Subject: Re: [RAM] Incremental Deployment of LISP

From: Eliot Lear <[email-masked]>
Date: Mon, 02 Apr 2007 10:35:03 +0200

[resending to RAM]

Markus Stenberg wrote:
> 'signed by an authority', which is that?

This is the right question to ask.  There can be several answers but 
they all will have the flavor of being a small number of entities 
distributing to a large number of receivers, probably through at least 
one additional distribution level.  IMHO we should engineer for the 
ability to process these updates end to end in about a minute, but that 
you REALLY don't want to update more than once an hour.

Consider the following possibilities for authorities:

   * IANA - the ultimate source of address space
   * RIRs - the delegated sources of address space
   * A new "Locator Registry"(*) - a new delegated source of PI addresses

Each of these has pluses and minuses.  I suspect that if we advance LISP 
further an additional internet draft is in order.

Eliot

_______________________________________________
RAM mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ram

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 02 Apr 2007 11:19:35 +0200

>   * A new "Locator Registry"(*) - a new delegated source of PI addresses

ULAs are self-assigned PI, so the authority is the site using them.
An interesting security property...

     Brian

---

From: Eliot Lear <[email-masked]>
Date: Mon, 02 Apr 2007 11:55:18 +0200

> An interesting security property...

It's not secure at all.  I can pick the same ULA you are using.

Eliot

---

From: Andrew McGregor <[email-masked]>
Date: Mon, 2 Apr 2007 22:00:59 +1200

> It's not secure at all.  I can pick the same ULA you are using.

Which is the strength of HIP.... it doesn't matter unless you have  
picked the same private key as well, which is astronomically unlikely.

Andrew

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 02 Apr 2007 14:46:02 +0200

> It's not secure at all.  I can pick the same ULA you are using.

Sure. That's why they must be blocked by border routers. But if they
were registered automatically in a FCFS registry, we could find a way
round this (and the registry would become the authority).

     Brian