[10:20:19] --- psavola has joined
[11:02:49] --- Bill has joined
[11:02:53] --- ggm has joined
[11:03:12] <ggm> agenda up. just finished agenda bash
[11:03:21] <ggm> overview/status., proto/design, proposed work, discussion. to 11:30ish
[11:03:45] <ggm> reading list.. (long)
[11:04:04] <ggm> covers threat model, soBGP, sBGP, psBGP. current work in RPSEC is the threats model
[11:04:43] <ggm> overview, status, but no slides from AD. so handing to AD
[11:04:49] <ggm> alex zinin to the floor
[11:04:58] <ggm> rtg area AD
[11:05:00] --- psavola has left
[11:05:25] <ggm> started from RPSEC, few years ago (3) asked to look at reqts for bgp security. do not look at solns. look at what needs to be secured
[11:05:34] --- psavola has joined
[11:05:39] <ggm> *some* agreement in RPSEC on some requirements. not 100%
[11:06:17] <psavola> COMMENT: the RPSEC work is not a useful threats model for this work.
[11:06:18] <ggm> can identify minimal subset need to be secured.
[11:06:41] <ggm> start part of work, satisfy minimal set of reqts but not preclude additional stuff
[11:07:14] <ggm> presentations on different approaches, goal is not to have discussion "which do we pick" or do comparisons. goal is to give feel of state of art today
[11:07:30] <ggm> ask Qs please, lets avoid 'fight' between the two. avoid picking one at this point
[11:07:40] <ggm> concentrate on proto work
[11:08:16] <ggm> Tony Tauber slideset
[11:09:23] <ggm> rpsec has concentrated on analysis/requirements. without neccessarily looking at how can be impl inside a framework.
[11:09:30] <ggm> this is 'next steps' from that.
[11:09:45] <ggm> looking at IDR, enhancements to overall framework that would include how to address reqts
[11:10:11] <ggm> duplicating work? no. RPSEC not chartered for enhancements -more than just proto, why saying 'framework' -how to generate/interpret too
[11:10:28] <ggm> not into IDR, too busy. one view. not sure if IDR chair is here, IDR does have hefty agenda.
[11:10:42] <ggm> may require considerations which will warrant sep WG, breadth/depth moving forward
[11:10:55] <ggm> draft-ietf-rpsec-bgpsecrec being worked on.
[11:11:08] <ggm> on ML, consensus is not there overall. most agree in decent shape, more to do
[11:11:23] <ggm> some consensus on some aspects. particularly on origination.
[11:11:58] <ggm> woll not solve everything now. cannot wait for all reqts.
[11:12:06] <ggm> practical concerns
[11:12:09] <ggm> no flag day.
[11:12:15] <ggm> want benefit without global deployment
[11:12:25] <ggm> no change to operational/business model
[11:13:55] <ggm> distance-vector policy model established in business model of public internet. radical change has hard time getting acceptance
[11:14:24] <ggm> dave clark: finding it hard to route money.
[11:14:31] <ggm> this is how its done these days. hard to change
[11:14:42] <ggm> consensus on source authorization
[11:15:26] <ggm> ops notice attacks on routing system, address want to use in attacks is traceable, so many attackers invent addresses. best way to imitate you, to be you, is to advertize your address in place of, ir with you. suck traffic down.
[11:15:41] <ggm> how can one provide authority info, validation info, to src address of adv.
[11:16:22] <ggm> thinking BGP, when originate, originate from particular AS. not all adr holder have AS, originate the route. first upstream does. need to understand not only adr is real, AS is real, also auth on binding of adv. of addr from ASN. Authority to originate
[11:16:28] <ggm> delegation of authority, thought about many ways
[11:17:07] <ggm> here, you may not be originating from your AS, prefix you have unique control of. may be using private AS, statics. has to handle delegation, transfer of authority, to somebody who does the adv. but they dont own your prefix. 2 credentials, relationship to express.
[11:18:28] <ggm> IANA manages pool. IANA alloc blocks addr/ASN to RIR. in turn, hand out blocks to forms of national registry, Local Regs, to ISP, further and further down the food chain.
[11:18:41] <ggm> looking for authority, one model is to look at delegation chain. other ways to look at it.
[11:18:52] --- psavola has left: Disconnected
[11:18:59] <ggm> Tony says 'must' follow addr delg. practices. must, or must-be-able, one of the issues here.
[11:19:05] <ggm> follow the food chain
[11:19:21] <ggm> avoid invented numbers.
[11:19:25] <ggm> AS_PATH validation
[11:19:38] <ggm> AS PATH used for 3 things, 1 implicit 2 direct.
[11:19:54] <ggm> is there a loop. in d-v protocols, don't have info, can get to count-to-infinity problem (c/f RIP)
[11:20:27] <ggm> secondly, intrinsic, length of AS PATH matters. in absence of any other info, provides preferences.
[11:20:50] <ggm> shortest path
[11:20:53] <ggm> don't care about other people, want to avoid loops for 'me'
[11:21:01] <ggm> implicit third function.
[11:21:22] <ggm> good correlation between path being offered and forwarding path: also part of issue of validation
[11:22:07] <ggm> Number Registry Opportunities
[11:22:25] <ggm> opportunities for hierarchies to be supported by certificates. can follow chains 'where it came from'
[11:23:23] <ggm> APNIC issuing certificates, planning. see other presentations
[11:23:42] <ggm> history is 'murky' old assignments, not well detailed.
[11:24:08] <ggm> is this the way to go? cool, but not definitely the way to go. Tonys obs. he doesn't see a btter one emerging
[11:24:11] <ggm> Next Steps.
[11:24:25] <ggm> begin proto work in parallel, with RPSEC. defer things that hinge on contended points
[11:25:00] <ggm> Current Proto work. soBGP, sBGP, psBGP. not a pick-one exercise. showing state of thinking. efforts, where people are, approaches
[11:25:53] <ggm> Susan Hares.
[11:26:12] <ggm> concerns about IDR WG. have problems with Tony characterizing it
[11:26:54] <ggm> AD decided to put work here for whatever reason. don't want you to feel I am insulted. not we don't want new work items, too busy in IDR. moving pretty good. blocked on finding reviewers, or impls. Yakov/I want 2 impls.
[11:27:23] <ggm> we're not too busy to take this. don't hesitate to send things to IDR
[11:28:03] <ggm> Bill. agree with disagree on IDR characterization. not there is too much. more this work extends beyond IDR. imp. to create new place for everyone, instead of building in IDR
[11:28:37] <ggm> Susan: personal comment
[11:29:02] <ggm> important to settle RPSEC open issues (some of them) before getting too far. may drive solns differnt ways. know contention, worth resolving in creative fashion
[11:29:47] <ggm> Alex. when take on work item, look at size. try to understand where is going to be in 1-2years. looking at that, seemed like good idea to have separate WG
[11:30:41] <ggm> Russ WHite
[11:30:48] <ggm> soBGP
[11:31:26] <ggm> trying to deploy with existing h/w. dist info, no central servers, some security info
[11:31:46] <ggm> providers have local policies, want to support. sec sys shouldn't override. should provide more info, not flat out override
[11:31:52] <ggm> certs.
[11:32:01] <ggm> entity certs, ASPolicy Cert.
[11:32:15] <ggm> temp design, thrown together to meet goal. could improve
[11:32:53] <ggm> believe ServiceProviders don't want to name adr holders in certs.
[11:33:11] <ggm> some detail about adv. set, how much info want to give away
[11:33:29] <ggm> signed using key of origin AS.
[11:33:39] <ggm> AuthCert.
[11:33:52] <ggm> hidden inside other cert. ties origin AS to adr block, signed by ttp
[11:34:09] <ggm> PrefixPolcyCert. authcert+per prefix policy
[11:34:17] <ggm> transport draft
[11:34:35] --- suz has joined
[11:34:36] <ggm> certs need to converge as BGP. no centralized server
[11:34:45] <ggm> rely on routing to get to cent. server
[11:35:08] <ggm> for now, new msg type in BGP, transp. in BGP, don't touch existing packets but use semantics/update to dist
[11:35:30] <ggm> can use eBGPmulti, iBGPmulti. can avoid border routers etc
[11:35:34] <ggm> validation
[11:35:41] <ggm> build graph, similar to SPF
[11:36:06] <ggm> can hang policy on graph
[11:36:15] <ggm> DAG, links must be bidi to be valid
[11:36:37] <ggm> Validation details
[11:37:39] <ggm> powerful to kill off spoof paths
[11:37:48] <ggm> not just big-I internet. also mil-nets
[11:38:36] <ggm> deployment options.
[11:38:41] <ggm> can run on existing h/w
[11:39:16] <ggm> exch sbgp to offline servers
[11:39:28] <ggm> with h/w accellerators
[11:39:40] <ggm> then query server locally
[11:39:46] <ggm> also variants between the two
[11:40:26] <ggm> two axis of deployment. partial deployments. logical/physical
[11:40:37] <ggm> logical is part of the system, not all of it. phyisical is some AS support, some don't
[11:40:41] <ggm> logical. don't turn on all checks
[11:40:48] <ggm> physical, partial deployment, soBGP is pretty good
[11:41:43] <ggm> given avg hop is around 4, with mix of enabled/not can do full path check. 5 hop, cant do, but 4, can because secured can see both sides of unvalidated path
[11:41:45] <ggm> logical: can do incremental stuff.
[11:41:59] <ggm> can do origin authentication only, path matters but can do it
[11:42:12] <ggm> attacks on graph, faked path, deploy second piece
[11:42:15] <ggm> add policies
[11:42:24] <ggm> flexible
[11:45:31] <ggm> Sandy Murphy/Sparta
[11:46:07] <ggm> had cert to represent, AS, something to represent prefix-to-AS mapping. signed by TTP. didn't see way to represent, person owns prefix. what info does the TTP use to decide this is ok?
[11:46:28] <ggm> [ggm asked about TTPvs hierarchy, and 4-hop validation being generic to any model]
[11:46:36] <ggm> Russ allocator has to sign to say its auth.
[11:47:02] --- oatwillie has joined
[11:47:07] <ggm> TTP is about flexibility. in real world, anticipate is the allocator, RIR, service provider. either way. did envision, internetworks, property doesn't hold
[11:47:16] <ggm> don't know of any, want to allow for it
[11:47:33] <ggm> Sandy uniqueness in global big-I internet
[11:47:38] <ggm> Russ true, but other nets, not always true
[11:48:07] <ggm> Brian/Cisco. comes from trying to separate TTP for authentication to who signs for authorization
[11:48:21] <ggm> its about trusting keys, claims come from other paths 'down the line'
[11:48:30] <ggm> made separation
[11:48:45] <ggm> Steve Kent, sBGP
[11:49:01] <ggm> evolving for number of years, like soBGP, DoD initiative to design
[11:49:19] <ggm> need realistic goals.
[11:50:17] <ggm> try to provide data to routers about authenticity. care about routing updates, believe used to control forwarding tables,
[11:50:43] <ggm> both ends, sender/receiver have to send and forward. is interrelationship. can leverage.
[11:51:37] <ggm> approach taken in sBGP, not tell what HAVE to do, provide ISPs info to verify as authentic
[11:51:52] <ggm> criteria. avoid trust word amongst ISPs for fundamental basis. on glbal scale, not ISps trusted by all other ISps
[11:52:08] <ggm> axis of evil issues, and bilateral nastyness
[11:52:25] <ggm> transitive trust introduces error propagation
[11:53:06] <ggm> isolate failures. didn't have to trust people beyond what they can establish objectively they can do
[11:53:10] <ggm> solns have to scale
[11:54:56] <ggm> also looking at local config. adjacency configs. if neighbour does, do <x> but it gets complicated.
[11:55:24] <ggm> basic BGP security reqt
[11:55:51] <ggm> for every UPDATE, bgp should be able to verify hlder for first hop AS, and subsq. AS PATH auth to adv.
[11:57:36] <ggm> derived Reqts
[11:57:53] <ggm> timeliness issue. residual vulns. can't neccessarily solve
[11:58:45] <ggm> s-BGP uses standard extensions. avoid transitive trust. believe has same dynamics as BGP
[11:59:23] <ggm> three components. use IPSEC pt-to-pt between border routers. ESP/AH-only is fine. alternative to tcp-MD5. has auto key mgt. can use or not. link by link. no global visibility
[11:59:49] <ggm> second is PKI. designed to issue certs using allocation scheme
[11:59:58] <ggm> no new TTPs. rely on existing parties.
[12:00:10] <ggm> DoD: comparable. don't need generic TTP, always an authority.
[12:00:14] <ggm> incrementally deployable
[12:00:25] <ggm> avoid flagday
[12:00:40] <ggm> full deployment, blows memory. need crypto h/w
[12:00:47] <ggm> problem
[12:01:17] <ggm> can do this backgrojund, when not under attack, but when flapping, overwhelms.
[12:01:26] <ggm> moores law will help. but can't do it today
[12:01:30] <ggm> (full deployment)
[12:01:54] <ggm> dartmouth have done work to reduce costs, improve performance. 60% cutback. convergeance in simulations faster. use nifty tricks.
[12:02:38] <ggm> diagram of information flows
[12:03:40] <ggm> offline prep of info download, then prep routers. routers don't see crls. get told which keys to accept
[12:04:17] <ggm> route attestations are digitally signed blobs. can be checked.
[12:04:19] <ggm> if have lots of neighbours, don't check all the time. check if change route.
[12:04:55] <ggm> infrastructure needed to attest to holders, provide signing framework
[12:05:07] <ggm> most proposals need this somewhere
[12:05:23] --- mb has joined
[12:05:45] <ggm> can do PKI checks before deployment into BGP
[12:07:06] <ggm> PKI model, hierarchy
[12:08:05] <ggm> hierarchic vs web.
[12:08:30] <ggm> start with hierarchic. users on local basis can make decision, can decide to take root, make it 'the one' -get uniformity.
[12:08:42] <ggm> locally, can pick other points, other users lower down, make those trust anchors (in PKI terms) -it becomes a web of trust
[12:08:59] <ggm> start with hierarchy, deploy. then you can allow indiv. orgs to run local interpretation, or as web of trust.
[12:09:09] <ggm> can't do other direction. if it starts as web of trust, dont have root to point to
[12:09:57] <ggm> goals. soBGP and sBGP not quite the same. may need a mixture
[12:10:17] <ggm> need criteria for security which recognize the 'autonomous' word. preserve autonomy,
[12:10:37] <ggm> other hand, internet is not the wild west. we do centralized alloc to get uniqueness. some controls can be imposed from infrastructure standpoint.
[12:10:44] <ggm> need objective criteria
[12:11:00] <ggm> based on explicit TRUST word, we're in trouble if its transitive.
[12:11:38] <ggm> like to suggest consider establishing hierarchy for PKI of addr/AS, basis to use for proposals, two seen thus far, allows interpret locally as web if you want, or use as hierarchy. keeps options open. manage locally
[12:12:15] <ggm> SteveCrocker. speak about moores law effect
[12:13:11] <ggm> SteveKent. scaling reqts directly derivable from internet growth. have formula. how many AS, how many discrete allocs, how many routes.
[12:13:17] <ggm> how many routes, have to accommodate anyway
[12:13:56] <ggm> one thing, disproportionate, factor, is avg path length, say pathlength isn't growing. constant. translates to number of sigs per update and store in ribins, locrib, how many sigs to validate per path
[12:14:12] <ggm> growth don't put disporportionate pressure on this
[12:14:39] <ggm> way behind moores law. issue isn't cant put mem in, its vendors didn't have need, chose not to do it, nor put slots in, given criteria being used
[12:14:47] <ggm> ability to support is well within realms of laptops
[12:16:10] <ggm> steve crocker. so memory cost will change if size changes, that function, not pathlength unless there is a change to path length
[12:17:07] --- dumdidum has joined
[12:18:54] <ggm> questioner: effect is linear cost? Steve yes
[12:19:07] <ggm> Ggm don't rei-fy number. 4 could go away. long tail flapping increases cost.
[12:19:23] <ggm> Steve yes, long tail, but can optimize between flap states can contain problem
[12:19:35] <ggm> psBGP
[12:19:52] <ggm> Tao Wan, PC Van Oorschot, Evangelos Kranakis
[12:20:19] <ggm> Tao's PhD work. presented for him. Tao now at Nortel
[12:21:20] <ggm> does both prefix and ASpath verification
[12:21:52] --- dumdidum has left: Replaced by new connection
[12:21:54] <ggm> psBGP is centralized trust. hierarchy of depth one. RIR hand out certs, bding AS num to PK
[12:22:06] <ggm> decentralized model for prefix origin, by corroboration with adjacent AS
[12:22:18] <ggm> has nice comparison table. worth keeping in mind
[12:22:46] --- dumdidum has joined
[12:22:47] <ggm> calls its path verification method 'stepwise integrity'
[12:24:12] <ggm> cert stuff
[12:24:48] <ggm> RIR sign bindgs to AS num, AS issues prefix assertion certs, for each BGP speaker, or shared. and speaker certs
[12:25:59] <ggm> as number is subject, to simplify
[12:26:10] <ggm> 18,000 AS, growing 190/mo
[12:26:22] <ggm> rating mechanism. as rates as
[12:28:33] <ggm> math to show its coverage is valid
[12:28:37] <ggm> how to use beliefs
[12:29:04] <ggm> prefix assertion lists. give bindings of AS# and neighbours (selected, people you know and have real knowledge of)
[12:29:10] <ggm> or RIR can issue endorsements via PALs too
[12:29:42] <ggm> distribute PALs by extensions to update msg
[12:29:50] <ggm> example prefix assertion list
[12:32:57] <Bill> the url given (http://www.scs.carleton.ca/research/tech_reports/2005/download/TR-05-08.pdf) is the longer updated version
[12:33:06] <ggm> Sam Weiler
[12:33:45] <ggm> finding bad wireless cards
[12:34:11] <ggm> Alex. moving forward
[12:34:15] <ggm> not picking approaches
[12:34:17] <ggm> (yet)
[12:34:26] <ggm> take agreed reqts. work on proto specific part
[12:35:20] <ggm> what infrastructure needs work. what proto elems.
[12:35:31] <ggm> next steps. discuss here, take to list, continue, write charter, form WG
[12:35:49] <ggm> BillF
[12:36:13] <ggm> work done focussed on secure internetrouting system. bgp being used for other things. nice not to preclude 2547 etc
[12:36:50] <ggm> Ross Callon
[12:37:04] <ggm> seems to me, looking at IETF effort, big bang engineering methods don't work.
[12:37:20] <ggm> go off and think for 5 years, fully formed, them impl, doesnt work. better is, incremental
[12:37:39] <ggm> BoF is to decide if new WG on something. and, some amount of charter.
[12:37:57] --- dumdidum has left: Replaced by new connection
[12:38:21] <ggm> whats propsoed is take agreed thing, done, as one part of securing BGP, one part of securing routing, one piece, and go do it already, in 1-2 years done. then take more, thats the right approach
[12:38:21] <ggm> approach makes seense
[12:39:26] <ggm> like direction.
[12:39:39] <ggm> Russ White SIDR process suggestions
[12:40:09] <ggm> although cochair of RPSEC, not really doing that here. ditto cisco
[12:40:21] <ggm> sort the requirements.
[12:41:01] <ggm> partial deployment, standalone origin auth, existing equipment issue, grwoth of BGP issue
[12:41:07] <ggm> break problems down where possible
[12:41:30] <ggm> split validity/policy, routing security, key mgt, security & authority.
[12:42:01] <ggm> <battery dying. going offline. sorry>
[12:42:45] --- ggm has left: Logged out
[12:55:03] --- simon.leinen has joined
[12:57:21] --- dumdidum has joined
[12:57:22] --- oatwillie has left
[13:04:56] --- gregory has joined
[13:20:15] --- mb has left
[13:20:16] --- dumdidum has left: Disconnected
[13:27:23] --- simon.leinen has left
[13:28:33] --- Bill has left
[13:35:05] --- gregory has left: Disconnected
[14:42:22] --- suz has left
[14:42:22] --- suz has joined
[14:42:22] --- suz has left
[15:11:58] --- Bill has joined
[15:12:05] --- Bill has left
[15:24:54] --- gregory has joined
[17:23:09] --- gregory has left: Disconnected
[23:16:42] --- gih has joined
[23:18:26] --- gih has left