Thu, Aug 04, 2016 at 06:03:52PM +0900, Randy Bush: > < pedantry alert > > > > I am not knowledgable of every facet of rpki, but I thought that it was > > possible to express /length-or-longer? But Randy has already pointed > > that rpki doesnt cover communities; to middle men can alter it. > > rpki does not cover anything in a bgp announcement. it is a distributed > database of address space ownership and authorization to announce (and > some other cruft). > > rpki-based origin authentication doe not help here because the attacker > requesting my prefix be blackholed with merely forge my AS on the path. > > rpki-based path validation, one possible future, would plug the forged > origin hole. as you say, the current drafts do not sign over > communities. > > < /pedantry > < rant >
fine, bad terminology. was following the original. Is it not possible to define a ROA that includes a prefix-length -or-longer up-to and including a /128 or /32? _______________________________________________ GROW mailing list [email protected] https://www.ietf.org/mailman/listinfo/grow
