On 10/15/14, 11:14 AM, "Ted Lemon" <[email protected]> wrote:
>On Oct 15, 2014, at 7:29 AM, Iljitsch van Beijnum <[email protected]> >wrote: >> However, rather than advertising that block in BGP as a single prefix, >>or perhaps a handful of prefixes, like an ISP would, they subdivide this >>block within the organization and then many subunits advertise >>subprefixes though different ISPs. The aggregate may or may not be >>advertised. > >Yuck. Has anybody done an analysis of how this works with RPKI? Seems >like an obvious attack surface if the RPKI isn't present or isn't done >right. Yup. I don¹t have an analysis, but it is a common discussion point when creating ROAs: what should the ROA cover? Both the max-length of the advertisement and the origin ASNs could result in a ³validated² attack. On one hand, creating ROAs that cover exactly what is advertised reduces the surface, but it can result in a higher operational cost and maybe some hassle if something different (like a more specific) needs to be advertised *right now*. OTOH, creating a more ³flexible² ROA (2100::5/32 -> /48, for example) provides more operational flexibility, but it may in fact open up the door to ³valid² announcements. I¹ve worked with LACNIC in some of their RPKI deployments in Latin America and I suspect that a significant number of people opt for the ³flexible ROA²..even after we explain the risks. LACNIC may have some insight in what is being created right now (with the caveat of course that there¹s just one place in the world that is in fact filtering). Alvaro. _______________________________________________ GROW mailing list [email protected] https://www.ietf.org/mailman/listinfo/grow
