North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
- From: Steven M. Bellovin
- Date: Wed Nov 23 23:02:37 2005
In message <email@example.com>, Randy Bush writes:
>> We need prefix ownership certs; these need a special field identifying the
>> prefix owned. (See RFC 3779, which also describes AS certificates). We
>> need the latter in CA form, for delegation.
>sorry to complicate, by iana allocates as ranges which are then
>subbed to rirs. so the ca bit could be set on these
I thought I'd mentioned earlier that we may want two different forms of
prefix cert, with with CA and one without. The one without goes in the
routers; the one with CA is used to issue certs to downstreams.
Rationale for the two certs: if a router is badly 0wned, someone can
steal its private key and use it for address hijacking. But that sort
of gross abuse of an entire prefix is likely to be noticed. A CA cert
can be used to issue certs for longer prefixes, i.e., target one
customer, rather than an entire ISP.
--Steven M. Bellovin, http://www.cs.columbia.edu/~smb