On 01 May 2015, at 21:24, Matthew Lepinski <[email protected]> wrote:
> You are certainly correct that there are Nine possible states (and Randy's > table is correct). Randy's table? I must have missed that one. > That being said, I have some concern about treating "Path Unsigned" > differently than "Path Not Valid", since it is trivial for a malicious > adversary to transform "Path Not Valid" into "Path Unsigned" if doing so will > yield better treatment for some bad route. That's a good point. But then, how do you treat those? By filtering the affected prefixes? You can only do that once _all_ paths are signed. So basically, we're stuck with our AS path filters until BGPsec deployment hits 100%. It would have been better if BGPsec would have had provisions for partial deployment, so that you can have a path that is partially BGPsec protected even if it can't be fully be BGPsec-protected. That way, the filtering issue shrinks in scope as the BGPsec-enabled core grows and non-BGPsec branches turn into leaves and finally go away. _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
