Internet2 Network Security SIG

["Garrett, Seth B" <>]

I think the general idea is to try to be as specific as possible with ROAs 
regarding prefixes.  Under normal circumstances 129.79.0.0/16 is one of the 
prefix we advertise.  When utilizing a DDoS scrubbing service we could 
initiate scrubbing on a /24 from within that.   Creating the ROA with 
129.79.0.0/16 maxlength option of 24 is an option.  The option also makes 
anything between 16 and 24 valid as well.  The ROA would need to be specific 
for 129.79.0.0/16 and every single potential /24 to get around this.  That 
way only the /16 or a list of expected /24s would be valid in RPKI from AS87. 
 If someone accidentally or intentionally tried to advertise 129.79.0.0/17 
from a different ASN it would be invalid in RPKI with or without the 
maxlength set.  However, by not using the maxlength option on the /16 it 
would be invalid even if they tried a forged-origin hijack on the /17.  

The origin ASN could change from your ASN in a legitimate DDoS scrubbing 
even.  That just depends on the service & scenario.  That would need a ROA 
allowing that ASN as well if that scenario could exist.  

https://tools.ietf.org/html/draft-yossigi-rpkimaxlen-02 goes into more detail 
on some of the security concerns around maxlength.

Seth Garrett
Principal Network Engineer
Indiana University

________________________________________
From: 

 
<>
 on behalf of Dale W. Carder 
<>
Sent: Tuesday, August 14, 2018 4:00 PM
To: 

Subject: Re: [Security-WG] Re: Internet2, MANRS and embedded security

Thus spake Garrett, Seth B 
()
 on Tue, Aug 14, 2018 at 04:08:16PM +0000:
>   *   You need to account for your DDoS scrubbing service when planning for 
> RPKI.
>      *   ?Its strongly encouraged to not use the maxlength option for a 
> prefix.  However, you need to account for smaller prefixes and/or different 
> ASNs the routes could be coming from when using a scrubbing service.  This 
> can lead to rather large ROAs.  Andrew Gallo I know has been doing some 
> testing in this area.

Can you share what your thoughts are along these lines?

Dale