Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Helping to secure internet routing

aws.amazon.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Helping to secure internet routing

#21

Post by skynet-9000 »

With RPKI, what happens if the RIR (i.e., ARIN, RIPE, etc)'s Certificate Authority decides to revoke the certificate for the netblock?

Does the netblock "owner" suddenly see all of its traffic dropped?

If so, this is a far more powerful takedown than simply a domain or CA takedown or revocation and takes immediate effect across the globe.

It's basically a giant "kill switch" and centralizes enormous power in the RIR's, which still have to operate according to the laws of the jurisdiction that they operate in, but span country laws.

Follow up question. What happens when a judge in (any country) issues legal notice to terminate the certificate to the RIR of a region for a netblock of an entity in another country?

Re: Helping to secure internet routing

#22

Post by simonjgreen »

superkuh wrote: post #9
jtdev wrote: post #7

Earlier quoted context omitted.

Who is the authority on the integrity of routing?

The certificate authority that signs the routes. So yeah, this will centralize control of routing and expose it to things like government censorship and corporation exploitation. Sometimes the wild west is better than an authoritarian government. Like DNSSEC this is only good for megacorps and nationstates. If anything it will expose human people to more abuse and exploitation.

Actually, it's a level playing for all ISPs. So if you want safety, support your smaller ISPs rather than the big names who are often under the surveillance radar and will still be using RPKI.

Re: Helping to secure internet routing

#23

Post by icedchai »

advisedwang wrote: post #5
jtdev wrote: post #4

Does this give AWS any ability to block/censor or influence access to segments of the internet that they might not politically "approve" of?

No. If anything this makes it harder for anyone to block segments of the internet, by ensuring the integrity of routing to any given netblock.

Not really. ISPs can still send your traffic to null0. They can still filter routes. On top of that, it will be years, likely decades, before the majority even bother to validate routes with RPKI.

Re: Helping to secure internet routing

#24

Post by superkuh »

ancarda wrote: post #15
superkuh wrote: post #9

Earlier quoted context omitted.

The certificate authority that signs the routes. So yeah, this will centralize control of routing and expose it to things like government censorship and corporation exploitation. Sometimes the wild west is better than an authoritarian government. Like DNSSEC this is only good for megacorps and nationstates. If anything it will expose human people to more abuse and exploitation.

Has this happened as HTTPS adoption has increased? Do you believe BGP RPKI will be different? A lot of threads about rising use of encryption seem to have this fear - that it will be used against us at some point, and I'd really like to understand where this fear comes from Even taking a recent example of Parler; as far as I know it had HTTPS support and the corresponding X.509 cert was never revoked - instead hostin…

Let's put it another way. Do you think the Arab spring and Libyan civil war would've taken place if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? I don't. Now think of that on kind of thing happening with routes. Yikes.

At least with the way things are now there's no ground truth. Every AS has it's own perception of the routing table and the ability to act on it. That's the way it should be. Securing BGP means less security because there is no global consensus even implied in the protocol. Securing BGP means centralizing BGP, not security.

Re: Helping to secure internet routing

#25

Post by lima »

skynet-9000 wrote: post #21

With RPKI, what happens if the RIR (i.e., ARIN, RIPE, etc)'s Certificate Authority decides to revoke the certificate for the netblock? Does the netblock "owner" suddenly see all of its traffic dropped? If so, this is a far more powerful takedown than simply a domain or CA takedown or revocation and takes immediate effect across the globe. It's basically a giant "kill switch" and centralizes enormous power in the RIR'…

> Does the netblock "owner" suddenly see all of its traffic dropped?

Assuming everyone implements RPKI validation AND the RIR signs a new valid ROA with a different origin: Yes, eventually. Depends on sync intervals. It's unlikely it would even be legally possible to compel them to do this.

Individual ASNs can still choose to accept the invalid route anyway.

The RIR already has the power to revoke assignments, and IRRs would likely remove the route objects which most large networks use to generate filters. It was simply a slower process, and filtering according to IRR data is much more error-prone and open to abuse.

For example, here's RIPE's policy: https://www.ripe.net/publications/docs/ripe-541

Re: Helping to secure internet routing

#26

Post by kitteh »

skynet-9000 wrote: post #21

With RPKI, what happens if the RIR (i.e., ARIN, RIPE, etc)'s Certificate Authority decides to revoke the certificate for the netblock? Does the netblock "owner" suddenly see all of its traffic dropped? If so, this is a far more powerful takedown than simply a domain or CA takedown or revocation and takes immediate effect across the globe. It's basically a giant "kill switch" and centralizes enormous power in the RIR'…

It would revert to not being signed, which routes just fine. You just don't get the additional security benefits. It won't turn it into invalid if I'm following what you are saying.

Re: Helping to secure internet routing

#27

Post by lima »

kitteh wrote: post #26
skynet-9000 wrote: post #21

With RPKI, what happens if the RIR (i.e., ARIN, RIPE, etc)'s Certificate Authority decides to revoke the certificate for the netblock? Does the netblock "owner" suddenly see all of its traffic dropped? If so, this is a far more powerful takedown than simply a domain or CA takedown or revocation and takes immediate effect across the globe. It's basically a giant "kill switch" and centralizes enormous power in the RIR'…

It would revert to not being signed, which routes just fine. You just don't get the additional security benefits. It won't turn it into invalid if I'm following what you are saying.

Yep - simply deleting ROAs would make it "unknown".

A RIR could, however, purposefully sign a new ROA with a different origin.

Re: Helping to secure internet routing

#29

Post by tialaramex »

wmf wrote: post #14
ancarda wrote: post #12

>We are happy to have over 99% of our IPv4 and IPv6 -Space covered under a Route Origination Authorization, and that we are right now dropping RPKI invalid routes in every single Point-of-Presence for AS16509. Does anyone know if AWS is going to push the remaining 1% to implement ROA? Also, it sounds like an unsigned route - which I think most BGP announcements are - is still accepted, right? Any idea when we can sta…

Making RPKI mandatory is like turning off IPv4 after everyone has adopted IPv6.

I believe it is likely that global IPv4 routing goes away before universal adoption of IPv6 at clients.

Transitional technologies allow IPv4 holdouts to have "working" Internet despite an increasing proportion of IPv6 nodes, there's some device somewhere which is mapping your connection to some IPv6-only service as an imaginary IPv4 connection. Such things wouldn't scale with 99% of users and usages, but can handle say, five thousand IPv4 users on your ten million customer ISP who mostly visit Facebook and check email.

Eventually the long distance traffic for IPv4 is tiny, because there's a transition device nearer almost all remaining IPv4 users and that's turning their traffic into IPv6 for the long haul anyway.

At that point if you're a backbone provider, IPv4 is a sizeable cost (the routing tables for it are horrendous) for negligible benefit (hardly any of your traffic) and its future only looks more dismal. So you start deprecating this service for your customers, and they don't bother to buy a replacement because they have a transition device to help any residual IPv4 users.

And so one day, without a fanfare, there just isn't really an IPv4 Internet any more, and the RIRs will just deprecate their management of the numbering for that network because it's obsolete.

Ideally this is an obscure nerd event, like a leap second, which your friends at first don't understand, and then when you explain it they realise it's boring and they don't care.

I hope to live to see it.

Post reply on HN