>I would also note that this has been brought up here Reviewing that was what led to my question to Randy. (something like "what is the reason for having ORIGIN in the first place".)
The responses when this came up in the past have been that protecting integrity of ORIGIN might be conceivable, but the authenticity of the value was not. That is, who says that the AS did indeed get the info from EGP. Sounds like at one time, that mattered. To consider this a threat, we would need to decide what attacks are of interest. Is corruption the only concern? Is spoofing a value (mis-ORIGIN-ing) a concern? If authenticity of the value is a concern, who could be an authority to attest to the authenticity? And so forth. --Sandy, speaking as regular ol' member ________________________________________ From: [email protected] [[email protected]] on behalf of Danny McPherson [[email protected]] Sent: Tuesday, October 23, 2012 4:05 PM To: sidr wg list Subject: Re: [sidr] origin attribute On Oct 23, 2012, at 11:14 AM, Randy Bush wrote: > > but it is in the bgp decision process. it is prettly low down, but > could be used for traffic engineering or other, less nice, influencing > of the decision process. s/could be/is/ > hence, bgpsec should probably should protect it. Agreed. I would also note that this has been brought up here many times (e.g., [1]), glad to see folks giving it consideration now, and hoping it can find it's way into a future threats document. -danny [1] http://www.ietf.org/mail-archive/web/sidr/current/msg03464.html _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
