Internet2 Network Security SIG

[Larry Blunk <>]

On 08/15/2018 01:55 PM, Andrew Gallo wrote:
> Greetings, Security WG:
>
> Seth Garrett and I have been trading some emails about creating a ROA 
> request with a lot of prefixes.  I've written a script that can make 
> this easier.
> https://github.com/CAAREN-engineering/generateSignedROAreq
>
> Here's the scenario and use-case:
>
> If you have a large summary prefix, let's say an IPv4 /16, and you 
> would like to cover this prefix AND all the /24s within it, you 
> *could* use the Max Length feature to create a ROA request for 
> 172.16.0.0/16-24. HOWEVER, use of Max Length field is no longer 
> recommended (can lead to larger attack surface).
>
> You might want ROAs covering all the constituent /24s so that they can 
> be originated by a DDoS scrubbing service.
>
> At this point, following best practices, you're left with entering 256 
> prefixes by hand in the Hosted RPKI portal.  There is another way!
>
> You can pasted into the portal pre-formatted, pre-signed text.
>
> ARIN's instructions are here:
> https://www.arin.net/resources/rpki/roarequest.html
>
> I wrote a script to help make this process easier.  What you'll need:
> Python 3.3+
> a file containing a list of prefixes you want included in the ROA (you 
> can mix v4 and v6)
> Your private key
>
> The script will ask you some basic information needed to create the 
> ROA request data:
> Origin ASN
> ROA name
> Validity Start Date
> Validity End Date
>
>
> Let me know if you have any questions.




   I'm really failing to see the big win here.   It's not so much the 
use of maxlength that's the
issue, but rather having ROA's allowing announcements of prefixes which
you do not normally announce (which are more specifics of prefixes you 
normally do announce).
When you use maxlength, the attacker still needs to spoof origin AS in 
the AS_PATH
in order to hijack a prefix.    By registering a bunch of /24's (or 
/48's) which
are not normally announced, you still opening yourself up to hijacks of 
those individual
prefixes with the same type of origin AS spoofing.   For most networks, 
hijacking a few strategic
/24's or /48's will likely be just as deadly as hijacking a larger block.


 -Larry Blunk
  Merit