Re: ROVER routing security - its not enumeration

2012-06-11 Thread Doug Montgomery
On 6/10/12 5:53 PM, "Paul Vixie" wrote: >Doug Montgomery writes: > >> > ... >> >> I think we debate the superficial here, and without sufficient >>imagination. >> The enumerations vs query issue is a NOOP as far as I am concerned. >>With >> a little imagination, one could envision building a b

Re: ROVER routing security - its not enumeration

2012-06-10 Thread Paul Vixie
Doug Montgomery writes: > > ... > > I think we debate the superficial here, and without sufficient imagination. > The enumerations vs query issue is a NOOP as far as I am concerned.With > a little imagination, one could envision building a box that takes a feed > of prefixes observed, builds

Re: ROVER routing security - its not enumeration

2012-06-06 Thread Doug Montgomery
On 6/5/12 3:40 PM, Randy Bush wrote: There are number of operational models that provide the needed routing protection without enumeration. I can see a use-case for something like: "Build me a prefix list from the RIR data" this requires a full data fetch, not doable in dns. and, at the oth

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Christopher Morrow
On Tue, Jun 5, 2012 at 5:39 PM, Tony Tauber wrote: > Shane A. gave a Lightning Talk the slides for which will be posted at some > time soon. I figured the talk was shane's. > They came in at the last minute which is why they're not up already. > ok, cool. thanks -chris > Tony > > On Tue, Jun 5

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Tony Tauber
Shane A. gave a Lightning Talk the slides for which will be posted at some time soon. They came in at the last minute which is why they're not up already. Tony On Tue, Jun 5, 2012 at 3:28 PM, Christopher Morrow wrote: > On Tue, Jun 5, 2012 at 2:42 PM, Daniel Massey > wrote: > > > > ROVER is not

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Randy Bush
> putting origin-validation data into IRR's happens today, it's not > 'secured' in any fashion, and lots of proof has shown that 'people > fill it with junk' :( So being able to bounce the IRR data off some > verifiable source of truth seems like a plus. so i should use the sow's ear as the author

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Christopher Morrow
On Tue, Jun 5, 2012 at 5:00 PM, Randy Bush wrote: > routing protection without enumeration. I can see a use-case for something like:   "Build me a prefix list from the RIR data" >>> this requires a full data fetch, not doable in dns. >> does it? shane implied (and it doesn't seem UNR

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Randy Bush
routing protection without enumeration. >>> I can see a use-case for something like: >>>   "Build me a prefix list from the RIR data" >> this requires a full data fetch, not doable in dns. > does it? shane implied (and it doesn't seem UNREASONABLE, modulo some > 'doing lots of spare queries')

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Christopher Morrow
On Tue, Jun 5, 2012 at 3:40 PM, Randy Bush wrote: >>> There are number of operational models that provide the needed >>> routing protection without enumeration. >> I can see a use-case for something like: >>   "Build me a prefix list from the RIR data" > > this requires a full data fetch, not doab

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Randy Bush
>> There are number of operational models that provide the needed >> routing protection without enumeration. > I can see a use-case for something like: > "Build me a prefix list from the RIR data" this requires a full data fetch, not doable in dns. and, at the other end of the spectrum, for any

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Christopher Morrow
On Tue, Jun 5, 2012 at 2:42 PM, Daniel Massey wrote: > did not need such an enumeration.     Enumeration is not a goal in itself. > There are number of operational models that provide the needed routing > protection > without enumeration. which are? I can see a use-case for something like: "

Re: ROVER routing security - its not enumeration

2012-06-05 Thread Shane Amante
One correction below. On Jun 5, 2012, at 12:42 PM, Daniel Massey wrote: [--snip--] > I think the first step is to step back and ask whether every operational > model needs > enumeration. For example, the talk yesterday by Level3 used the DNS and > IRR > did not need such an enumeration. T

ROVER routing security - its not enumeration

2012-06-05 Thread Daniel Massey
Hi, Just wanted to clarify a few things about the ROVER approach. One key misunderstanding seems to be that ROVER is an approach for enumerating all potentially valid routes. This is not the case. Slides on ROVER are posted for the NANOG 55 talk and there was an additional Lightning talk