Internet2 Network Security SIG

[gcbrowni <>]

These are all great comments! I’ll integrate them in to the text.

I appreciate the feedback

-G

On Mar 30, 2017, at 3:47 PM, David Farmer <> wrote:

On Thu, Mar 30, 2017 at 1:43 PM, Michael H Lambert <> wrote:

> On 30 Mar 2017, at 12:14, gcbrowni <> wrote:
>
> Many people within the community use MD5 authentication and have had little to no trouble, with others reporting concerns. Sites will need to weigh the pros and cons carefully before making a decision.

I think this sums things up very succinctly.  Credential management aside, there is the question of no authentication vs MD5 vs TCP-AO and what is supported by a site's (and a site's peers') BGP speakers (be they vendor iron or open source).  In many cases this decision will be driven by the lowest common denominator of features or by economics rather than by technical considerations or risk mitigation.

Michael

BGP TTL Security (RFC 7454, section 5.2) and GTSM (RFC5082) should at least be mentioned as another possible way to protect BGP sessions especially if authentication is not used.   

--

===============================================
David Farmer              
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota  
2218 University Ave SE        Phone: 612-626-0815
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================

Attachment: smime.p7s
Description: S/MIME cryptographic signature