> The lesson was about the danger of more specifics.
> Would the attack had been as successful if had
> announced a matching /22 instead of a /24? Imagine
> a ROA future where Pakistan Telkom replays the attack
> and inserts the correct origin in the path to match the
> Youtube ROA. The attack still succeeds if Youtube
> has a maxlength of 24 for their /22 ROA. It fails if
> Youtube requires an exact match 22 in their ROA.
>
> I would also point out that the AS7007 incident involved
> more specifics, not just exact match prefix lengths.
> ROA's give one the ability to specify both origin AS
> and prefix length. Gratuitous use of maxlength
> negates the prefix length matching capability of ROA's.
your use of the word attack is not appropriate. it was an accident.
aside from that, all of this is true. roas simply can not and will not
deal with deliberate forging. they do not deal with attacks. they
just deal with 99% of the problems we have today, fat fingered
accidents. a roa for the /22, with or without roas for the covered
/24s would have prevented the pt accident.
dealing with attacks is a non-trivial design and engineering problem.
if you want to know how hard, i suggest looking at sharon goldberg's
work in this area.
<rant>
where roas will fail in even their simple task is more likely roa and
certificate expiration and/or invalidation. with some rirs planning on
turning certificate and roa issuance into an income stream tied to
leasing the address space which they got for free [0], any use of the
rpki approach to make routing more resilient is doomed.
randy
---
[0] - remember all the rir assertions that the rirs abjure all control
of routing? well, this is a horrifyingly strong control.
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
