[as112-ops] RPKI-signature for AS112-Prefixes

[Jens Ott - Opteamax GmbH]

Hi,

One argument could also be, that some IXP-routeservers are already strict filtering and only accept prefixes which have a state "valid". Especially small ASNs not running their own AS112 node and not getting direct peerings with someone running an AS112 node could see the prefixes over the routeservers.

BR
Jens

Am 27. Juli 2018 19:39:58 MESZ schrieb "Carlos M. Martinez" <carlosm3011 at gmail.com>:
>Hi,
>
>AS112 is a very particular case in the sense that anyone can operate a 
>node. As a promoter of RPKI myself, I’d love to see ROAs for AS112, 
>but as Joe points out, it is not particularly useful for anything else 
>than supporting the technology.
>
>cheers!
>
>/Carlos
>
>On 27 Jul 2018, at 13:22, Joe Abley wrote:
>
>> Hi Matt,
>>
>> Presumably the same as any other use of route origin validation:
>> defence against accidental origination of the routes from autonomous
>> systems other than 112.
>>
>> ROAs or other origin attestations don't provide any real defence
>> against malicious origination, so the fact that malicious isn't
>really
>> a thing with 112 seems tangential.
>>
>> There's also the (arguably more dubious) benefit of being seen to
>> support RPKI in general.
>>
>> It'd be fairly straightforward for DNS-OARC, as stewards of the
>> project's number resources, to publish a ROA I think (and I don't
>> think doing so would do any harm).
>>
>>
>> Joe
>>
>> On Jul 27, 2018, at 11:20, Matthew Pounsett <matt at dns-oarc.net>
>wrote:
>>
>>>> On Jul 27, 2018, at 04:41, Jens Ott - Opteamax GmbH
><jo at opteamax.de> 
>>>> wrote:
>>>>
>>>> Hi,
>>>>
>>>> I just found that the AS112 prefixes do not have RPKI signatures. I
>>>> think a project like AS112 should support route-origin-validation.
>>>>
>>>> Who ever has the ability to create a signature, would you mind
>doing 
>>>> so?
>>>
>>> The AS112 project, by design, allows anyone to set up and operate an
>
>>> AS112 name server and announce the relevant routes.  What would be 
>>> the goal of doing route origin validation on those routes?
>>>
>>> Matt Pounsett
>>> DNS-OARC Systems Engineering
>>>
>>>
>>> _______________________________________________
>>> as112-ops mailing list
>>> as112-ops at lists.dns-oarc.net
>>> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>> _______________________________________________
>> as112-ops mailing list
>> as112-ops at lists.dns-oarc.net
>> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>_______________________________________________
>as112-ops mailing list
>as112-ops at lists.dns-oarc.net
>https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>
>!DSPAM:1229,5b5b5a97195088645649653!

-- 
Jens Ott
Geschäftsführer

Opteamax GmbH

Simrockstr. 4b
53619 Rheinbreitbach

Tel.:  +49 2224 969500
Fax:   +49 2224 97691059
Email: jo at opteamax.de

HRB: 23144, Amtsgericht Montabaur
Geschäftsführer: Jens Ott
Umsatzsteuer-ID.: DE264133989
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/mailman/private/as112-ops/attachments/20180727/82ff37ca/attachment.html>