Newbie x Cisco IOS-XR x ROV: BCP to not harassing peer(s)

Sat May 14 22:35:23 UTC 2022

> In the end, the reason for all this RPKI-thingy is to prevent route
> spoofing by malicious actors.

sigh.  for my quarterly posting of the same many year old text

To be clear, as people keep calling BGP security 'RPKI',

    RPKI

    The RPKI is an X.509 based hierarchy [RFC 6481] which is congruent
    with the internet IP address allocation administration, the IANA,
    RIRs, ISPs, ...  It is just a database, but is the substrate on
    which the next two mechanisms are based.  It is currently deployed
    in all five administrative regions.

    RPKI-based Origin Validation (ROV)

    RPKI-based Origin Validation [RFC 6811] uses some of the RPKI data
    to allow a router to verify that the autonomous system originating
    an IP address prefix is in fact authorized to do so.  This is not
    crypto checked so can be violated.  But it should prevent the vast
    majority of accidental 'hijackings' on the internet today, e.g. the
    famous Pakistani accidental announcement of YouTube's address space.
    RPKI-based origin validation is in shipping code from AlcaLu, Cisco,
    Juniper, and possibly others.

    BGPsec

    RPKI-based Path Validation, AKA BGPsec, a future technology still
    being designed [draft-ietf-sidr-bgpsec-overview], uses the full
    crypto information of the RPKI to make up for the embarrassing
    mistake that, like much of the internet BGP was designed with no
    thought to securing the BGP protocol itself from being
    gamed/violated.  It allows a receiver of a BGP announcement to
    cryptographically validate that the autonomous systems through which
    the announcement passed were indeed those which the sender/forwarder
    at each hop intended.

Sorry to drone on, but these three really need to be differentiated.