BGP Security and PKI Hierarchies (was: Re: Wifi Security)
Steven M. Bellovin
smb at cs.columbia.edu
Thu Nov 24 04:01:01 UTC 2005
In message <17285.13981.462449.539200 at roam.psg.com>, Randy Bush writes:
>> We need prefix ownership certs; these need a special field identifying the
>> prefix owned. (See RFC 3779, which also describes AS certificates). We
>> need the latter in CA form, for delegation.
>
>sorry to complicate, by iana allocates as ranges which are then
>subbed to rirs. so the ca bit could be set on these
>
I thought I'd mentioned earlier that we may want two different forms of
prefix cert, with with CA and one without. The one without goes in the
routers; the one with CA is used to issue certs to downstreams.
Rationale for the two certs: if a router is badly 0wned, someone can
steal its private key and use it for address hijacking. But that sort
of gross abuse of an entire prefix is likely to be noticed. A CA cert
can be used to issue certs for longer prefixes, i.e., target one
customer, rather than an entire ISP.
--Steven M. Bellovin, http://www.cs.columbia.edu/~smb
More information about the NANOG
mailing list