Internet2 Network Security SIG

[Andrew Gallo <>]

Are you asking why Max Length is no longer recommended?

Here's a draft BCP that describes in detail what the problem is:
https://tools.ietf.org/id/draft-yossigi-rpkimaxlen-00.html

The short description- only cover what you know you'll advertise.  If you 
create a ROA covering 172.16.0.0/16-24, then every prefix is covered between 
16-24, including /17, 18, etc.
An attacker could, spoofing your ASN, announce a /17 and still pass RPKI 
validation.  Assuming you're already advertising a /16, then you couldn't 
advertise a more specific, only an equal /17.

Now, with the case of DDoS mitigation, if you could potentially redirect any 
/24, then you would need to have ROAs covering all those prefixes.  I wrote a 
script that allows you to easily generate a ROA for all the prefixes in a 
summary route.

You would still be open to the vulnerability discussed in the draft, namely, 
someone spoofing your AS and advertising a covered prefix.  You're still in a 
better position because an attacker couldn't use intermediate masks.
If you knew only a certain number of prefixes would could be redirected to a 
scrubbing service, then the recommendation is to only include those the ROA

This raises an interesting possibility.  Maybe you generate a ROA allowing 
your AS to originate the summary route, while the DDoS service can originate 
the subnets.  The risk here is that if you ever had to originate a more 
specific from your own space, it wouldn't be covered.

Honestly, I think we're still in the "figuring out operational best 
practices" phase.




On 8/14/2018 4:00 PM, Dale W. Carder wrote:
> Thus spake Garrett, Seth B 
> ()
>  on Tue, Aug 14, 2018 at 04:08:16PM +0000:
> >    *   You need to account for your DDoS scrubbing service when planning for 
> > RPKI.
> >       *   ?Its strongly encouraged to not use the maxlength option for a 
> > prefix.  However, you need to account for smaller prefixes and/or different 
> > ASNs the routes could be coming from when using a scrubbing service.  This 
> > can lead to rather large ROAs.  Andrew Gallo I know has been doing some 
> > testing in this area.
> Can you share what your thoughts are along these lines?
>
> Dale

--
________________________________
Andrew Gallo
The George Washington University