Re: Securing BGP sessions (Issue#41)
Mahesh Jethanandani <[email protected]> Tue, 10 Dec 2019 17:21:40 -0800
| Newsgroups | gmane.ietf.idr |
|---|---|
| Message-ID | <[email protected]> |
--===============2898792926417053462== Content-Type: multipart/alternative; boundary="Apple-Mail=_45C9BD35-C72A-4E61-9BA9-ACB9B5799C65" --Apple-Mail=_45C9BD35-C72A-4E61-9BA9-ACB9B5799C65 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Dec 10, 2019, at 4:51 PM, Jared Mauch <[email protected]> = wrote: >=20 >=20 >=20 >> On Dec 10, 2019, at 7:34 PM, Mahesh Jethanandani = <[email protected]> wrote: >>=20 >> This is the second thread in the list of issues that were discussed = in IETF 106 w.r.t. to BGP YANG model. This particular thread is to = discuss the issue of defining how BGP sessions are going to be secured. >>=20 >> As stated in Singapore, the model is being defined to secure BGP = sessions using=20 >> - TCP AO >> - TCP MD5 >> - IPSec >>=20 >> In case there was a question of why MD5, it is because there are = existing implementations that are choosing to stay with MD5, regardless = of the issues that have been raised about MD5. The model therefore has = to support such implementations. >>=20 >> The model will use the ietf-key-chain model=E2=80=99s (RFC 8177) = key-chain-ref to refer to an instance of the key chain. By doing that it = will make use of the key rollover capability defined in that model, and = for static key configuration by setting the end time to infinite in the = key chain. The BGP model will leave the case of IPSec as TBD for now, = and fill it when/if the IPSec YANG model is defined. >>=20 >> Questions/Concerns? >=20 > Some comments here: >=20 > I think of the above options the only two that are available are = TCP-MD5 and IPSEC. IPSEC doesn=E2=80=99t have use in the (public) = internet space, but this doesn=E2=80=99t mean people don=E2=80=99t use = it internally or elsewhere.. I just haven=E2=80=99t found any of these = people in real life. >=20 > TCP-AO seems like it=E2=80=99s viable but as I mentioned in one of the = security area meetings at IETF-101, the current operational requirements = are generally stability for 180-1800 days of a BGP session (or longer). = People hate it when their BGP sessions go down and their routes go away = as a result so there=E2=80=99s a lot of steps necessary to upgrade both = sides once they support something like TCP-AO. >=20 > Also operators have a hard enough time keeping the static keys = configured as they often outlast the lifetime of the engineer at the = company and most key rotation systems (eg: IPSec on routers don=E2=80=99t = often expose them in a way that survive device migrations, and key = management/export are poor or non-existent, so people only use them = internally vs externally facing =E2=80=A6) don=E2=80=99t work well or = require time sync in a way that if the fail will drop the TCP session = and BGP goes down as well. >=20 > The other thing is most people just want transport integrity, not = privacy. Not securing the BGP session is certainly an option. Cheers. >=20 > - Jared Mahesh Jethanandani [email protected] --Apple-Mail=_45C9BD35-C72A-4E61-9BA9-ACB9B5799C65 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><br = class=3D""><div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Dec 10, 2019, at 4:51 PM, Jared Mauch <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" = class=3D""><blockquote type=3D"cite" style=3D"font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; orphans: auto; text-align: = start; text-indent: 0px; text-transform: none; white-space: normal; = widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D"">On = Dec 10, 2019, at 7:34 PM, Mahesh Jethanandani <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:<br class=3D""><br = class=3D"">This is the second thread in the list of issues that were = discussed in IETF 106 w.r.t. to BGP YANG model. This particular thread = is to discuss the issue of defining how BGP sessions are going to be = secured.<br class=3D""><br class=3D"">As stated in Singapore, the model = is being defined to secure BGP sessions using<span = class=3D"Apple-converted-space"> </span><br class=3D"">- TCP AO<br = class=3D"">- TCP MD5<br class=3D"">- IPSec<br class=3D""><br class=3D"">In= case there was a question of why MD5, it is because there are existing = implementations that are choosing to stay with MD5, regardless of the = issues that have been raised about MD5. The model therefore has to = support such implementations.<br class=3D""><br class=3D"">The model = will use the ietf-key-chain model=E2=80=99s (RFC 8177) key-chain-ref to = refer to an instance of the key chain. By doing that it will make use of = the key rollover capability defined in that model, and for static key = configuration by setting the end time to infinite in the key chain. The = BGP model will leave the case of IPSec as TBD for now, and fill it = when/if the IPSec YANG model is defined.<br class=3D""><br = class=3D"">Questions/Concerns?<br class=3D""></blockquote><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">Some comments here:</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">I think of the above options the = only two that are available are TCP-MD5 and IPSEC. IPSEC doesn=E2=80= =99t have use in the (public) internet space, but this doesn=E2=80=99t = mean people don=E2=80=99t use it internally or elsewhere.. I just = haven=E2=80=99t found any of these people in real life.</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">TCP-AO seems like it=E2=80=99s = viable but as I mentioned in one of the security area meetings at = IETF-101, the current operational requirements are generally stability = for 180-1800 days of a BGP session (or longer). People hate it = when their BGP sessions go down and their routes go away as a result so = there=E2=80=99s a lot of steps necessary to upgrade both sides once they = support something like TCP-AO.</span><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">Also operators have a hard enough time keeping the static = keys configured as they often outlast the lifetime of the engineer at = the company and most key rotation systems (eg: IPSec on routers don=E2=80=99= t often expose them in a way that survive device migrations, and key = management/export are poor or non-existent, so people only use them = internally vs externally facing =E2=80=A6) don=E2=80=99t work well or = require time sync in a way that if the fail will drop the TCP session = and BGP goes down as well.</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">The other thing is most people just want transport integrity, = not privacy.</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""></div></blockquote><div><br class=3D""></div>Not = securing the BGP session is certainly an option.</div><div><br = class=3D""></div><div>Cheers.</div><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D""><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">- Jared</span></div></blockquote></div><br class=3D""><div = class=3D""> <div class=3D"">Mahesh Jethanandani</div><div class=3D""><a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a></div><div class=3D""><br = class=3D""></div><br class=3D"Apple-interchange-newline"> </div> <br class=3D""></body></html>= --Apple-Mail=_45C9BD35-C72A-4E61-9BA9-ACB9B5799C65-- --===============2898792926417053462== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Idr mailing list [email protected] https://www.ietf.org/mailman/listinfo/idr --===============2898792926417053462==--