Subject: [sidr] I-D Action: draft-ietf-sidr-pfx-validate-02.txt

From: [email-masked]
Date: Mon, 11 Jul 2011 14:51:54 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF.

	Title           : BGP Prefix Origin Validation
	Author(s)       : Pradosh Mohapatra
                          John Scudder
                          David Ward
                          Randy Bush
                          Rob Austein
	Filename        : draft-ietf-sidr-pfx-validate-02.txt
	Pages           : 11
	Date            : 2011-07-11

   To help reduce well-known threats against BGP including prefix mis-
   announcing and monkey-in-the-middle attacks, one of the security
   requirements is the ability to validate the origination AS of BGP
   routes.  More specifically, one needs to validate that the AS number
   claiming to originate an address prefix (as derived from the AS_PATH
   attribute of the BGP route) is in fact authorized by the prefix
   holder to do so.  This document describes a simple validation
   mechanism to partially satisfy this requirement.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sidr-pfx-validate-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-sidr-pfx-validate-02.txt

---

From: Pradosh Mohapatra <[email-masked]>
Date: Mon, 11 Jul 2011 16:24:04 -0700

FYI... This version addresses comments from Geoff (put a reference to ietf-sidr-origin-ops + some word-smithing). Would appreciate another review.

- Pradosh

---

From: Randy Bush <[email-masked]>
Date: Tue, 12 Jul 2011 15:25:03 +0900

of course i could pick nits, but it looks ok to me.

randy

---

From: Roque Gagliano <[email-masked]>
Date: Wed, 27 Jul 2011 17:46:17 -0400

Hi Pradosh, 

I read the document and I think it is in great shape. I found some nits and have some comments.

Roque

General Comment:
  " Depending on the lookup result, we define a property for each route,
   called the "validity state".  It can assume the values "valid", "not
   found", or "invalid"."

You may want to consider calling it "Origin AS validity state" to distinguish it from the validity state in BGPSEC ("valid" and "invalid").

Section 1:
p2: s/verifyable/verifiable

Section 2:
   "An AS can originate more than one
   prefix set.  Thus, multiple prefix sets in the database can contain
   the same origin AS(es)."

I believe you also need to mention that in the table there may be "multi-origin prefixes". Geoff report identifies 2400 but you may find more in local/regional environments (http://bgp.potaroo.net/as6447/report.txt).

Section 5:
p5: 
I believe you should reference draft-ietf-sidr-origin-validation-signaling-00

Security Consideration:
I think you need to consider what you already mentioned in section 4, if the connectivity to the local-caches is lost, invalid routes will be classified as "not-found", which could have a different set of local policies.

> 
> 
> 
> n Jul 11, 2011, at 7:24 PM, Pradosh Mohapatra wrote:
> 
>> _______________________________________________
>> sidr mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/sidr
>