- Test - lists.nanog.org

re: do you use SPF TXT RRs? (RFC4408)
by Nick Olsen 04 Oct '10

04 Oct '10

We use SPF. Lots of the bigger guys require it. Along with DK/DKIM signing. In our spam weight based filtering, if it hardfails it drops it, softfail(no spf record) we don't add or remove points at all. If it passes SPF we remove a few points of the spam weight. Nick Olsen Network Operations (877) 804-3001 x106 ---------------------------------------- From: "Greg Whynott" <Greg.Whynott(a)oicr.on.ca> Sent: Monday, October 04, 2010 12:48 PM To: "nanog(a)nanog.org list" <nanog(a)nanog.org> Subject: do you use SPF TXT RRs? (RFC4408) A partner had a security audit done on their site. The report said they were at risk of a DoS due to the fact they didn't have a SPF record. I commented to his team that the SPF idea has yet to see anything near mass deployment and of the millions of emails leaving our environment yearly, I doubt any of them have ever been dropped due to us not having an SPF record in our DNS. When a client's email doesn't arrive somewhere, we will hear about it quickly, and its investigated/reported upon. I'm not opposed to putting one in our DNS, and probably will now - for completeness/best practice sake.. how many of you are using SPF records? Do you have an opinion on their use/non use of? take care, greg

3 2

Geoff Huston's study on IPv6 Background Radiation - now on RIPE Labs
by Mirjam Kuehne 04 Oct '10

04 Oct '10

Hi, Earlier today, Geoff Huston presented the following at NANOG 50 in Atlanta: Background Radiation in IPv6. You can read the full story now on RIPE Labs: https://labs.ripe.net/Members/mirjam/background-radiation-in-ipv6 Kind Regards, Mirjam Kuehne RIPE NCC

1 0

2010.10.04 NANOG50 day 1 morning notes posted
by Matthew Petach 04 Oct '10

04 Oct '10

For those who might care, I've put version 1.0 of my notes from the morning session up at http://kestrel3.netflight.com/2010.10.04-NANOG50-morning-notes.txt and I bounced apache on the box, since it seemed to have gotten hung--sorry about that, for those who were puzzled at the timing out URL from earlier. ^_^;; Matt

1 0

2010.10.03 NANOG50 NANOG Community meeting nots
by Matthew Petach 04 Oct '10

04 Oct '10

Here's my notes from the community meeting from last night; sorry about being a bit late with them, the meeting ran long, and we dashed straight out from it to the social, which had already started by the time we wrapped up. ^_^;; Apologies for any typos still in the notes, I did a quick proofread this morning while jotting down this morning's notes, so it wasn't terribly thorough. Bcc'ing to nanog-futures@ as well, as it is germaine to both lists. Notes are also available online at http://kestrel3.netflight.com/2010.10.03-NANOG50-community-meeting.txt Matt NANOG50 2010.10.03 community meeting notes AGENDA: Steering committee report -- steve feldman Progream committee report dave meyer Communicatons commitee report This is a dialog, not a lecture; come to the mic with questions, comments, etc. steering committee report -- steve feldman blue badges are steering committee highlights since nanog49: day-to-day nanog stuff has Just Been Working thanks to hosts and merit for that! prep for 2010 election Postel network operator's scholarship preoparation for this and future meetings, through 2011 and the transition After NANOG50 select new PC members select new CC members (nominations still open) start on planning for 2012 meetings and the transition Mailing lists...look at website for list. Dave Meyers, Program Committee Report PC has yellow badges; if you like things on program, come let yellow badge people know. PC members really pull the conference together. PC committee member list Communications Committee Report, Mike Smith Red target badges! List of CC members is shown. They try to take a light hand when running the list; nanog-futures is a great forum, please do speak up. They are very much in need of more people, so make sure to nominate your friends (or enemies!)! Marketing Working Group -- Cat Hoffman members listed.. Full sponsorship attendance at NANOG49 sponsorship appreciation lunch and pre-promotion for NANOG50 Atlanta NANOG50 full sponsorship promotion attendance pre-promotion of NANOG51 Vendor Collaboration check it out in Chastain Room (may be called NOG room) Merit Report -- Andy R. Thanks to meeting host, TelX network connectivity, engineering power in general session onsite meeting staffing 2 socials! Other contributors for logistics Break sponsors, breakfasts, etc. Beer and Gear is Monday evening, they double as breakfast sponsors as well. Vendor collaboration is Comcast, Arris, A10, [and one more I missed] Merit Network Team Larry Blunk, David Bilbertson , DSue Joiner ,Dawn Khan, Rob Levitt, Carl Wadsworth. Pete Hoffswell NANOG 49, SF Attendance 607 total (record!) 505 PAID 102 WAIVED 199 newcomers (32.7%) 9 students 26 countries 31 US states plus DC NANOG49 revenue 409,061 expense, 423,340 balance -14,279 hosting was 184,221; SF was about 80,000 more than previous meetings; expense place to host, about 34% more than other locations. 2 big staff transitions at the beginning of the year, from Merit, put against the revenue from meetings, cost of about 40,000. 2 meetings upcoming NANOG51 Jan30-Feb2, Miami FL, Terremark NANOG52, June 12-15, 2011 Denver, CO, Alcatel, Lucent NANOG Election election process SC candidates NANOG charter amendment NewNOG charter Election slide, giving eligibility instructions should be on NANOG page; you can vote any time up to Weds morning. Announced Weds at lunch. Please, if you have opinion, please vote! SC candidates, 5 for 3 positions Thanks to Joe Provo who is aging out after 4 years. Rob Seastrom Richarch Steenbergen John Osmon Michael K Smith Patrick Gilmore Order is random, don't read anything into it. Rob Seastrom starts off with his statement, listing his experiences and background; his position statement is on the web, you can read it there. He'd like to help make Nanog stand on its own, and has some 501(3c) experience. Richard Steenbergen is up next; he's been on PC for 4 years, he's termed out there, so now he's running for SC. He thinks NANOG's been doing good job on the reform process that last 4 years; he'd like to help make the transition go smoothly, keep mailing list on topic, make it a good place for engineers to get information. And if you vote for him, you get custom-printed M&Ms. :) Michael K. Smith--chair of communications committee; been on SC as non-voting member for past year, working to make newNOG a success. Has been working on doing business modelling for the organization, and wants to keep doing it! Patrick Gilmore--he helped start newNOG, and wants to see it through; there's five really good candidates, so whomever you pick, newNOG will be in good hands. If you like what he's done, vote him back; otherwise, vote him off and signal a desire for change. SC members will become newNOG board members, btw. New Charter Amendment on Ballot Lets Merit wind down, and newNOG wind up; it's an endorsement for newNOG organization. If you're in favour of it, vote for it. :) There is also a newNOG election happening at the same time; everyone from NANOG will be eligible to vote for newNOG as well. Merit is running that as well. Shall we adopt the new bylaws as drafted by Steve Gibbard? Yes/No? Otherwise, the hastily done ones from Steve stay in effect. Bylaws do allow for amendments, so mistakes in either case can be rectified over time. That's it for the NANOG section of meeting. Now over to Sylvie's slides. Transition report--newNOG that's a placeholder name, once we have rights to a better name, we'll use a better name. milestones next activities reports from WGs created 5 working groups membership WG (kris foster) governance (steve gibbard) development (chris quesada)--getting revenue stream finance (dan golding) -- budget to spend the revenue technical (richard steenbergen)--support technical needs of the organization Sept 24, applied for 501(c)(3) with IRS; that will take many weeks, as it was a very, very thick sheaf of documents. Loan by ARIN to fund an executive director position Merit has loaned money to hire the executive director newNOG treasury income: donations: 11,125.00 other income 102.11 Expenses: hotel deposit 5,000.00 IRS application [get rest of numbers online] Executive director search accepting applications until Oct 15th http://www.newnog.org/ Form an RFP working group get involved!! send mail to board(a)newnog.org Issue RFP by end of Oct to contract Association management services IT services Conference Management services Membership-wg(a)newnog.org Ren got drafted to do this. But Joe can stand in for her. membership-wg, hammered out membership structure to fold into the bylaws Basic overview of different member models used in different organizations following nanog49 (thanks Janine!) fine print listing of qualifications for newNOG membership is put up. There was discussion on newnog-futures about the types of memberships. Steve Gibbard, governance working group, notes that the life member was no longer 10x, it's now at board discretion. Joel Jaegli, on 9/2, failed to get a rise, he's not sure he'll vote against them, he would have preferred different language in them. The other bearded one is not here to voice his thoughts. Joe agrees that this will be an iterative process over time. Joel notes that once success from last time around was that we left a lot up to the discretion of the various orgs responsible for them; that is a useful model to consider going forward, such as membership models and dues. Kevin Oberman, ESnet, he's been here for many years; the logo used to be a drawing of a necktie with the words "official member"--those who had an interest paid their money, and showed up. Why do we need to have requirements for demonstrated professional competence as part of the requirements? Why can't we simply let anyone who wants to pay, show up to the meetings? Why can't we let it be as open as possible? Joe notes that the openness idea is to have paid attendance separate from 'membership' status. Dan Golding--not part of membership working group; the weasel words were so that anyone who wanted to join could; you need to have some definition for membership for non-profits for IRS. Otherwise, you have to list it as "those with interest in topic area X". Some are happy with outcome, some are unhappy. We got the best output we could from 14 person team; with larger group, it's hard to come up with output everyone likes, or is comfortable. When you have larger working groups, concensus is challenging. Also, membership working group was pretty vague, pie-in-the-sky for its goals. Lessons learned; fewer people, more input from the board, more constrained choices. Fellow members selected by board, for outstanding service to the community. Board doesn't have to actually *add* any fellows, but the option is there; it can be dropped if people don't think it's useful. Martin Hannigan, man who wears many hats. Neutral with respect to NANOG to newNOG; not subscribed to futures mailing list; heard that randy made some interesting comments about it. He doesn't really support it; he appreciates it's hard work; but it sounds kind of obnoxious. A good deal of his advancement came from NANOG, and it would have been much harder without access to it. Joe: boilerplate was from IEEE, the front loading of the lifetime membership was to build the bank. difficulty with travel allows for people who can't make the meetings to still participate. the membership is to establish an eligible pool for voting on corporate matters, not limit meeting attendance. it also establishes a revenue stream. And a way to recognize one's peers. fundamentally: Need members who can vote Need revenue stream from members John Springer--are we all members? At present, yes, for the first member. After the first election, you have to join to be a voting member. So, as of Wednesday, if we pass this, then we all cease to be members. Current interim bylaws leave it up to the board. Bill Norton asks--the vote for bylaws is thumbs up or down; it's an all or nothing vote right now, no way to vote down on membership. RS asks Martin Hannigan about his question; turns out he was asking why we needed a membership structure at all? Turns out that for non-profit organizations, you must satisfy some prerequisites to become a member, like for a credit union, you must belong to a legally qualified category to qualify for voting. Martin is happy to understand that, and will vote yes, as he thinks that this group can pluck a turd out of a punchbowl; but he thinks that membership qualifications are problematic, and would be happy to have one that's just pay $50 to get a membership card. Steve notes that there's sufficient disagreement on the topic, we'll probably need to go back and adjust the membership topic some more. Matt Petach from Yahoo asks how we vote for changes to membership rules if we pass the new bylaws, and cease to be members at that point? If we pass the new bylaws, people will have to pay the $100 to become members again in order to vote for changes. Better is the enemy of good enough; are we moving in a positive direction, as we refine this, year over year? David Farmer, UofMinn--this is eligibility for voting that we're talking about; when he first looked at it, it wasn't clear it was about voting, it seemed that applied to those who could participate. We need to be very clear what the restrictions on membership imply, and what participation people can or cannot engage in. The IEEE model is *not* that way, so we need to be clear if we point to it as the boilerplate that we used for this. Michael Sinatra, UCB, is there an intent to provide discount for meeting fees for NANOG members? It has certain negative impacts; perhaps extend earlybird pricing for members? Once we have membership, we need to streamline it, and codify the benefits that paid membership brings with it. If you are going to do that, you have to be very careful that there is decoupling between membership and participant status, so that we don't put participants disenfranchised or feel turned away. Perhaps, but we do want to make people want to become members. Dan Golding notes there was some discussion about the breakeven point between membership and meeting costs. Joel Jaegli notes there are people who participate who do not attend meetings; this will allow them to participate more in the process. Financial slides will be online after this. How can you help? participate in the process; it's expected to be iterative, there will be refinements as we go along. Governance working group, Steve Gibbard herding cats to get bylaws drafted. The working group was thrown open to everyone who wanted to join, and got a large list. He puts up a list of the major contributors. Draft by-laws were written up; but they didn't write up the membership section, that was the membership wg. :D rest of section was mainly merging NANOG charter with interim newNOG charter. Took structure from existing charter. There is an elected board that has actual power; executive director will serve as board member, for tie breaking, and to keep voting the same. Executive director selected by elected members of the board; the board can remove the executive director. Added some extra committees: membership/development budget/finance Amendability--by majority of membership or temporarily by the full board. Assumption that we got a lot of things wrong, so goal was to make it as amendable as possible. The ability of board to temporarily amend was mainly done to allow for adjusting rules to make IRS happy for the first year; after the first year, it expires unless specifically revoked. It sounds like there's a lot of concern about the membership rules, but not as much about the rest of the bylaws. If the new bylaws are passed, we have a provision to allow the new members to vote them out or to change them over the coming year. Bill Norton notes that we're putting faith in the steering committee to make changes to the membership rules. If we vote thumbs up on bylaws, we note that we may have the board changing the rules over time; if people pay lifetime membership now, will they be immune to changes in the future, based on their payment? The fellows, setting of fees, etc. was all left to the board. The board could decline to set a fee, or set the fee so high nobody wants to pay it, if they want to take it off the table. Could people be amended out of their membership? That depends on what the board says, and what amendments people bring to the table. Patrick notes that it's a membership org; so there's nothing stopping the members from voting to change the structure after you buy your lifetime dues. If you don't have faith in the org, pay the annual dues; if you do have faith in the org and your fellow members, then go ahead and pay it. It really comes down to a matter of how much you trust the other people in the room. Don Welch, Merit networks; if the ED serves at behest of board, it will be with some longevity, while board cycles out. The ED and assistant will have institutional knowledge, compared to short term limits of the board. Patrick notes the ED will be very powerful, as they will have a seat on the board, as well as outlasting the rest of the board. It's a matter of making the right choice; the membership can make an amendment to remove the ED if they can get a majority to approve it. development wg; Chris couldn't be here, but Sylvie can talk about it. Betty Burke, Chris Quesada, Valerie Wittkopf sponsorship highlights: additional sponsorship programs little change from attendee perspective beer and gear, breaks stay same, marketing, sales, still limited more flexibility for sponsors multiple sponsorship program, sponsors can provide for a calendar year, rather than just a single break or event. Finance working group, with Dan Golding Dan Golding, Bill Norton, Michael Smith, Tom Daly, Duane Wessels, Board liason. Remit: Budget--create cash budget for now through 2012, a cash budget based on sponsorship, revenues, etc. Budget is done, waiting for board approval create financial controls and systems to make sure finances are being handled properly. Budget is complete, submitted with IRS application, board will review and vote on it this meeting. Efforts ongoing for financial controls and systems. Budget determined by looking at membership structures, determine probable membership and meeting attendance. provided a sounding board for development WG as they created sponsorship models for 2011 and 2012 conferences. (models were very conservative, we should be able to hit those numbers). Expense side; pretty limited data on what it costs to run a conference; we have aggregate totals, but specific breakdowns. Extremely conservative expense model, buffer for all line items, and assumes no discounts. Some areas will not be clear until we've run a conference. still pretty confident. This was done as openly as possible; only requirement was financial or accounting knowledge all volunteers accepted lots of collaboration with other working groups If you are dissatisfied with this, please step up and volunteer. Small group, but everyone contributed spectacularly to the overall effort. most difficult issues: which sponsorship model to use shift from traditional "ala carte" to industry typical "bronze/silver/gold" model should make sponsors happier and easier to budget for. Staffing level of the organization small staff (ED), augmented by event assistants "Hooks" in budget for association mangement an option Is the newNOG org financially viable? Yes, though this was not a starting assumption. If everything comes together, sponsorships, membership in reasonable numbers, etc. This should be viable for 6 figures a year, which should be enough to keep us afloat in case of bad events, acts of god, and horrible conferences. David Farmer, UofMinn--association management; are they looking for a for-profit or non-profit doing it, some other organization do it? this will be part of RFP going out; it will be open, it could be for profit, non-profit, etc; there's no preconceived notions around who may apply. We'll be looking for someone who is very good at doing it. Martin Hannigan--if buckets don't fill, what's the contingency plan; do we have a line of credit, so that the meeting can still happen in spite of poor revenue stream? A: Dan notes that was one of the biggest concerns about this. ARIN provided a good sized loan to fund the ED position, thank you ARIN, that will get the ED piece off the ground. But for the conference numbers were put in, they were worse than what we are achieving today. We tried to be as disciplined as possible about any assumptions. Between the ARIN loan and the conservative assumptions, we should be OK. Holly Jacobson, Cisco, this is great; one caveat, there are some organizations that like to host events in their home town; IETF has that kind of issue. A: Chris Quesada is pretty good about this; if you want that type of privilege, you'd really pay for it. So, if someone wants it that badly, they can get it, but it'll really cost them. Right now, NANOG gets what's left for sponsorship budgets, since we don't plan in advance. Now that we're planning more than a year in advance, we should be able to get into people's budgets well in advance. Mike Hughes, Google, there's often some provision to restrict signing authority for the ED; they're likely to have primary signing authority. There don't seem to be any financial restrictions or expiration terms around it. A: we'll probably add those in within a separate document, requiring a second signature from someone else in the org above a certain threshold. Steve Gibbard jumps in to note intent in bylaws was that board was final authority, and would decide on what those limits were. Patrick notes those limits aren't meaningful, since ED can sign binding contract in spite of limits in the bylaws. John Curran said ARIN put a quarterly note at 30,000 note, 2%, payments begin 25 months after initiation. Each quarterly payment is contingent upon report of progress, including financial controls; so an ED that goes haywire will find that the payment 90 days out will simply not happen. The controls ask for audited financial statements, etc. The ARIN note amortization is shown on screen. Pat P. financially strapped student; right now, membership only buys you a vote; he's unlikely to be able to spend the money. Dan Golding notes he shouldn't get a membership; $100/year for a vote is probably not a good tradeoff. But those who feel really strongly about it, may make the choice. Right now, the assumption is 100 members to start with, topping out at 250 in 2012. There's probably 40-50 people just in the steering committee, program committee, working groups, and the recently rehabilitated. At end of first year, end of 2011, 100 members, 2012, 250, 2013, 500 were the target member counts. Social started 10 minutes ago. Joel Jaegli noted a student served on the program committee, so we should not count them out. We should consider a discounted rate for students. Election for bylaws; donny roiseman; vote is for bylaws in full; in section 9, lists four committees, but details five; how do we deal with errors like that? Look at controlling section of it; 2 mechanisms to fix them; board can make adjustments with unanimous vote; or wait a year and put it through the full process; depends on severity of the error, and community support. Dan Golding: When charter came out in 2005, there were at least as many errors, and over next 24 months, they were slowly corrected. with any effort like this, there's going to be errors that we'll find over time, it's part and parcel with this process. Louis Lee, will be a member for sure! OK, we'll wrap up and go (late) to the social! We wrap up at 1729 hours Pacific time.

1 0

router lifetime
by Franck Martin 04 Oct '10

04 Oct '10

How long do you keep a router in production? What is your cycle for replacement of equipment? For a PC, you usually depreciate it over 3 years, and can make it last 5 years, but then you are stretching the functionality, especially if you upgrade the OS, tho it is not uncommon to see companies still on XP and IE6. I'm wondering what is the rule of thumb for routing hardware? Same shelf life as a PC or you keep the hardware much longer?

11 14

Re: [ncc-services-wg] RPKI Resource Certification: building features
by mkarir 04 Oct '10

04 Oct '10

Hi Alex, We are trying to tackle a similar problem with the RADB. The approach we have taken is to build into the object management web portal an alerting system that provides alerts to a user when there is a mismatch between what is in the IRR and what is observed in BGP. Right next to the alert will be a button that they can click on to "fix" their own IRR information or to flag an object as "conflict - needs review" to allow Merit to manually review and resolve conflicting IRR information. If it indeed is a hijack then they can take other steps. A second piece of this is a historical origin database we have built where we attempt to learn from history what a valid origin might be for a given prefix. Lots of complications here with moas and newly announced prefixes but some heuristics can help here. Once again this db becomes a source of validation information like the IRR database. Not for use in rejecting/accepting routes but for generating alerts that allow a user to fix/monitor their routing assets. So in both these cases we take what is reported in BGP and compare it with sources of possible validation and generates alerts for users on mismatches. The final piece of the puzzle which is a link with roa is something that we are still working on integrating into the RADB. The piece that is currently in place add roa-uri tag to irrd which allows a user to specify in the IRR a URI pointer to a roa for that prefix. Currently we dont use it in any validation. However we have a modified rpki-whois that at the end of the whois query will perform roa validation and tell the user whether the roa was valid or in in addition to the usual whois reponse. -manish On Oct 4, 2010, at 6:00 AM, routing-wg-request(a)ripe.net wrote: > > Message: 1 > From: Alex Band <alexb(a)ripe.net> > Date: Sun, 3 Oct 2010 19:08:33 +0200 > To: ncc-services-wg(a)ripe.net, > routing-wg(a)ripe.net > Subject: [routing-wg] RPKI Resource Certification: building features > > Most of the discussions around RPKI Resource Certification that have = > been held up to now have largely revolved around infrastructure and = > policy topics. I would like to move away from that here and discuss > what = > kind of value and which features can be offered with Certification > for = > network administrators around the world. Because in the end, the > goal is = > to make Internet routing more robust and create a more reliable > method = > for network operators to make routing decisions. > > We all know about the shortcomings of the IRR system and that just > half = > of all prefixes on the Internet have a route object associated with > them = > (http://bgpmon.net/blog/?p=3D140) However, it does mean that there > is = > ton of valuable information in the IRRs, whereas the Certification = > system needs to start from scratch. Based on many discussion I've > had = > with members and the Community, here is my idea for a Route Origin = > Authorisation** (ROA) wizard that retrieves IRR information, > compares it = > to real world routing and uses that for the creation of ROA = > Specifications. This has a number of benefits: > > - Network operators don't have to create their routing policy in the = > Certification system from scratch > - Because a comparison between is done the IRR and RIS = > (http://ripe.net/ris/) only accurate up-to-date information is > added to = > the Certification system > - The accuracy of the IRR is increased as a bonus, and is achieved = > without leaving the wizard > > Ideally, a network operator should be able to manage and publish > their = > routing policy =96 both for the IRR and Certification =96 from one = > single interface.=20 > > Here are the basic steps for the wizard after a certificate is = > generated: > > 1. Start ROA Wizard > > 2. Detect IRR information using the AS numbers in the Certificate, > like = > for example: > = > http://www.db.ripe.net/whois?searchtext=3DAS286&inverse_attributes=3Dorigi= > n&form_type=3Dsimple > > 3: Compare results with RIS using RRCC/Netsense, like for example: > http://www.ris.ripe.net/cgi-bin/rrccng/query.cgi?target=3DAS286 > > 4: Allow user to flag which ROA specifications they would actually > like = > to create, based on the IRR and RRCC/Netsense results. > > 5: Allow user to create additional ROA Specifications > > 6: Detect which maintainer is used for the route objects in the IRR > > 7: Allow user to specify maintainer password/pgp key, so all route = > objects are updated/removed/added based on the ROAs that were > created. = > This makes sure the data in the IRR and the Certification system is = > consistent.=20 > > 8: Save and publish ROAs and route objects > > Do you think there is value in creating a system like this? Are > there = > any glaring holes that I missed, or something that could be added? > I'm = > looking forward to your feedback. > > Alex Band > RIPE NCC > http://ripe.net/certification > > > ** The certification system largely revolves around three main > elements: = > (1) the Certificate, that offers validated proof of holdership of an = > Internet Resource, (2) the Route Orgin Authorisation Object (ROA), a = > standardised document that states that the holder of a certain > prefix = > authorises a particular AS to announce that prefix and (3) the = > Validator, which relying parties, i.e. your peers, can use to > validate = > certificates and ROAs.= > >

1 0

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Owen DeLong 04 Oct '10

04 Oct '10

>> >> No... I'm saying that if ISPs aren't the only entities that hold their >> private keys, then they aren't the only entities that can sign their >> resources. > > The hosted system that we created uses Hardware Signing Modules (HSM) > for generating keys and signing operations. By design it is impossible > to retrieve the private keys. Any process or feature that would involve > the transferral of keys cannot be implemented. > In other words, not only do you hold the resource holders private key, but, they do not. This means that the ability to sign their resources is 100% under your control and 0% under their control except to the extent that you allow it. While I'm not accusing RIPE of nefarious conduct and do not believe that there is any malicious intent in the system, I do believe that it is a security model that any rational provider would likely consider untenable. The fact that you cannot retrieve the key is of little relevance, since you have full use of the key without retrieving it. > Access to the *use* of the keys is a different thing though. This is > controlled by the software. Although we cannot extract the keys, we can > instruct the HSM to create a new key, or use an existing key to sign > something. > Exactly... > Our hosted software controls all (activated) hosted member certificate > authorities. The process has potential access to the *use* of *all* keys > in the system. However, other security layers are implemented to ensure > that for a given LIR only those users that have the 'certification' > group enabled are *authorised* to use the hosted system -- and thereby > the applicable keys. > But by the very nature, the administrators of the system have the ability to make themselves members of the certification group. While I'm not saying that I think RIPE would do such a thing, the reality is that using this hosted solution is placing a tremendous amount of trust in the system and the administrators of the system. I have no problem with LIRs that choose to do this, so long as they are making an informed decision and understand the risks. I think the risks have been substantially down-played. >> >> If you choose to delegate the CA role for signing your resources >> to someone else, then, obviously, you have to give them a valid >> private key with which to sign those resources. >> > > > Given this setup a member can authorise any person to use the system by > creating an LIR Portal account for them and enabling the certification > group. Only the LIR's admin user can do this. > Really? There's no way for any member of RIPE staff to make corrections to an LIR's admin account such that it would be possible to bypass this? I tend to doubt that any sustainable system could be built in such a manner. Again, I am not accusing RIPE of doing so, but, pointing out that for such a hosted solution to remain functional over time, there must be certain compromises in the trust model. These compromises should at least give one pause and be carefully considered prior to handing over that level of trust. >> However, in doing that, you've created a situation where your >> signature is now much easier to forge. Kind of like automatic >> signing machines for checks. Benefit: The accounting department >> can sign thousands of checks and the CFO doesn't have to. >> Draw-back... The accounting department can sign thousands of >> checks without the CFO knowing they did so. >> > > The current system has an audit history page that shows all the commands > executed by users. It includes details like the name of the user, the > time of the change and further details: e.g. in case of the modification > of a ROA specification the complete new specification is visible in the > history. > So at least if someone does something horrible, assuming the system integrity is not compromised in the process, we can tell what happened and either who did it, or, at least who they chose to impersonate. That's good, but, by itself it is not enough. > There is currently no additional notification mechanism implemented but > that would be fairly trivial to add if there is a demand. > That would be a good additional safety feature. > > Non-hosted: > ===== > > Of course we put a lot of effort into maintaining security and quality > of the implementation we built. But we can well imagine that for some > people it is a matter of principle that they want full local access to > their own private keys and important configuration objects such as ROAs > -- and don't want to be hosted on a shared system outside of their > control. Other members may not mind so much about this and choose to > trust and use the hosted services. > Exactly my point... Such a choice should be an informed decision and if it is not a matter of choice made by the organization holding the resource (as is currently the case), then, there are issues. > There is standard that is close to completion in the SIDR WG in the IETF > that defines a protocol by which a parent and child Certificate > Authority can communicate. > > http://tools.ietf.org/html/draft-ietf-sidr-rescerts-provisioning-06 > Which is a major step forward in this area. > In our case the RIPE NCC system could function as the parent CA for a > non-hosted LIR child CA. The LIR can then deploy anything they see fit > themselves. They would have full access to their own private keys and > everything else in their system and can delegate as they see fit. And > add new features of course. > Another alternative in the meantime would be for the resource holder to maintain their private key and have transactions accomplished through a CSR process, but, obviously, this comes with a different set of tradeoffs, not the least of which is a certain amount of manual and mechanical complexity. > But.. > 1) We have not implemented support for this yet. We plan to go live with > the fully hosted version first and extend it with support for non-hosted > systems around Q2/Q3 2011. > > 2) It can take considerable effort for LIRs to set up their own > non-hosted solution from scratch. We know that ISC is developing an open > source solution (rpkid) that may be useful for LIRs that want to run > their own instance. From our side we will make sure that we test > interoperation with this system when we implement this protocol in our > system. > I think that's a good plan. However, Randy's criticisms of the hosted solution are not without merit. While I am glad to see that the RIPE hosted solution is not such a scheme, my comments were based on the fact that other schemes I have seen for other certificate systems involved the user holding their private key after it was given to them by the hosted system. Such a system would obviously the worst of all worlds from a security standpoint. Owen

1 0

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Owen DeLong 04 Oct '10

04 Oct '10

> >> I'll go a step further and say that the resource holder should be >> the ONLY holder of the private key for their resources. >> >> Owen > > If you're saying that ISPs can only participate in an RPKI scheme if they > run their own Certificate Authority, then I think that would practically > ruin the chances of Certification actually ever taking off on a large > scale. > > -Alex No... I'm saying that if ISPs aren't the only entities that hold their private keys, then they aren't the only entities that can sign their resources. If you choose to delegate the CA role for signing your resources to someone else, then, obviously, you have to give them a valid private key with which to sign those resources. However, in doing that, you've created a situation where your signature is now much easier to forge. Kind of like automatic signing machines for checks. Benefit: The accounting department can sign thousands of checks and the CFO doesn't have to. Draw-back... The accounting department can sign thousands of checks without the CFO knowing they did so. Owen

1 0

RPKI Resource Certification: building features
by Alex Band 04 Oct '10

04 Oct '10

Most of the discussions around RPKI Resource Certification that have been held up to now have largely revolved around infrastructure and policy topics. I would like to move away from that here and discuss what kind of value and which features can be offered with Certification for network administrators around the world. Because in the end, the goal is to make Internet routing more robust and create a more reliable method for network operators to make routing decisions. We all know about the shortcomings of the IRR system and that just half of all prefixes on the Internet have a route object associated with them (http://bgpmon.net/blog/?p=140) However, it does mean that there is ton of valuable information in the IRRs, whereas the Certification system needs to start from scratch. Based on many discussion I've had with members and the Community, here is my idea for a Route Origin Authorisation** (ROA) wizard that retrieves IRR information, compares it to real world routing and uses that for the creation of ROA Specifications. This has a number of benefits: - Network operators don't have to create their routing policy in the Certification system from scratch - Because a comparison between is done the IRR and RIS (http://ripe.net/ris/) only accurate up-to-date information is added to the Certification system - The accuracy of the IRR is increased as a bonus, and is achieved without leaving the wizard Ideally, a network operator should be able to manage and publish their routing policy – both for the IRR and Certification – from one single interface. Here are the basic steps for the wizard after a certificate is generated: 1. Start ROA Wizard 2. Detect IRR information using the AS numbers in the Certificate, like for example: http://www.db.ripe.net/whois?searchtext=AS286&inverse_attributes=origin&for… 3: Compare results with RIS using RRCC/Netsense, like for example: http://www.ris.ripe.net/cgi-bin/rrccng/query.cgi?target=AS286 4: Allow user to flag which ROA specifications they would actually like to create, based on the IRR and RRCC/Netsense results. 5: Allow user to create additional ROA Specifications 6: Detect which maintainer is used for the route objects in the IRR 7: Allow user to specify maintainer password/pgp key, so all route objects are updated/removed/added based on the ROAs that were created. This makes sure the data in the IRR and the Certification system is consistent. 8: Save and publish ROAs and route objects Do you think there is value in creating a system like this? Are there any glaring holes that I missed, or something that could be added? I'm looking forward to your feedback. Alex Band RIPE NCC http://ripe.net/certification ** The certification system largely revolves around three main elements: (1) the Certificate, that offers validated proof of holdership of an Internet Resource, (2) the Route Orgin Authorisation Object (ROA), a standardised document that states that the holder of a certain prefix authorises a particular AS to announce that prefix and (3) the Validator, which relying parties, i.e. your peers, can use to validate certificates and ROAs.

1 2

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Randy Bush 04 Oct '10

04 Oct '10

> Do you think there is value in creating a system like this? yes. though, given issues of errors and deliberate falsifications, i am not entirely comfortable with the whois/bgp combo being considered formally authoritative. but we have to do something. > Are there any glaring holes that I missed yes. the operator should be able to hold the private key to their certificate(s) or the meaning of 'private key' and the security structure of the [ripe part of the] rpki is a broken. randy

3 2