Subject: Re: [Sidrops] draft-ymbk-sidrops-ov-clarify-01.txt

From: "Jakob Heitz (jheitz)" <[email-masked]>
Date: Fri, 6 Oct 2017 23:35:33 +0000

I'd like to add a section:

ROAs and BGP announcements

Every IP prefix that is matched by a ROA SHOULD be announced to BGP by the AS stated in the ROA
unless that AS is AS 0. If the owner AS does not announce the prefix, then another AS can
announce the prefix and simply prepend the owner ASN. Such a false announcement will pass
RPKI validation. Also, there will be no legitimate announcement to compete with it.
If an AS wishes to protect an IP address prefix without announcing it,
then it SHOULD issue a ROA that associates the prefix with AS 0.

Thanks,
Jakob

---

From: Randy Bush <[email-masked]>
Date: Sat, 07 Oct 2017 08:54:26 +0900

hi jakob,

> Every IP prefix that is matched by a ROA SHOULD be announced to BGP by
> the AS stated in the ROA unless that AS is AS 0. If the owner AS does
> not announce the prefix, then another AS can announce the prefix and
> simply prepend the owner ASN. Such a false announcement will pass RPKI
> validation. Also, there will be no legitimate announcement to compete
> with it.  If an AS wishes to protect an IP address prefix without
> announcing it, then it SHOULD issue a ROA that associates the prefix
> with AS 0.

unless i am not reading this as you intended, this is not about how
validation is done, but is directed at operational practice, rfc 7115.
the draft under discussion is about how validation is done.

it should be clear from 7115 that OV is forgable as you describe; an
attacker can prepend the expected origin.  and, as validation just has
to match *any* roa, as 0 does not help [0].  to strongly authenticate
origination, you need to go to bgpsec.

randy

--

0 - as far as i remember, as 0 has no special properties other than
    being an as number which is not allowed to appear in bgp, see
    rfc 7607, but is allowed to appear in a roa.

---

From: "Jakob Heitz (jheitz)" <[email-masked]>
Date: Sat, 7 Oct 2017 00:41:05 +0000

Randy,

0 helps if an AS is not announcing its prefix in BGP.
Registering it under AS0 causes the evil announcement to be invalid.
The evil announcer cannot prepend 0.
Of course, it should register under AS0 only, not under its own ASN.

RPKI is actually really good at protecting unannounced prefixes.
It can protect announced prefixes if you can manage to get a
shorter AS_PATH length than the evil prepended path.

Thanks,
Jakob

-----Original Message-----
From: Randy Bush [mailto:[email-masked]] 
Sent: Friday, October 6, 2017 4:54 PM
To: Jakob Heitz (jheitz) <[email-masked]>
Cc: SIDR Operations WG <[email-masked]>
Subject: Re: [Sidrops] draft-ymbk-sidrops-ov-clarify-01.txt

hi jakob,

randy

--

---

From: Randy Bush <[email-masked]>
Date: Sat, 07 Oct 2017 09:51:48 +0900

hi jakob,

> 0 helps if an AS is not announcing its prefix in BGP.  Registering it
> under AS0 causes the evil announcement to be invalid.  The evil
> announcer cannot prepend 0.  Of course, it should register under AS0
> only, not under its own ASN.
> 
> RPKI is actually really good at protecting unannounced prefixes.  It
> can protect announced prefixes if you can manage to get a shorter
> AS_PATH length than the evil prepended path.

yep, all true.  but, imiho, not for this doc.  this doc is meant to
clarify some things that implementations have shown to be insufficiently
clear in 6811, how announcement are validated in a router, not in 7115,
operational practices.

but if you think your comments could be used to clarify 7115, i have no
problem with that.

randy