Why not to use RPKI (Was Re: Argus: a hijacking alarm system)
danny at tcb.net
Fri Jan 20 08:11:41 CST 2012
On Jan 20, 2012, at 8:08 AM, Yang Xiang wrote:
> I think network operators are only careless, but not trust-less,
> so black-hole hijacking is the majority case.
This is aligned with the discussion on route leaks at the proposed
interim SIDR meeting just after NANOG.
Even with RPKI and BGPSEC fully deployed we still have this
vulnerability, which commonly manifests itself today even by
RPKI-enabled BGPSEC would give you some assurances that the
ASes in the AS_PATH represent the list of ASes through which the
NLRI traveled, but nothing about whether it should have traversed
those ASes in the first place -- so we still need something somewhere
to mitigate that threat.
See this draft for more information:
More information about the NANOG