On Apr 1, 2013, at 10:17 AM, Sharon Goldberg <[email protected]> wrote:
[--snip--]
> > As above, the actions described in these sections are all easily detectable
> > by the targeted entity. So, the question is what that entity would/could do
> > if
> > it detects this sort of activity by its parent (or grandparent). Unless the
> > parent was compelled to whack a ROA by a LEO, there is likely to be a legal
> > remedy
> > that can be invoked. if a LEO is involved, then the situation is more
> > complex,
> > but I've been working on a memo that describes remedies for that context as
> > well.
> > I'll share it when it's been vetted by some more folks.
>
> We'll look forward to this -- more information about legal remedies will be
> useful to inform further investigations on our end.
>
> We are particularly curious about how legal recourse would play out in cases
> where the targeted party is in a different country than the party that
> whacked its ROA. For example, what if an American organization whacks a ROA
> for an AS in a different country (or vice versa)?
>
> We did some analysis of when a subject in one country can whack a ROA for an
> AS in another country. See the heatmaps on slide 10-11 of the slide deck:
>
> http://www.cs.bu.edu/~goldbe/papers/Cooper_RPKI_BFOC.pdf
>
> To get these, we took data on the direct-allocations from each RIR, and then
> used routeviews and RIPE RIS data to determine for each directly-allocated
> prefix, how many different ASes originate the prefix or any of its
> subprefixes. We show this in slide 10. To get slide 11, we then use the
> AS-to-country mappings provided by the RIRs to determine the number of
> countries that have ASes who originate prefixes that are covered by the
> directly allocated prefix. (Note we are in the midst of writing up a full
> report of these results, that I'll share with the list in a month or two.)
>
> So, if we suppose that prefixes directly allocated by the RIRs are given
> their own resource certs, we see that these resource certs can whack ROAs for
> ASes in multiple countries. (Look at 8/8 or 12/8, for example.) How would
> takedowns play out if they cross national borders?
As one operator whose worldwide routing/operations could be negatively impacted
by the above, it would be nice to have a concise statement about what is/was
the original intent of the design of the RPKI with respect to the above. In
addition, it would be useful to see if any potential remedies/solutions may be
employed (and, any associated overhead/delays/*costs*/etc. they incur) that may
be used to mitigate them /before/ they manifest themself in the network, at
which point operators will be obligated to stop using those 'trusted
information repositories' to directly inform routing.
Regardless ... good work, Sharon & Co.
-shane
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
