- Test - lists.nanog.org

NANOG36-NOTES 2006.02.15 talk 2 Katrina--telecom infrastructure impacts
by Matthew Petach 15 Feb '06

15 Feb '06

2006.02.15 Hurricane Katrina: Telecom Infrastructure Impacts, Solutions, and Opportunities, Paula Rhea, Verizon A more interactive presentation from her, in the aisles. Verizon Business group--combined MCI/Verizon team. Agenda Hurricane Katrina Recap Telecom infrastructure impacts telecom provider successes business continuity planning conclusions references appendices: case examples. Many of the people in this room would be considered part of the critical infrastructure for the nation by the department of homeland security After world trade center 9/11 issue, there was a lessons learned; hopefully there will be a similar report post Katrina. New Orleans is still very much like a war zone right now; it's definitely a disaster recovery training session for many industries. Neighborhoods are wiped out; no capital investments, infrastructure in holding pattern. Many with no power, 20% of houses condemned. Neighborhoods that are entirely silent--eerie. Aim is not to diss anyone specifically, certainly not in this room; aimed to be an assessment in a neutral fashion. Critical infrastructure: food and water supply energy transportation healthcare banking/finance telecommunications/infrastructure Oddly enough, much of critical infrastructure is privately owned, rather than government owned. The domino model says that any one piece will cause the rest to start to fall. 35th largest city in US port of new orleans is #1 in US by tonnage 50% of total US grain exports shipped via gulf 10.8% of total US refining from new orleans 5th largest port Key space shuttle facility in Michoud supported fuel tanks for international space station Storm recap hirricane hit aug 29 2005 135MPH winds, 20foot storm surge sent inland 55foot surges logged in gul pior to landfall levee failures create secondary crisis 2.3M homes without power spawned 33 reported tornadoes in NA 1090 fatalities in LA recorded to date people dancing about cat 5 dropping to cat 4, thought they were spared, then levees broke; had been predicted the year before. :( Still 2500 people missing/unaccounted for. Map of eastern LA parishes st bernards/plaque mines parishes between the lake and the gulf, hardest hit when levees broke as water headed back towards gulf. Lack of interoperability between parish govt systems. New orleans telecom impact (multi-carrier) 1.75M lines down immediately following kat. 38 911 centers out (1/3) initially 1,000 cellular towers out two class 4 toll switches initially out of service no power/unable to secure extended diesel fuel Traffic out of lata logjammed with toll switches out. LECs had backup power systems, but no fuel. Took 4 days to inspect causeway to allow emergency crews into the city with main bridge out. Most nurses and doctors were in suburbs, not in city. Central offices post katrina new orlenas lake co CLLI NWORLALK Venice LA CA CLLI: VENCLAMA Buras CO CLLI: BURSLAMA 19 COs are totally destroyed, and will have to be rebuilt. These slides are public domain info, no inside info. I2/Abilene link from Houston to Atlanta initially out, restored on sept 8 2005 fiber optic path on lake pchatrain bridge offline following hurricane katrina wifi, wimax and voip play key role in area communications public internet was actually very resilient Telecom provider successes: alphabetic 1,000 amateur radio operators helped bellsouth cingular cisco cox, iridium added 10,000+ new phones to first responders MCI Nortel Sprint/Nextel donated up to 10M Verizon donated 8M and 200 workers Carriers have mutual aid agreements; Verizon sent 200 people who volunteered to spend 8 weeks living in a tent to help rebuild--had to work with armed guards. The CO rebuilds wasn't any type of upgrade, it was bulldozing damaged/destroyed facilities, digging new vaults, and starting over to restore just what was in place before hand. Bill Norton--COs underwater, can you imagine some type of preventative design that could have been put in place to help avoid impacts like this? Most of the area is reclaimed land, 2 miles below sea level (some dispute about that number). Bill wonders if they could be built above sea level somehow. Even if they were, Paula notes that they wouldn't have power, wouldn't have 2 weeks of diesel fuel to run them, etc. Really, it comes back to the levees. Randy Bush noted that early on, community based wifi was one of the early-on means of communication to daisy-chain packets along. Roland, from Cisco; did some logistical work with relief; Verizon donated eVDO boxes to make eVDO to wifi bridges, did VoIP over wifi to eVDO boxes to juryrig connectivity. But doesn't work so well with towers down, and no power. With the cell phone infrastructure down, that really hurt too. Thanks to Todd Underwood/Renesys for their graphs; did a pre-and-post analysis routingwise. Top red is LA; about 170 networks totally out during the bulk period. teal/TX not impacted, MS also hit, in tierms of percentage more so than LA AL somewhat hit. There's likely to be some significant number of businesses that never recover from this. 6months later, port of NO at 50% capacity 130,000 lines remain out in LO; awaiting local govt repopulation lans cellular service fully operational in occupied areas outside of those with restritcted access US congtressional budget office estimates damage at $60B in insured and uninsured losses; insurance is tagging it at $75B. It would have been far better to have spent money helping fix the levees up front. BCP will your organization be able to survive a disaster? 1 what staf, materials, proceedures, and equipment is vital to the firm 2 what suppliers and resources do I need daily 3 what will you do if your building is not accessible 4 have you planned for payroll continuity 5 who should yo invo BCP compontents NIST 800-34 document develop contingency plan intro/activation stage/recovery phase/reconstitution stage/ plan backup. People are still in emergency mode six months later disaster recovery journal (DRJ) survey IAEM, international association of emergency managers GAP in business continuity % stating bc plan is important 62% 60% have a plan 58% tested in last 12 months 18% never tested plan 55% implmented security measures only 49% have bckup servers Telecom conclusinos interdepenedt infrsatrurctures incrase risk business continuity management should include plans for "worst case" scenrios operate--interopearte factor in data recovery and storage into plans be flexible June 1st, hurricane season starts again DNA records lost from courts, many records that might have been mandated also lost. Vision of public internet realized ARPANet launched predecessor in 1969 Goals: use disparate computers to communicate in order to provide high reliability and survivablility Katrina proved it is possible for Internet to meet that mandate.

1 0

NANOG36-NOTES 2006.02.15 talk 1 ipv6fix (and boy, does it need it)
by Matthew Petach 15 Feb '06

15 Feb '06

Morning intro notes--don't forget to fill out your SURVEYS!!!! six lightening talks signed up, should be very cool. If you have slides, get them to Steve Feldman start with! Wireless movie after break should be cool to watch. Ren? Steve mistakenly introduces her, she corrects them. Don't forget to give feedback via the Survey forms!! 2006.02.15 v6fix: Wiping the Slate Clean for IPv6 Kenjiro Cho, WIDE/IIJ, Ruri Hiromi, WIDE/Intec NetCore Will be talking about their efforts to deploy IPv6, called v6fix. v6fix is an effort to solve problems in the current v6 deployment. focuses on v4/v6 dual stack environments. it's a technical analysis of real world problem Kenjiro will talk about tools and measurements. deployment status majority of equipment out there is v6 available from major vendors still many applications and appliances just work with v4 v6 is starting to get into various business fields Many people lack knowledge/experience with v6. when non-experts hit problems, they're clueless. Example: illiteracy. Hotel internet systems have instructions for guest. troubleshooting: if you have IPv6 enabled, please disable IPv6--brochure in guest room. Cause of problem: combination. DNS redirection returns specific A record for AAAA clients stub-resolver accepts the A for AAAA, can't get out. Wiping the slate clean for the v6 faulty behaviours only 1% and combinatorial often, but could be fatal to deployment. slow fallback to v4 after v6 errors misbehaving DNS resolvers filtering of ICMPv6 DNS misconfigurations poorly configured tunnels lack of peering or v6 paths v6fix activities (research group) identify/analysze/solve real-world tech problems in v6 deployment. Enemy: "after disabling v6, my problems went away" Cooperation needed between researches, implementers, ops. v6fix topics harmful effects of the on-link assumption. misbehaving DNS servers and resolvers slow fallback to v4 after v6 failures Examples: case 1: DNS loop at hotel real story of hotel internet system--went to same room, investigated. DNS is intercepted, redirected to signup page ipv6 users can't get beyond first page hotel instructions say to disable v6 erroneus DNS redirection system and stub-resolver redirection system always returns specific A record when getting non-A queries client's stub resolver queries AAAA for any address, blindly accepts A return response. case 2: DNS server slowdown Japanse ISP ISP upgraded a DNS cache to BIND9, recieved complaints about slowdown. recompiling BIND9 with --disable-ipv6, fixed problem, reported to JANOG Caused by older BIND9 w/o IPv6 connectivity server w/o v6 connectivity always tries to talk over v6, ends up failing back to v4 after timeouts fixed in BIND9.2.5 and 9.3.1 Common factors 1 problems appear only with specific combinatorial conditions 2 implementors and operators didn't notice until reported 3 even for professionals, not easy to track down problems. Kenjiro Cho, Tools: v6 tools and measurement results Goal: to understand the macro-level v6 healthiness current methodologies wide area meaasuremetn of behaviours of 2nd/3rd level DNS servers dual stack issues DNS server measurements of .jp domain AAAA responses: 0.13% DNS servers can't deal with AAAA requests Most are lame delegation type errors. ignore AAAA queries respond with RCODE 3 ("name error") NXDOMAIN dual-stack path analysis measurement techniques specifically designed for dual-stack take measurements for v4 and v6 at same time compare v6 results with v4 results extract problems that exist in v6 only methodology dual-stack node discovery create dual-stack node list by monitoring DNS AAAA replies. dual stack ping run ping/ping6 to target dual-stack nodes select a few representative nodes per site (/48) by RTT dual-stack traceroute trace/trac6 to selected nodes visula v6 MTU to look at issues visualize path issues distribution of v6/v4 RTTs 4000 ping targets v4 on x-axis, v6 on y axis individual nodes far above unity line--leaf issues paths and PMTU visualization from NYSERNET to ARIN sites Many of ARIN paths via jp! (lack of peering) >From ISC to ARIN sites--paths look much better, but lots of blue == lots of tunnels Abilene case: well known problem. Abilene trying to encourage v6 adoption no AUP, tunnel services for v6 but ended up with horrible v6 paths, mostly with tunnels ISPs are reluctant to move to paid v6 connectivity Abilene thinking about suspending its relaxed AUP for v6 tool tries to illustrate such issues, convince users to move to native v6 dual stack traceroute to ABILENE from WIDE (v4 upper, v6 lower) similar RTTs/hops for v4/v6; native dual-stack paths dual-stack trace to ABILENE from IIJ similar RTTs, but different paths: currently more common dualstack traceroue to ABILINE fro ES v6 RTTs much larger than v4: roundabout tunnels Conclusion: faulty behaviours are only 1% and often combinatorial, but can be fatal to acceptance of v6 slow fallback to v4 on v6 errors knowledge sharing need to realize the dangers of harmful of adoption of v6 cooperation among researchers, implementers, and ops need to act now, or will bring negative impact to v6 deployment Acknowlegements v6fix members, etc. http://v6fix.net/ overview, documents, and fact database. contact at v6fix.net reports of issues are welcome

1 0

dnsauth3.sys.gtei.net DNS record is poisoned???
by Joe Shen 15 Feb '06

15 Feb '06

Hi, Today, some of our customers could not resolve state.gov by our cache server. I found state.gov is served by dnsauth1.sys.gtei.net, dnsauth2.sys.gtei.net, dnsauth3.sys.gtei.net. Using some others' DNS servers I found their IP addresses should be 4.2.49.2, 4.2.49.3, 4.2.49.4. But, our cache server(BIND9.3.1) got some othere IPs( I've tried restart bind9.3.1). So, it always failed to resolve state.gov. After restarting BIND9.3.1 again, I did "rndc flush" for several times, then it comes back. Why? is there something poisoned ? Joe =========== BIND9 got wrong server IP ==== > set debug > dnsauth1.sys.gtei.net Server: dnsv2.zjhzptt.net.cn Address: 202.101.172.133 ;; res_nmkquery(QUERY, dnsauth1.sys.gtei.net, IN, A) ------------ Got answer: HEADER: opcode = QUERY, id = 58203, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 3, additional = 2 QUESTIONS: dnsauth1.sys.gtei.net, type = A, class = IN ANSWERS: -> dnsauth1.sys.gtei.net internet address = 128.121.126.139 ttl = 86084 (86084) AUTHORITY RECORDS: -> gtei.net nameserver = dnsauth2.sys.gtei.net ttl = 172565 (172565) -> gtei.net nameserver = dnsauth3.sys.gtei.net ttl = 172565 (172565) -> gtei.net nameserver = dnsauth1.sys.gtei.net ttl = 172565 (172565) ADDITIONAL RECORDS: -> dnsauth2.sys.gtei.net internet address = 169.132.13.103 ttl = 86084 (86084) -> dnsauth3.sys.gtei.net internet address = 192.67.198.6 ttl = 86084 (86084) ------------ Non-authoritative answer: Name: dnsauth1.sys.gtei.net Address: 128.121.126.139 > ============================== Restart bind and do "rndc flush" 6 times, I got: ====================== > set debug > state.gov Server: hzdnsv2.zjhzptt.net.cn Address: 202.101.172.133 ;; res_nmkquery(QUERY, state.gov, IN, A) ------------ Got answer: HEADER: opcode = QUERY, id = 20953, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 3, additional = 3 QUESTIONS: state.gov, type = A, class = IN ANSWERS: -> state.gov internet address = 164.109.48.80 ttl = 1778 (1778) AUTHORITY RECORDS: -> state.gov nameserver = dnsauth3.sys.gtei.net ttl = 1778 (1778) -> state.gov nameserver = dnsauth1.sys.gtei.net ttl = 1778 (1778) -> state.gov nameserver = dnsauth2.sys.gtei.net ttl = 1778 (1778) ADDITIONAL RECORDS: -> dnsauth1.sys.gtei.net internet address = 4.2.49.2 ttl = 172767 (172767) -> dnsauth2.sys.gtei.net internet address = 4.2.49.3 ttl = 172767 (172767) -> dnsauth3.sys.gtei.net internet address = 4.2.49.4 ttl = 172767 (172767) ------------ Non-authoritative answer: Name: state.gov Address: 164.109.48.80 > ================================== __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

1 0

Interesting paper by Steve Bellovin - Worm propagation in a v6 internet
by Suresh Ramasubramanian 15 Feb '06

15 Feb '06

http://www.cs.columbia.edu/~smb/papers/v6worms.pdf - courtesy Schneier on Security and then the ITU newslog. > Internet Worms and IPv6 > > Bruce Schneier's Schneier on Security points to a paper dismissing the > myth that worms won't be able to propagate under IPv6.

5 8

FYI: reg-ops now becoming fully operational
by Rick Wesson 15 Feb '06

15 Feb '06

Through 2005, the reg-ops (Registrar Operations) mailing list which was established after the first Panix incident, was working by trial and error, learning from past mistakes, formalizing reporting guidelines and operating procedures. The mailing list now holds representatives from most of the big registrars. reg-ops also holds liaisons to NSP-SEC, DA/MWP, ICANN, SSAC, NANOG and the root servers. Other than the registrars, there are also a limited number of vetted individual from the anti-spam, anti-phishing and security industry. The purpose of the list is to relay reliable information in real-time from the industry to registrars on issues such as scams, phishing, etc. Real-time issues are handled with care while other reports can be made digested, periodically. The list is mostly operational and therefore there is not much chatter. However, security and operational issues which concern registrars or cooperation/information sharing happens when it is needed. The list is not open to the public, and subscription requires vetting. Please contact me or Gadi Evron <ge(a)linuxbox.org> directly to be added to the group. Thanks, -rick

1 0

NANOG36-NOTES 2006.02.14 talk 2 Netflow Visualization Tools
by Matthew Petach 15 Feb '06

15 Feb '06

2006.02.14 talk 2 Netflow tools Bill Yurcik byurcik at ncsa.uiuc.edu NVisionIP and VisFlowConnect-IP probably a dozen tools out there, this is just two of them. Concenses is there's something to this. They're an edge network, comes into ISP domain, their tools are used by entities with many subnet blocks. Overview Project Motifivation Netflows for Security Two visualization tools NVisionIP VisFlowConnect-IP Summary Internet Security: N-Dimensional Work Space large--already lots of data to process complex--combinatorics explode quickly time dynamics--things can change quickly! Visualizations can help! in near-realtime overview-browse-details on demand People are wired to do near-realtime processing of visual information, so that's a good way to present information for humans. HCI says use overview-browse-details paradigm. Netflows for security can identify connection-oriented stats to see things like attacks, DoS, DDoS, etc. Most people don't use the data portion of the flow field, the first 64 bytes, they just look at header info or aggregated flow records. Can spot how many users are on your system at a given time, to schedule upgrades. Who are your top talkers? How long do my users surf? What are people using the network for? Where do users go? Where did they come from? Are users following the security policy? What are the top N destination ports? Is there traffic to vulnerable hosts? Can you identify and block scanners/bad guys? This doesn't replace other systems like syslog, etc.; it integrates and works alongside them. architecture slide for NCSA. Can't really do sampled view for security, so probably need distributed flow collector farm to get all the raw data safely. Two visualization tools: NVisionIP, VisFlowConnect-IP focus on quick overview of tools security.ncsa.uiuc.edu/ 3 level hierarchical tool; galaxy view (small multiple view) ((machine view)) Galaxy is overview of the whole network. color and shape of dots is each host in a network. settable parameters for each dot. Animated toolbar and clock show changes over time in the galaxy. Lets you get high-level content quickly and easily. Domain view lets you drill in a bit more; small multiple view looks at the traffic within the block. upper histogram is lower, well known ports; lower histogram is ports over 1024 You can click on a given multiple view entry to delve into one machine. Many graphs for each machine in the most detailed view. well known ports first, then rest of ports (sorted) then source and destination traffic broken out. Designed for class Bs. http://security.ncsa.uiuc.edu/distribution/VisFlowConnectDownload.html 3 vertical lines, comes from edge network perspective; middle line is edge network to manage. You set range of networks you care about. Outside lines are people sourcing or sinking traffic to you, from outside domains. There's a time axis, traffic only shown for the slice of time currently under consideration. Uses VCR-like controls to move time forward/backward Lets you see traffic/interactivity, drill into that domain, see host level connectivity flows. Shows MS Blaster virus traffic as an example. Example 2, a scan example. Just because it looks like one IP hitting many others doesn't mean it's really a security incident, though; could be a cluster getting traffic. web crawlers hitting NCSA web servers make for a very charateristic pattern over time. Summary Netflows analysis is non-trivial, NVisionIP VisFlowConnect-IP lots of references listed in very fine blue font. http://security.ncsa.uiuc.edu/distribution/NVisionIPDownload Avi Freedman, Akamai, Argus was mentioned a lot; it lets you grab symmetric netflows, but also does TCP analysis, shows some performance data as well. not sure if people are studying the impact of correlating argus data with flow data. Roland Douta? of Cisco; many people are using netflow to track security issues. They now have ingress and egress flow data on many of their platforms. In reading paper describing it, there's data conversion that needs to happen into an internal format that nVision can understand. It reads log files at the moment, takes about 5 minutes to process files. Lets them take different file data sources, make the tool for visualization independent of the input format. They can read large files, but there is a performance hit when doing it. Are they planning on doing further work on the tool to collect TCP flags, for frags, drop traffic, etc? They've looked at it, but they leave it to IDS tools for flag activity. Might be of interest to consider for future versions of the tools. Last question came up, echoed about argus. Question about interactivity, they are working on feedback through tools. Question about alarming on patterns; but once you start alarming or putting up visual indicators, it distracts from rest of the overall pattern, you tend to miss other information.

3 2

NANOG36 Wednesday schedule, lightning talks
by Steve Feldman 15 Feb '06

15 Feb '06

Here is the revised NANOG36 agenda for Wednesday, Feb. 15: 9:00-9:30 v6fix: Wiping the Slate Clean for IPv6 Kenjiro Cho, WIDE/IIJ, Ruri Hiromi, WIDE/Intec NetCore 9:30-10:00 Hurricane Katrina: Telecom Infrastructure Impacts, Solutions, and Opportunities Paula Rhea, Verizon 10:00-10:30 Katrina Recover Panel moderator: Sean Donelan, Cisco 10:30-11:00 BREAK 11:00-11:20 An Inter-domain Consistency Management Layer Nate Kushman, MIT 11:20-12:20 Lightning Talks: Infrastructure (DNS and Routing) Security - Status and Update by Sandra Murphy Need for Speed: What's next after 10GE? by Mike Hughes A Brief Look at Some DNS Query Data by John Kristoff The impact of fiber access to ISP backbones in .jp by Kenjiro Cho New Network Monitoring Interest Group by Mike Caudill Understanding the Network-Level Behavior of Spammers by Nick Feamster (presented by Randy Bush) 12:20-12:30 Closing Remarks Steve Feldman, CNET, Susan Harris, Merit

1 0

Fed Bill Would Restrict Web Server Logs
by Jon R. Kibler 15 Feb '06

15 Feb '06

> Message: 3 > Date: Thu, 09 Feb 2006 00:14:23 -0800 > From: Declan McCullagh <declan(a)well.com> > Subject: [Politech] Delete web server logs, or get fined by the Feds? > Ed Markey's new bill [fs] > To: politech(a)politechbot.com > Message-ID: <43EAF9DF.2000602(a)well.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > I've posted the text here: > http://www.politechbot.com/docs/markey.data.deletion.bill.020806.pdf > > A summary is here: > http://news.com.com/2100-1028_3-6036951.html > "A bill just announced in Congress would require every Web site operator > to delete information about visitors, including e-mail addresses, if the > data is no longer required for a "legitimate" business purpose. > > An open question is whether Rep. Ed Markey's bill would require that > Internet addresses be deleted by default from Apache and other web > server logs. One reading is that it would be. But it's not clear whether > an IP address falls under the definition of personal information. > > This bill applies to anyone running a web site, including individuals > and bloggers. So it's not just companies that have to worry. > Original posting from Declan McCullagh's PoliTech mailing list. Thought NANOGers would be interested since, if this bill passes, it would impact almost all of us. Just imagine the impact on security of not being able to login IP address and referring page of all web server connections! Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

14 14

Re: protocols that don't meet the need...
by Andrew Dul 14 Feb '06

14 Feb '06

> -------Original Message------- > From: Valdis.Kletnieks(a)vt.edu > Subject: Re: protocols that don't meet the need... > Sent: 14 Feb '06 13:10 > > On Tue, 14 Feb 2006 12:35:19 PST, Tony Hain said: > > Rather than sit back and complain about the results, why not try to > > synchronize meeting times. Not necessarily hotels, but within a reasonable > > distance of each other so the issue about ROI for the trip can be mitigated. Not a substitute for attendance and face-to-face meetings, but ISOC has started publishing the IETF journal. It is a pretty long read, but I've found it useful to catchup on working groups. http://ietfjournal.isoc.org/

1 0

NANOG36-NOTES 2006.02.14 talk 7 Randy IRR routing security revisited
by Matthew Petach 14 Feb '06

14 Feb '06

Many apologies...I'm no Stan Barber, but still doing my best to keep up with the note-taking. ^_^;; Matt Slides are on Randy's site at http://rip.psg.com/~randy/060214.nanog-pki.pdf What I want for Eid ul-Fitr Randy Bush randy at psg.com Definition of Eid ul-Fitr; end of Ramadan; breaking of the fasting period, and of all evil habits. Roughly October 24th this year. 10 years ago Randy plead for people to use IRR; he gives, it didn't work, it has bad data, it doesn't work. Let's get rid of it. Routing security is what we need. Routing security gap assume router has been captured. routing security (not router) is a major problem. http://rip.psg.com/~randy/060119.janog-routesec.pdf need PKI, storing and passing and signing certificates. Public Key Infrastructure PKI Database RIR Certs ISP Certs End Site Certs IP Addresss Attestations ASN Attestations IP and AS Attestations specifies identity == pyblic ckey of recipient signed by allocator's private key Follows allocation hierarchy IANA (or whomever) to RIR RIR to ISP ISP to downstream ISP or end user enterprise IP allocation example IANA to RIR S.iana (192/8, rir) RIR allocatees to ISP S.rir(192.168/16) and so on down the chain. Each chain uses the private key to sign the certs to hand down the chain. ISP/End-site-certs May be acquired anywhere. Don't have to be chained to a single master organization, and can use the same one for multiple RIRs, orgs, etc. RIRs can issue as a service for members who don't get them anywhere. They need no attestation because they are only used in business transactions where they are exchanged and managed by contract, or Bound to IP or ASN attestations by the RIRs or upstream ISPs. Big ISPs may use an ARIN identity for an APNIC allocation or business transaction. Since the keys are acquired separately, doesn't matter where the certs come from, or where used. RIR Identity similar. it's their public key can get it from 'above', RIR< NRO, IANA, or they can even self cert. No provision for revocation, however. PKI Interfaces/Users Nice slide showing the interrrelationships; go see the slides for it, I won't try to render it in ASCII in realtime. The certificates are directly exchanged as part of the business transaction when goods (IPs, ASNs, etc) are exchanged. Goal is to have formally verifiable route attestations, so want replicas of data near routers to be used to determine validity of route origination and propagation. Transacting with PKI RFC2585 descripts FTP and HTTP transport for PKI no need for transport security! Tools for RIRs Generate and receive ISP certs Receive ASN and IP space attestations from upstairs Tools for ISPs generate/get certs register role certs generate certs for downstreams sign allocations to downstreams Open Issues Coordination of updates one central repository not feasible LDAPv3 RFC3377 and RFC2829 for authentication Cert/key rollover and revocatoin not covered May require a separate and secured communication channel NSF via awared ANI-0221435 Steve Bellovin & JI >From microphone, are there TTLs on certs? Yes, which is why ISP certs are separated out. Addresses from ARIN are only "yours" as long as you keep paying ARIN. Tie certs to contract terms. But the ISP identity cert is yours, nobody else should have control over rollover and expiration. APNIC is working to have web pges Andrew Dole, Boeing; how to get funded--Randy will take cash donations. Andrew thinks it'll take 10 million to get the ball rolling. Randy doesn't think that's the problem. The operator community would prefer to see a rigorously correct and verifiable solution with reasonable security infrastructure rather than one more hack on the IRR. Second question. What is forum to discuss and nail down the details? He'll be at APNIC in 2 weeks; for this region the ARIN meeting in Montreal, and this meeting is good too. Nobody seems to be sure where the right place to do this is. But Randy thinks the important part is to SEND the message, that there is a valid path. Vince Fuller. Soliciting input from this group is a good thing, but be more targetted. Figure out why the previous efforts failed, and target them. Chris Morrow, Ted Seely...Randy targets some specific people in the audience. Chris Morrow notes that one challenge he faces is being able to verify if filters are correct. Randy notes the ROUTER will verify the validity itself. Chris feels doing it in OSS system is safer. RS--how do you deal with crufty stuff? RIRs and community will have to deal with that, he's just talking about giving tools to make it possible. Sandy Murphy, Sparta--Randy, you've said there's no prefix lists needed for this; but this could be used for building filter lists, or checking updates, or for tracking customers who call in with issues, etc. this is a first step for a whole BUNCH of things. So no matter what else we want to build on top of it, this really is the first level of the foundation that needs to be built. Beer and Gear at 5:30 directly beneath us today. Surveys will be online this afternoon--fill it out today or tomorrow!! Especially give feedback on M-W vs Sun-Tue format; next one will be M-W, then S-Tu for ARIN, after that there will be flexibility. Head for lunch, back by 2.

1 0