

I look forward to hear your comments,

Roque

---

From: Olivier Bonaventure <[email-masked]>
Date: Tue, 24 Mar 2009 16:13:16 +0100

Roque,
> 
> As mentioned some months ago in the lisp-interest mailing list I believe
> that the work in SIDR WG can be somehow used to verify authority of the
> entries on the mapping database, particularly for LISP but in general
> for Map&Encap solutions.
> 
> I compiled a first draft and I am sorry that did not make it to the cut
> date. The draft can be downloaded at:
> http://iie.fing.edu.uy/~rgaglian/drafts/draft-lisp-rgaglian-ioa-00.txt

Thanks for this draft.

Securing the mapping system is an important problem that hasn't received
enough attention on the lisp mailing list. I hope that once the nitty
details of the charter have been sorted out we'll be able to have
technical discussions on this topic on the mailing list.

> The idea is to generate a CMS signed object where an EID (or set of EID) address holder can sign the authority for a set of RLOC to be associated with them in the mapping database. I call this objects IOA.
> 

This is a possible approach. It would be interesting to discuss how the
IOA would be discributed ?
One option could be a central repository such as a RIR containing all
the IOAs
Another option could be to include the IOA in the mapping reply or the
url of the IOA in the mapping reply.

Olivier

-- 
http://inl.info.ucl.ac.be , UCLouvain, Belgium

---

From: Roque Gagliano <[email-masked]>
Date: Wed, 25 Mar 2009 09:14:31 -0700

Hi Olivier,
> url of the IOA in the mapping reply.

The way that RPKI works is by using a distributed repository where  
each signed object (ie certificates, ioa, roas) mentions the location  
of its repository. So, yes the RIR have a repository for the first two  
layers of material (certificates to ISPs) but the ISP then can  
implement their own CA and their own repository to host its signed  
objects (ie ioas).

The protocol propossed to fetch all these object from various  
repositories is rsync and normally a relying party has a local cache  
with all the material that has download. There is a lap that by design  
we took as 24hs from time I update my repository until every party has  
the latest copy.

Regards,
r.

---

From: Olivier Bonaventure <[email-masked]>
Date: Thu, 26 Mar 2009 10:00:02 +0100

Roque,
> The way that RPKI works is by using a distributed repository where each
> signed object (ie certificates, ioa, roas) mentions the location of its
> repository. So, yes the RIR have a repository for the first two layers
> of material (certificates to ISPs) but the ISP then can implement their
> own CA and their own repository to host its signed objects (ie ioas).
> 

I think that the rsync distribution method used by RPKI is valid for
checking the BGP messages. As each ISP receives BGP advertisements for
all prefixes, it needs to have all the certificates to validate the
received BGP messages.

For LISP, it is unclear to me whether this model is the most appropriate
one. An ITR that sends mapping requests and wants to validate the
mapping replies will usually not receive mapping replies from all over
the world. In fact, small ITRs will only receive mapping replies from a
small number of prefixes and only these replies need to be checked. For
such small sites, it would be useful to have certificate repositories
than can be checked online.

Olivier