nanog mailing list archives
RE: BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing")
From: "Keith Medcalf" <kmedcalf () dessus com>
Date: Mon, 21 Oct 2019 09:30:45 -0600
On 21/10/19 6:30 pm, Bjørn Mork wrote:
Yes, and I really like Julien's proposal. It even looks pretty complete. There are just a few details missing around how to make the MD5 => TLS transition smooth.
At least for those systems that run on Linux (which is most all of the major's except Juniper) I suspect if we went to the relevant kernel folk with a clear plan on how handling TCP-MD5 in a way that would make transitions much easier they'd listen.
Why do you need to do anything? TLS is Transport Layer Security and it's sole purpose is to protect communications from eavesdropping or modification by wiretappers on/in the line between points A and B. MD5 in BGP is used for authentication (rudimentary, but authentication nonetheless). Why cannot one just put the MD5 authenticated connection inside a TLS connection? What is the advantage to be gained by replacing the authentication mechanism with weaker certificate authentication method available with TLS? -- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.
Current thread:
- RE: "Using Cloud Resources to Dramatically Improve Internet Routing", (continued)
- RE: "Using Cloud Resources to Dramatically Improve Internet Routing" Keith Medcalf (Oct 07)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" J. Hellenthal via NANOG (Oct 08)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Dennis Lundström (Oct 10)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Hank Nussbacher (Oct 07)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Bjørn Mork (Oct 20)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Julien Goodwin (Oct 20)
- Message not available
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Bjørn Mork (Oct 20)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Christopher Morrow (Oct 20)
- BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Bjørn Mork (Oct 21)
- Re: BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Julien Goodwin (Oct 21)
- RE: BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Keith Medcalf (Oct 21)
- Re: BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Radu-Adrian Feurdean (Oct 21)
- RE: BGP over TLS Robert McKay (Oct 21)
- RE: BGP over TLS Keith Medcalf (Oct 21)
- Re: BGP over TLS Joe Abley (Oct 21)
- Re: BGP over TLS Tony Finch (Oct 21)
- Re: BGP over TLS Jared Mauch (Oct 21)
- Re: BGP over TLS Grant Taylor via NANOG (Oct 21)
- Re: BGP over TLS Julien Goodwin (Oct 22)
- Re: BGP over TLS Christopher Morrow (Oct 22)
- RE: BGP over TLS Keith Medcalf (Oct 22)