Subject: A draft about BGP protection,Please review

From: lidefeng <[email-masked]>
Date: Mon, 26 Aug 2002 14:28:54 +0800

hi,

    As to the protection of BGP route information, we propose an efficient mechanism as described 
in draft-huawei-bgp-protection-md5-00.txt.
   Please reviev it as soon as possible.Thanks

Regards

Li Defeng

---

From: Pedro Roque Marques <[email-masked]>
Date: Mon, 26 Aug 2002 10:42:11 -0700 (PDT)

lidefeng  writes:

> 3.0 Security Considerations

>     This BGP extension mechanism provides an simple but efficient
> method to protect the security of BGP route information,compared
> with other methods which encrypt the whole BGP message,the impact to
> the performance of route protocol will be sustainable,and in
> contrast to the existing BGP security mechanism such as RFC2385,
> which is from the perspective of the transport layer ,this mechanism
> takes measure on the application layer and do nothing to the
> transport layer.

Li,
RFC 2385 protects you against attacks on the TCP session in addition
to autenticating the BGP data. Causing a valid BGP session to be reset
via attacks at the TCP layer is a very effective DOS attack which is
still possible under your proposal.

Effectivly BGP relies on its transport layer to provide it w/ a
session. Authentication needs to be a property of that session, since
events on the session are so or more important than the data in the
session itself.

Protecting BGP data does not address some of the most important
concerns.

  Pedro.

---

From: "John G. Scudder" <[email-masked]>
Date: Mon, 26 Aug 2002 13:47:59 -0400

Since draft-huawei-bgp-protection-md5-00.txt does not protect the 
transport layer, some other form of transport layer protection would 
be required in order to protect against RST attacks and the like.  In 
fact, this is exactly why RFC 2385 style protection was developed as 
a TCP option instead of using the BGP authentication field.

Considering that (a) transport layer protection is required anyway, 
(b) as a subset of its functionality it provides substantially the 
same benefits as application layer protection and (c) it's 
well-deployed already, I don't see the motivation for developing 
application layer protection as your draft describes.

Regards,

--John Scudder

At 2:28 PM +0800 8/26/02, lidefeng wrote:
>Attachment converted: JGS TiBook:draft-huawei-bgp-protection-md5 
>(TEXT/R*ch) (000A84F0)