We need to get to a fully trustless routing mechanism on global networks
Fully trustless is where we started.
Helping to secure internet routing
31–40 of 54 posts
Re: Helping to secure internet routing
#32With RPKI, what happens if the RIR (i.e., ARIN, RIPE, etc)'s Certificate Authority decides to revoke the certificate for the netblock? Does the netblock "owner" suddenly see all of its traffic dropped? If so, this is a far more powerful takedown than simply a domain or CA takedown or revocation and takes immediate effect across the globe. It's basically a giant "kill switch" and centralizes enormous power in the RIR'…
The experience in the Web PKI has been that you can pay lawyers to explain to a judge that they should order the thing they actually want done, rather than accept contorted arguments from other lawyers that a different order will achieve the goals despite not ordering what is actually desired.
For example the EFF spent effort helping US judges understand that if they want to order that stealmovies.example must go away they need to order the example registry to remove this name, not try to force Let's Encrypt to revoke certificates for it as Hollywood lawyers were advocating.
That won't magically stop judges from making orders you disagree with but it does force them to be clear eyed about what they're about, and that means you're more likely to prevail with simple just rationales either in court or subsequently in popular opinion.
Re: Helping to secure internet routing
#33Does this give AWS any ability to block/censor or influence access to segments of the internet that they might not politically "approve" of?
Why the downvotes for this question? Given recent events, this seems like an incredibly important consideration. No matter your perspective, this seems like something to think about.
If you think Amazon did the right thing, then you would probably want them to be able to refuse routes from networks that are too dangerous.
If you think Amazon did the wrong thing, then you may be afraid that this gives them even more power to de-platform.
Either way, this seems relevant to me. Thanks OP for asking the question.
Re: Helping to secure internet routing
#34Earlier quoted context omitted.
Has this happened as HTTPS adoption has increased? Do you believe BGP RPKI will be different? A lot of threads about rising use of encryption seem to have this fear - that it will be used against us at some point, and I'd really like to understand where this fear comes from Even taking a recent example of Parler; as far as I know it had HTTPS support and the corresponding X.509 cert was never revoked - instead hostin…
Let's put it another way. Do you think the Arab spring and Libyan civil war would've taken place if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? I don't. Now think of that on kind of thing happening with routes. Yikes. At least with the way things are now there's no ground truth. Every AS has it's own perception of the routing table and the ability to act on it. That's the way it should be.…
> if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys?
But Gaddafi was already in control of all Libyan ISPs and the .ly ccTLD. Why would DNSSEC have made his job any easier?
Also, surely Facebook was more instrumental in the Arab Spring than bit.ly was.[0] If anything, the lack of DNSSEC made it easier for Gaddafi to spoof DNS results for facebook.com and other sites.
[0] https://en.wikipedia.org/wiki/Social_media_and_the_Arab_Spri...
Re: Helping to secure internet routing
#35Given recent AWS activities. One can foresee AWS dropping routing request for sites they don't like.
Re: Helping to secure internet routing
#36With RPKI, what happens if the RIR (i.e., ARIN, RIPE, etc)'s Certificate Authority decides to revoke the certificate for the netblock? Does the netblock "owner" suddenly see all of its traffic dropped? If so, this is a far more powerful takedown than simply a domain or CA takedown or revocation and takes immediate effect across the globe. It's basically a giant "kill switch" and centralizes enormous power in the RIR'…
> Does the netblock "owner" suddenly see all of its traffic dropped? Assuming everyone implements RPKI validation AND the RIR signs a new valid ROA with a different origin: Yes, eventually. Depends on sync intervals. It's unlikely it would even be legally possible to compel them to do this. Individual ASNs can still choose to accept the invalid route anyway. The RIR already has the power to revoke assignments, and IR…
"It's unlikely it would even be laglly possible to compel them to do this."
But then, at a higher level, look at the unilateral/collective censorship ("deplatforming") that is happening right now... and being carried out in part by Amazon. None of the censors have been legally compelled to take any such actions.
Re: Helping to secure internet routing
#37Earlier quoted context omitted.
Let's put it another way. Do you think the Arab spring and Libyan civil war would've taken place if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? I don't. Now think of that on kind of thing happening with routes. Yikes. At least with the way things are now there's no ground truth. Every AS has it's own perception of the routing table and the ability to act on it. That's the way it should be.…
> if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? But Gaddafi was already in control of all Libyan ISPs and the .ly ccTLD. Why would DNSSEC have made his job any easier? Also, surely Facebook was more instrumental in the Arab Spring than bit.ly was.[0] If anything, the lack of DNSSEC made it easier for Gaddafi to spoof DNS results for facebook.com and other sites. [0] https://en.wikipedia.or…
Gaddafi was not, to my knowledge, in control of any WebPKI CA=True certificates.
Re: Helping to secure internet routing
#38Earlier quoted context omitted.
Making RPKI mandatory is like turning off IPv4 after everyone has adopted IPv6.
I believe it is likely that global IPv4 routing goes away before universal adoption of IPv6 at clients. Transitional technologies allow IPv4 holdouts to have "working" Internet despite an increasing proportion of IPv6 nodes, there's some device somewhere which is mapping your connection to some IPv6-only service as an imaginary IPv4 connection. Such things wouldn't scale with 99% of users and usages, but can handle s…
> a transition device nearer almost all remaining IPv4 users and that's turning their traffic into IPv6 for the long haul anyway.
This is mostly impossible, because an IPv4 packet doesn't have room for an IPv6 destination. The opposite direction (NAT64) is common, but that's for IPv6 clients talking to IPv4 servers.
Re: Helping to secure internet routing
#39Earlier quoted context omitted.
> if DNSSEC had been in place and Gaddafi had control of bit.ly's TLS keys? But Gaddafi was already in control of all Libyan ISPs and the .ly ccTLD. Why would DNSSEC have made his job any easier? Also, surely Facebook was more instrumental in the Arab Spring than bit.ly was.[0] If anything, the lack of DNSSEC made it easier for Gaddafi to spoof DNS results for facebook.com and other sites. [0] https://en.wikipedia.or…
Gaddafi was not, to my knowledge, in control of any WebPKI CA=True certificates.
Obviously for facebook.com he would only be able to serve an unencrypted HTTP version (and HSTS-preloading would prevent that working in most cases), but by controlling the .ly ccTLD he could acquire TLS certificates for any "national" site. I'm not sure if any of that is relevant, though.
Re: Helping to secure internet routing
#40Earlier quoted context omitted.
I believe it is likely that global IPv4 routing goes away before universal adoption of IPv6 at clients. Transitional technologies allow IPv4 holdouts to have "working" Internet despite an increasing proportion of IPv6 nodes, there's some device somewhere which is mapping your connection to some IPv6-only service as an imaginary IPv4 connection. Such things wouldn't scale with 99% of users and usages, but can handle s…
> a transition device nearer almost all remaining IPv4 users and that's turning their traffic into IPv6 for the long haul anyway. This is mostly impossible, because an IPv4 packet doesn't have room for an IPv6 destination. The opposite direction (NAT64) is common, but that's for IPv6 clients talking to IPv4 servers.
So, what you do goes like this: You provide DNS service, offering A answers even where (if you were to ask the public Internet) there are none. When you're asked for foo.bar.example you do an AAAA query, and you track for a while a mapping from the answer to a (RFC1918 or assigned for this purpose) IPv4 address, and recording it, then you reply to the A? query with your temporary address as the answer and a chosen timeout (maybe you plan to have this work for one hour, so you give 3600 seconds timeout). You then act as a NAT gateway that translates between IPv6 and IPv4 for that address mapping.
This doesn't work great, it breaks protocols which assume they're transparent (e.g. some FTP modes), it is slower and clunkier than "just" having IPv4 as we do today, and as I said it isn't viable with huge numbers of users (you run out of address space) but it's good enough that a lot of common application software remains usable this way.
This is about the gentle slope down, so it doesn't need to be perfect or even have the potential to be perfect, it just needs to work well enough to reduce the amount of tech support phone calls.
Think of it like the way pulse dialling was deprecated. Nobody needed to figure out a way to have pulse dialling be as good as tone dialling, let alone a truly out-of-band system (as is used by your mobile phone, and most other modern systems), they just needed to minimise the situation where lots of customers discover that they were using pulse dialling only because now it doesn't work.