Description
BGPsec enjoys global world domination. Or does it? No, it does not. At least not yet. Therefore this needs to be addressed.
BGPsec has been around in theory and on paper for a while. Not in practice and deployments, though. Some production scale and quality experimentation with BGPsec, performed over last two years within Equinix networks, has revealed quite a number of incorrect design time assumptions, outright wrong decisions made, lack of community understanding of how it could and should be used, and how can it fit into the overall routing security framework. One of the open gaps is the unawareness of the community, primarily operations community, of how BGPsec functions and how it should be deployed. Therefore this proposal for your CSNOG event - a tutorial on BGPsec and how BGPsec fits into the overall context.
Three large parts:
- BGPsec the protocol, covering the protocol mechanics itself and how it operates on the BGP signaling level;
- Infrastructure required for BGPsec operation, covering aspects of providing and distributing supporting informational elements into BGPsec system - integration with RPKI machinery, what is required from the perspective of registries and certificate authorities, what are the scalability properties expected from the RPKI side, and practical aspects of how existing origin and path validation tooling would need to be extended to cover BGPsec too;
- BGPsec in the context of the overall routing security, and how it would match or interwork with the current understanding of routing security as realized by origin and path validation, with specific scenarios of what it would take to deploy BGPsec from the perspective of edge node, transit operator, an IX, and a CSP.
Overall technical level is expected to be rather high and detailed - as topics involving cryptography and practical security engineering just cannot be shallow and trivial. The target audience is not implementers though - it is focused for deployment teams.
Some historic background - having spent a substantial amount of time on characterizing the performance of BGPsec if deployed in the global routing system, it became evident that the current model will cause significant resource constraints on the infrastructure. For the most part the reasons why this would happen are not known to the community, and a common and outdated wisdom based on the BGPsec authors' vision appears to be misaligned with reality. Another aspect of complexity is in the area of supporting infrastructure - the keys and certificates and what to do about it to make it practically usable, and this part is mostly completely underlooked by the BGPsec specifications. As it appears at this time, the limiting factor to BGPsec adoption is the lack of community understanding in what it is and how it operates. There are some movements on the administrative side (NIST lobbying the US government and ITU to make BGPsec mandated for use), vendors are so far reluctant to do much as they do not see much interest from the community.
The content could be squeezed into 1 hour, preferred format would be an auditorium discussion with audience questions intermixed, more resembling a workshop style. It is not expected to have a hands-on part - this is an introduction into BGPsec problematics, and also the existing tooling is yet too raw for production use. An expectation would be for the bidirectional communication with the audience in a form of a questions-driven discussion.
