Please see comments below. Sriram > -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf Of Carlos > > Broadly speaking, and looking at what people have created in the > repositories so far, there seem to be two different views on the > matter: > > - ROAs that mirror BGP announcements and/or block de-aggregation within > networks > For example, an organization with as 100 holding 10.1/16 and having > sub-allocated 10.1.128/18 to as 200 creates something like this: > > ROA #1: 10.1.0/17-18, 10.1.192/18-18 origin-as 100 > ROA #2: 10.1.128/18-18 origin-as 200 > > - ROAs that protect all the way to /32 (in IPv4) > > Using the same example as above, they would have: > ROA #1: 10.1/16-32 origin-as 100 > ROA #2: 10.1.128/18-32 origin-as 200
The first approach (minimal maxLength in the ROA) is recommended. Please see Section 3 of http://tools.ietf.org/html/draft-ietf-sidr-origin-ops-10 where it says: "One advantage of minimal ROA length is that the forged origin attack does not work for sub-prefixes that are not covered by overly long max length. E.g. if, instead of 10.0.0.0/16-24, one issues 10.0.0.0/16 and 10.0.42.0/24, a forged origin attack can not succeed against 10.0.66.0/24. They must attack the whole /16, which is more likely to be noticed. Therefore, ROA generation software MUST use the prefix length as the max length if the user does not specify a max length." You may also take a look at http://tools.ietf.org/html/draft-ietf-sidr-usecases-02#section-3.3 Sriram _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
