to quote Vint Cerf, I hope correctly, "The Internet is an experiment
that never ended". There has been (and still is) a lot of discussion in
the IETF and the associated IRTF Routing Research Group, but that has
not yet resulted in a clear resolution of the security issues resulting
from the 20+ year old "trusting cooperative" routing model and the
identifier/locator contradictions inherent in IP addresses.
Solutions will be evolutionary, not revolutionary, as it is hard to swap
out the engine in flight.
On 11/23/2010 9:36 PM, Richard Bennett wrote:
Bob's more or less right, except for the SS7 dig. BGP was designed in
a big hurry, to keep the Internet going post-NSFNET shutdown. It's one
of those things that was supposed to be improved later, and never was.
Its biggest problem is that it has to route IP addresses, which aren't
what they should be; like the URL, the IP address isn't an identifier,
its a locator. It was a bad move to put a locator that high in the
protocol stack.
On 11/23/2010 6:14 PM, Bob Frankston wrote:
Of course. The Internet routing system is modeled after SS7 with hard
outer
shell and a soft trusted inner core. Oh, the outer shell isn't hard.
So what
do you expect? Like the DNS it is designed to fail!
The answer is not more "security" in the style of ITU's hierarchical
authority system.
It doesn't help that we have a hyper-complex routing system that doesn't
take advantage of the fact that most physical devices in the
infrastructure
don't move around. Instead we not only assume everything is in
motion, we
also have to route around arbitrary telecom pricing and settlement
system.
On top of that, as per the DNS, we expect the network to keep track
of the
end points.
The post office knows routing a lot better than the IETF. It has a
(relatively) stable infrastructure and leaves it to the users to map
their
location to a network transit point (AKA, a physical or logical
address).
The irony is that mobility would be easier if we didn't try to collapse
routing and naming into one system with a single identifier that was
good
for neither.
This is why we need new protocols that aren't dependent on naïve
trust and
need an infrastructure that isn't primarily about creating billable
events.
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On
Behalf Of
Lauren Weinstein
Sent: Tuesday, November 23, 2010 20:58
To: [email protected]
Subject: [ NNSquad ] Ars technica on BGP concerns
Ars technica on BGP concerns
http://bit.ly/fDLhHC (ars technica)
--Lauren--
NNSquad Moderator
--
Ed Jankiewicz - SRI International
Fort Monmouth Branch Office - IPv6 Research
Supporting DISA Standards Engineering Branch
732-389-1003 or [email protected]
