Hi, I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP? Again sorry for the n00b question, I am trying to make sense of how it works. TIA. Dovid
Hi, In fact, RPKI does nothing about AS Path checks if it's your question. RPKI is based on ROA where signatures are published to guarantee you're the owner of a specific prefix with optionnal different maxLength from your ASN. So if the question is about if RPKI is sufficient to secure the whole BGP path, well, it's not. RPKI guarantee / permit only to verify the ressource announcements (IPvX block) is really owned by your ASN. But even if it's not sufficient, we need to deploy it to start securing resources', not the whole path. Don't know if it replies to your question, but you can read also the pretty good documentation on RPKI here : https://rpki.readthedocs.io/en/latest/rpki/introduction.html or the corresponding RFC ;) Le 20-08-2020 15:20, Dovid Bender a écrit :
Hi,
I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP?
Again sorry for the n00b question, I am trying to make sense of how it works.
TIA.
Dovid
-- Fabien VINCENT _@beufanet_
Fabien, Thanks. So to sum it up there is nothing stopping a bad actor from impersonating me as if I am BGP'ing with them. It's to stop any other AS other then mine from advertising my IP space. Is that correct? How is verification done? They connect to the RIR and verify that there is a cert signed by the RIR for my range? On Thu, Aug 20, 2020 at 9:51 AM Fabien VINCENT (NaNOG) via NANOG < nanog@nanog.org> wrote:
Hi,
In fact, RPKI does nothing about AS Path checks if it's your question. RPKI is based on ROA where signatures are published to guarantee you're the owner of a specific prefix with optionnal different maxLength from your ASN.
So if the question is about if RPKI is sufficient to secure the whole BGP path, well, it's not. RPKI guarantee / permit only to verify the ressource announcements (IPvX block) is really owned by your ASN. But even if it's not sufficient, we need to deploy it to start securing resources', not the whole path.
Don't know if it replies to your question, but you can read also the pretty good documentation on RPKI here : https://rpki.readthedocs.io/en/latest/rpki/introduction.html or the corresponding RFC ;)
Le 20-08-2020 15:20, Dovid Bender a écrit :
Hi,
I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP?
Again sorry for the n00b question, I am trying to make sense of how it works.
TIA.
Dovid
-- *Fabien VINCENT* *@beufanet*
Here's some more literature: https://blog.cloudflare.com/rpki-and-the-rtr-protocol/ Eric On Aug 20 2020, at 10:00 am, Dovid Bender <dovid@telecurve.com> wrote:
Fabien,
Thanks. So to sum it up there is nothing stopping a bad actor from impersonating me as if I am BGP'ing with them. It's to stop any other AS other then mine from advertising my IP space. Is that correct? How is verification done? They connect to the RIR and verify that there is a cert signed by the RIR for my range?
On Thu, Aug 20, 2020 at 9:51 AM Fabien VINCENT (NaNOG) via NANOG <nanog@nanog.org (mailto:nanog@nanog.org)> wrote:
Hi,
In fact, RPKI does nothing about AS Path checks if it's your question. RPKI is based on ROA where signatures are published to guarantee you're the owner of a specific prefix with optionnal different maxLength from your ASN. So if the question is about if RPKI is sufficient to secure the whole BGP path, well, it's not. RPKI guarantee / permit only to verify the ressource announcements (IPvX block) is really owned by your ASN. But even if it's not sufficient, we need to deploy it to start securing resources', not the whole path. Don't know if it replies to your question, but you can read also the pretty good documentation on RPKI here : https://rpki.readthedocs.io/en/latest/rpki/introduction.html or the corresponding RFC ;) Le 20-08-2020 15:20, Dovid Bender a écrit :
Hi,
I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP?
Again sorry for the n00b question, I am trying to make sense of how it works.
TIA.
Dovid
-- Fabien VINCENT @beufanet
If the other AS announce the same resource, AS Path Length should be perhaps longer will prefix length is the same. RPKI is just here to secure resource announcement verification (ROV). Nothing more in my own opinion. You could read this RFC for RPKI OPs : https://tools.ietf.org/html/rfc7115.html Verification is done using tools like Routinator or GoRTR, that fetch Trusted Anchors Lists provided by RIR, compute them and provide RTR protocol support for your routers to verify against ROA the BGP table (what we called ROV). Everything is in the excellent RPKI documentation, so you should absolutely read it or look any presentation done on RIRs' meeting, probably available on YouTube ;) Le 20-08-2020 16:00, Dovid Bender a écrit :
Fabien,
Thanks. So to sum it up there is nothing stopping a bad actor from impersonating me as if I am BGP'ing with them. It's to stop any other AS other then mine from advertising my IP space. Is that correct? How is verification done? They connect to the RIR and verify that there is a cert signed by the RIR for my range?
On Thu, Aug 20, 2020 at 9:51 AM Fabien VINCENT (NaNOG) via NANOG <nanog@nanog.org> wrote:
Hi,
In fact, RPKI does nothing about AS Path checks if it's your question. RPKI is based on ROA where signatures are published to guarantee you're the owner of a specific prefix with optionnal different maxLength from your ASN.
So if the question is about if RPKI is sufficient to secure the whole BGP path, well, it's not. RPKI guarantee / permit only to verify the ressource announcements (IPvX block) is really owned by your ASN. But even if it's not sufficient, we need to deploy it to start securing resources', not the whole path.
Don't know if it replies to your question, but you can read also the pretty good documentation on RPKI here : https://rpki.readthedocs.io/en/latest/rpki/introduction.html or the corresponding RFC ;)
Le 20-08-2020 15:20, Dovid Bender a écrit :
Hi,
I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP?
Again sorry for the n00b question, I am trying to make sense of how it works.
TIA.
Dovid
-- Fabien VINCENT _@beufanet_
-- Fabien VINCENT _@beufanet_
ROA = Route Origin Authorization . Origin is the key word. When you create an signed ROA and do all the publishing bits, RPKI validator software will retrieve that , validate the signature, and pass that up to routers, saying "This prefix range that originates from this ASN is valid." Then, any BGP advertisement that contains a prefix in that range, with an origin ASN that matches, is treated as valid. The intermediary as-path isn't a factor. If another ASN ORIGINATES an announcement for your space, then RPKI routers will treat that announcement as INVALID, because that isn't authorized. If another ASN spoofs your ASN , pretending that they are your upstream, RPKI won't solve that. But that is a different problem set. On Thu, Aug 20, 2020 at 10:02 AM Dovid Bender <dovid@telecurve.com> wrote:
Fabien,
Thanks. So to sum it up there is nothing stopping a bad actor from impersonating me as if I am BGP'ing with them. It's to stop any other AS other then mine from advertising my IP space. Is that correct? How is verification done? They connect to the RIR and verify that there is a cert signed by the RIR for my range?
On Thu, Aug 20, 2020 at 9:51 AM Fabien VINCENT (NaNOG) via NANOG < nanog@nanog.org> wrote:
Hi,
In fact, RPKI does nothing about AS Path checks if it's your question. RPKI is based on ROA where signatures are published to guarantee you're the owner of a specific prefix with optionnal different maxLength from your ASN.
So if the question is about if RPKI is sufficient to secure the whole BGP path, well, it's not. RPKI guarantee / permit only to verify the ressource announcements (IPvX block) is really owned by your ASN. But even if it's not sufficient, we need to deploy it to start securing resources', not the whole path.
Don't know if it replies to your question, but you can read also the pretty good documentation on RPKI here : https://rpki.readthedocs.io/en/latest/rpki/introduction.html or the corresponding RFC ;)
Le 20-08-2020 15:20, Dovid Bender a écrit :
Hi,
I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP?
Again sorry for the n00b question, I am trying to make sense of how it works.
TIA.
Dovid
-- *Fabien VINCENT* *@beufanet*
Ok. So here is another n00b question. Why don't we have something where when we advertise IP space we also pass along a cert that can independently be verified by going back to the RIR to see if that cert was signed by them. This would also stop someone spoofing my ASN. On Thu, Aug 20, 2020 at 10:53 AM Tom Beecher <beecher@beecher.cc> wrote:
ROA = Route Origin Authorization . Origin is the key word.
When you create an signed ROA and do all the publishing bits, RPKI validator software will retrieve that , validate the signature, and pass that up to routers, saying "This prefix range that originates from this ASN is valid." Then, any BGP advertisement that contains a prefix in that range, with an origin ASN that matches, is treated as valid. The intermediary as-path isn't a factor.
If another ASN ORIGINATES an announcement for your space, then RPKI routers will treat that announcement as INVALID, because that isn't authorized.
If another ASN spoofs your ASN , pretending that they are your upstream, RPKI won't solve that. But that is a different problem set.
On Thu, Aug 20, 2020 at 10:02 AM Dovid Bender <dovid@telecurve.com> wrote:
Fabien,
Thanks. So to sum it up there is nothing stopping a bad actor from impersonating me as if I am BGP'ing with them. It's to stop any other AS other then mine from advertising my IP space. Is that correct? How is verification done? They connect to the RIR and verify that there is a cert signed by the RIR for my range?
On Thu, Aug 20, 2020 at 9:51 AM Fabien VINCENT (NaNOG) via NANOG < nanog@nanog.org> wrote:
Hi,
In fact, RPKI does nothing about AS Path checks if it's your question. RPKI is based on ROA where signatures are published to guarantee you're the owner of a specific prefix with optionnal different maxLength from your ASN.
So if the question is about if RPKI is sufficient to secure the whole BGP path, well, it's not. RPKI guarantee / permit only to verify the ressource announcements (IPvX block) is really owned by your ASN. But even if it's not sufficient, we need to deploy it to start securing resources', not the whole path.
Don't know if it replies to your question, but you can read also the pretty good documentation on RPKI here : https://rpki.readthedocs.io/en/latest/rpki/introduction.html or the corresponding RFC ;)
Le 20-08-2020 15:20, Dovid Bender a écrit :
Hi,
I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP?
Again sorry for the n00b question, I am trying to make sense of how it works.
TIA.
Dovid
-- *Fabien VINCENT* *@beufanet*
[sorry if you're getting this twice, I accidentally sent from the wrong address and it was rejected from the list] Hi Dovid, BGPSEC (as specified in RFC8205 <https://tools.ietf.org/html/rfc8205>) is the next level of routing security which provides the kind of in-band guarantees that you describe. In my view, RPKI with its ROAs is a stepping stone to get to an end state where BGPSEC can be deployed and routes validated end-to-end in the BGP control plane itself. Specifically, RPKI gets the roots of trust out there, and in use, and these can then be used in the future to bootstrap the BGPSEC ecosystem (RFC 8209 <https://tools.ietf.org/html/rfc8209> proposes a certificate profile for BGPSEC based on the RPKI)
From what I have seen, there are some roadblocks to widespread adoption of BGPSEC, notably:
- I'm not aware of any ready to use out of the box implementations of RFC8205 on off the shelf routers from major vendors, - There is a patch to BIRD <http://www.securerouting.net/tools/bird/>(site appears down ATM, but referenced from: https://bird.network.cz/pipermail/bird-users/2015-August/009877.html) and a variant of Quagga <https://www.nist.gov/services-resources/software/bgp-secure-routing-extension-bgp-srx-prototype> which supports BGPSEC, though. - There will be increased memory and CPU requirements for routers performing these validations in the control plane I think the offloading approach we've seen with RPKI validators running on another host would be an interesting one to consider as it could relieve the need for routers themselves to be upgraded with more performant hardware to perform the required signature verifications etc. I found this presentation <https://www.de-cix.net/Files/11a60fcb156e443c98010211f498f5ae4439dab0/Matthias-Waehlisch---BGPSec---AS-path-validation.pdf> to be very informative about BGPSEC's guarantees and failure modes, it's a few years old but still provides a nice overview. Hope that helps, Rayhaan Disclaimer: any and all views expressed here are those of myself in a personal capacity, and not necessarily those of my employer. On Sun, Aug 23, 2020 at 2:43 PM Dovid Bender <dovid@telecurve.com> wrote:
Ok. So here is another n00b question. Why don't we have something where when we advertise IP space we also pass along a cert that can independently be verified by going back to the RIR to see if that cert was signed by them. This would also stop someone spoofing my ASN.
On Thu, Aug 20, 2020 at 10:53 AM Tom Beecher <beecher@beecher.cc> wrote:
ROA = Route Origin Authorization . Origin is the key word.
When you create an signed ROA and do all the publishing bits, RPKI validator software will retrieve that , validate the signature, and pass that up to routers, saying "This prefix range that originates from this ASN is valid." Then, any BGP advertisement that contains a prefix in that range, with an origin ASN that matches, is treated as valid. The intermediary as-path isn't a factor.
If another ASN ORIGINATES an announcement for your space, then RPKI routers will treat that announcement as INVALID, because that isn't authorized.
If another ASN spoofs your ASN , pretending that they are your upstream, RPKI won't solve that. But that is a different problem set.
On Thu, Aug 20, 2020 at 10:02 AM Dovid Bender <dovid@telecurve.com> wrote:
Fabien,
Thanks. So to sum it up there is nothing stopping a bad actor from impersonating me as if I am BGP'ing with them. It's to stop any other AS other then mine from advertising my IP space. Is that correct? How is verification done? They connect to the RIR and verify that there is a cert signed by the RIR for my range?
On Thu, Aug 20, 2020 at 9:51 AM Fabien VINCENT (NaNOG) via NANOG < nanog@nanog.org> wrote:
Hi,
In fact, RPKI does nothing about AS Path checks if it's your question. RPKI is based on ROA where signatures are published to guarantee you're the owner of a specific prefix with optionnal different maxLength from your ASN.
So if the question is about if RPKI is sufficient to secure the whole BGP path, well, it's not. RPKI guarantee / permit only to verify the ressource announcements (IPvX block) is really owned by your ASN. But even if it's not sufficient, we need to deploy it to start securing resources', not the whole path.
Don't know if it replies to your question, but you can read also the pretty good documentation on RPKI here : https://rpki.readthedocs.io/en/latest/rpki/introduction.html or the corresponding RFC ;)
Le 20-08-2020 15:20, Dovid Bender a écrit :
Hi,
I am sorry for the n00b question. Can someone help point me in the right direction to understand how RPKI works? I understand that from my side that I create a key, submit the public portion to ARIN and then send a signed request to ARIN asking them to publish it. How do ISP's that receive my advertisement (either directly from me, meaning my upstreams or my upstreams upstream) verify against the cert that the advertisement is coming from me? If say we have Medium ISP (AS1000) -> Large ISP (AS200) in the above case AS200 know it's peering with AS1000 so it will take all advertisements. What's stopping AS1000 from adding a router to their network to impersonate me, make it look like I am peering with them and then they re-advertise the path to Large ISP?
Again sorry for the n00b question, I am trying to make sense of how it works.
TIA.
Dovid
-- *Fabien VINCENT* *@beufanet*
participants (5)
-
Dovid Bender -
Eric Dugas -
Fabien VINCENT (NaNOG) -
Rayhaan Jaufeerally (NANOG) -
Tom Beecher