Re: [sidr] AD Review of sidr-origin-validation-signaling-09

2016-11-29 Thread Chris Morrow
At Tue, 29 Nov 2016 21:08:11 -0500, "John G. Scudder" wrote: > > On Nov 29, 2016, at 9:02 PM, Chris Morrow wrote: > > Of course, just wiping out the prefixes in flight > > Right, exactly. The OV "attack" is just a baroque version of > underclaiming, only it's an inferior version because there's

Re: [sidr] AD Review of sidr-origin-validation-signaling-09

2016-11-29 Thread John G. Scudder
On Nov 29, 2016, at 9:02 PM, Chris Morrow wrote: > Of course, just wiping out the prefixes in flight Right, exactly. The OV "attack" is just a baroque version of underclaiming, only it's an inferior version because there's a greater audit trail. > and stitching back > together the tcp session..

Re: [sidr] AD Review of sidr-origin-validation-signaling-09

2016-11-29 Thread Chris Morrow
At Tue, 29 Nov 2016 20:23:55 -0500, "John G. Scudder" wrote: > > On Nov 13, 2016, at 1:40 AM, Alvaro Retana (aretana) > wrote: > > C1. The reference to rfc7607 should be Informative. > > Done (in -10 candidate source). > > > C2. [Major] Security Considerations. I think that there is one > >

Re: [sidr] AD Review of sidr-origin-validation-signaling-09

2016-11-29 Thread Randy Bush
> > C2. [Major] Security Considerations. I think that there is one > > consideration that should be mentioned in this section: Given that the > > largest value is preferred (2 = invalid), there is an attack vector where a > > router in the path (yes, even an internal router) can inject a commu

Re: [sidr] AD Review of sidr-origin-validation-signaling-09

2016-11-29 Thread John G. Scudder
On Nov 13, 2016, at 1:40 AM, Alvaro Retana (aretana) wrote: > C1. The reference to rfc7607 should be Informative. Done (in -10 candidate source). > C2. [Major] Security Considerations. I think that there is one consideration > that should be mentioned in this section: Given that the largest