Subject: [Sidrops] Maxlength Defaults: Follow Up

From: Alexander Azimov <[email-masked]>
Date: Wed, 20 Nov 2019 11:40:37 +0300

Hi all,

I want to follow up on my talk at the meeting and make a quick recap of my
considerations.
There are two defaults around ROA objects:

   1. Drop invalids (default suggestion);
   2. Setting maxlength equal to the prefix length (automated by RIRs).

These settings together might create both deployment and security risks.
The security risks grow up from a situation when you can't instantly create
a more specific prefix when somewhere more specific hijack starts to
propagate. It can be avoided by using maxlength as big as possible, but
this differs from the current default setting in the web interfaces
provided by RIRs.

The deployment risks are related to ov-egress draft, where expected
behavior isn't just reject invalids, but also creating exceptions in this
policy. As I suppose the target audience for this draft is stub ASNs, this
will require additional configuration on their side. It is doable, but the
more you require from this part of the ecosystem, the less will be done.
The effect can also be limited by changing default settings at the RIRs.

-- 
Best regards,
Alexander Azimov