nanog mailing list archives
RE: BGP over TLS
From: "Keith Medcalf" <kmedcalf () dessus com>
Date: Mon, 21 Oct 2019 10:05:41 -0600
On Monday, 21 October, 2019 09:44, Robert McKay <robert () mckay com> wrote:
On 2019-10-21 16:30, Keith Medcalf wrote:
Why do you need to do anything? TLS is Transport Layer Security and it's sole purpose is to protect communications from eavesdropping or modification by wiretappers on/in the line between points A and B. MD5 in BGP is used for authentication (rudimentary, but authentication nonetheless).
Why cannot one just put the MD5 authenticated connection inside a TLS connection? What is the advantage to be gained by replacing the authentication mechanism with weaker certificate authentication method available with TLS?
The MD5 authentication is built into TCP options.. not obvious how you would transport it over TLS which afaik doesn't offer similar functionality.
AHA! I understand now and sit corrected. I was under the mistaken impression that MD5 authentication was an application level thing, not a TCP level thing.
You'd probably have to basically tunnel TCP frames inside TLS, which doesn't really sound ideal (reimplement TCP in userspace?)
Either that or maybe use some other simpler MD5 based authentication (unrelated to the TCP implementation currently used in BGP).. but then that raises lots of questions like why even use MD5.
You are correct. There is no point in using or moving the current MD5 authentication method when it can just be "turned off" and some (perhaps better alternate) authentication method used as provided by the TLS wrapper. This of course presumes that if one turns off MD5 that the additional TCP option header is not used ... -- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.
Current thread:
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing", (continued)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Hank Nussbacher (Oct 07)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Bjørn Mork (Oct 20)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Julien Goodwin (Oct 20)
- Message not available
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Bjørn Mork (Oct 20)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Christopher Morrow (Oct 20)
- BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Bjørn Mork (Oct 21)
- Re: BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Julien Goodwin (Oct 21)
- RE: BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Keith Medcalf (Oct 21)
- Re: BGP over TLS (was: Re: "Using Cloud Resources to Dramatically Improve Internet Routing") Radu-Adrian Feurdean (Oct 21)
- RE: BGP over TLS Robert McKay (Oct 21)
- RE: BGP over TLS Keith Medcalf (Oct 21)
- Re: BGP over TLS Joe Abley (Oct 21)
- Re: BGP over TLS Tony Finch (Oct 21)
- Re: BGP over TLS Jared Mauch (Oct 21)
- Re: BGP over TLS Grant Taylor via NANOG (Oct 21)
- Re: BGP over TLS Julien Goodwin (Oct 22)
- Re: BGP over TLS Christopher Morrow (Oct 22)
- RE: BGP over TLS Keith Medcalf (Oct 22)
- Re: BGP over TLS Chris Adams (Oct 22)
- Re: BGP over TLS Brandon Martin (Oct 22)
- Re: BGP over TLS Jared Mauch (Oct 22)
- Re: "Using Cloud Resources to Dramatically Improve Internet Routing" Hank Nussbacher (Oct 07)