RFC 8205
BGPsec Protocol Specification
RFC 8205: BGPsec Protocol Specification 🎀
Okay bestie, here's the title block tea 🫶 It's an IETF Request for Comments, number 8205, and it's on the Standards Track 🔥. Written by M. Lepinski (Ed.) at NCF and K. Sriram (Ed.) at NIST. ISSN 2070-1721, dated September 2017. The title block doesn't list anything it obsoletes or updates, so it's standing on its own 💅
Abstract ✨
Okay so the big idea is BGPsec 🦋, an extension to the Border Gateway Protocol (BGP) that protects the path a BGP UPDATE message takes through Autonomous Systems (ASes). It works through an optional non-transitive BGP path attribute that carries digital signatures, one from each AS that passes the UPDATE along. Those signatures give you confidence that every AS on the listed path explicitly authorized the route being advertised. Main character energy for route security, periodt 💖
Status of This Memo
This one is an Internet Standards Track document 🌈
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 7841 📚
For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8205 🧚
Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved 💜
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 🙈 Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 💀
Table of Contents 🍓
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2. BGPsec Negotiation . . . . . . . . . . . . . . . . . . . . . 3
2.1. The BGPsec Capability . . . . . . . . . . . . . . . . . . 4
2.2. Negotiating BGPsec Support . . . . . . . . . . . . . . . 5
3. The BGPsec_PATH Attribute . . . . . . . . . . . . . . . . . . 6
3.1. Secure_Path . . . . . . . . . . . . . . . . . . . . . . . 8
3.2. Signature_Block . . . . . . . . . . . . . . . . . . . . . 10
4. BGPsec UPDATE Messages . . . . . . . . . . . . . . . . . . . 11
4.1. General Guidance . . . . . . . . . . . . . . . . . . . . 11
4.2. Constructing the BGPsec_PATH Attribute . . . . . . . . . 14
4.3. Processing Instructions for Confederation Members . . . . 18
4.4. Reconstructing the AS_PATH Attribute . . . . . . . . . . 19
5. Processing a Received BGPsec UPDATE Message . . . . . . . . . 21
5.1. Overview of BGPsec Validation . . . . . . . . . . . . . . 22
5.2. Validation Algorithm . . . . . . . . . . . . . . . . . . 23
6. Algorithms and Extensibility . . . . . . . . . . . . . . . . 27
6.1. Algorithm Suite Considerations . . . . . . . . . . . . . 27
6.2. Considerations for the SKI Size . . . . . . . . . . . . . 28
6.3. Extensibility Considerations . . . . . . . . . . . . . . 28
7. Operations and Management Considerations . . . . . . . . . . 29
7.1. Capability Negotiation Failure . . . . . . . . . . . . . 29
7.2. Preventing Misuse of pCount=0 . . . . . . . . . . . . . . 29
7.3. Early Termination of Signature Verification . . . . . . . 30
7.4. Non-deterministic Signature Algorithms . . . . . . . . . 30
7.5. Private AS Numbers . . . . . . . . . . . . . . . . . . . 30
7.6. Robustness Considerations for Accessing RPKI Data . . . . 32
7.7. Graceful Restart . . . . . . . . . . . . . . . . . . . . 32
7.8. Robustness of Secret Random Number in ECDSA . . . . . . . 32
7.9. Incremental/Partial Deployment Considerations . . . . . . 33
8. Security Considerations . . . . . . . . . . . . . . . . . . . 33
8.1. Security Guarantees . . . . . . . . . . . . . . . . . . . 33
8.2. On the Removal of BGPsec Signatures . . . . . . . . . . . 34
8.3. Mitigation of Denial-of-Service Attacks . . . . . . . . . 36
8.4. Additional Security Considerations . . . . . . . . . . . 36
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 38
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 39
10.1. Normative References . . . . . . . . . . . . . . . . . . 39
10.2. Informative References . . . . . . . . . . . . . . . . . 41
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 43
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 451. Introduction 🦋
Okay so BGPsec is a mechanism for path security on Border Gateway Protocol (BGP) [RFC4271] route advertisements 💅 What that means: a BGP speaker that receives a valid BGPsec UPDATE message gets cryptographic assurance that the route has this property: every Autonomous System (AS) on the path of ASes listed in the UPDATE message has explicitly authorized the advertisement of the route to the next AS in the path 😭 Iconic.
This document specifies an optional (non-transitive) BGP path attribute, BGPsec_PATH 🎀 It also explains how a BGPsec-compliant BGP speaker (called a BGPsec speaker from here on) can generate, propagate, and validate BGP UPDATE messages that carry this attribute, so you get those assurances.
BGPsec is meant to supplement BGP origin validation [RFC6483] [RFC6811]. When you use it together with origin validation, you can prevent a wide variety of route hijacking attacks against BGP 🔥 literally the dream team.
BGPsec leans on Resource Public Key Infrastructure (RPKI) certificates that attest to the allocation of AS number and IP address resources. (If you want the RPKI deep dive, see RFC 6480 [RFC6480] and the documents it references 🧚) Any BGPsec speaker that wants to send BGP UPDATE messages containing the BGPsec_PATH to external (eBGP) peers needs a private key tied to an RPKI router certificate [RFC8209] that matches the speaker's AS number. Here's the twist though: a BGPsec speaker does not need that certificate to validate received UPDATE messages containing the BGPsec_PATH attribute (see Section 5.2) ✨
1.1. Requirements Language 💜
Here's the rule for the capital words 🙈 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, just like they're shown here. Only the all-caps versions count, so the lowercase ones are just regular words 💅
2. BGPsec Negotiation 🌸
This document defines a BGP capability [RFC5492] that lets a BGP speaker tell a neighbor it can send or receive BGPsec UPDATE messages. Those are UPDATE messages carrying the BGPsec_PATH attribute 🦋 Basically, it's how two routers say "yep, we speak BGPsec" before anything else happens 🫶
2.1. The BGPsec Capability 🎀
Okay this capability has capability code 7 👑
The capability length for this capability MUST be set to 3 🔥
The 3 octets of the capability format are laid out in Figure 1 🍓
0 1 2 3 4 5 6 7
+---------------------------------------+
| Version | Dir | Unassigned |
+---------------------------------------+
| |
+------ AFI -----+
| |
+---------------------------------------+
Figure 1: BGPsec Capability FormatOkay bestie, the first 4 bits of the first octet tell you which BGPsec version the speaker is advertising support for ✨ This document only defines BGPsec version 0 (all 4 bits set to 0). Future documents might define other versions 🧚 A BGPsec speaker MAY advertise support for multiple versions by putting multiple versions of the BGPsec capability in its BGP OPEN message. Multi-version energy 🌈
The fifth bit of the first octet is the Direction bit 💅 It says whether the speaker is advertising the ability to send BGPsec UPDATE messages or to receive them. Setting it to 0 means "I can receive BGPsec UPDATE messages," and setting it to 1 means "I can send BGPsec UPDATE messages." Simple, but iconic 😭
The remaining 3 bits of the first octet are unassigned and reserved for future use 🙈 The sender of the capability sets them to 0, and the receiver ignores them 🫶
The second and third octets hold the 16-bit Address Family Identifier (AFI), which says which address family the speaker is advertising BGPsec support for. This document only specifies BGPsec for two address families: IPv4 and IPv6, with AFI values 1 and 2 respectively [IANA-AF] 🍓 Other address families might get specified in future documents, so stay tuned 💖
To be continued in part 2 🦋
2.2. Negotiating BGPsec Support
okay so this is the part where two BGP speakers shake hands and figure out whether they're both ready for BGPsec, bestie 🎀✨
To say you're willing to send BGPsec UPDATE messages (for a particular address family), a BGP speaker sends the BGPsec capability (see Section 2.1) with the Direction bit (the fifth bit of the first octet) set to 1 💅. To say you're willing to receive UPDATE messages containing the BGPsec_PATH attribute (for a particular address family), it sends the BGPsec capability with the Direction bit set to 0 🦋. And if you want to do both, you send two copies of the capability, one with the Direction bit set to 0 and one with it set to 1 👑. Main character energy, literally.
Now, if a speaker wants BGPsec with two different address families (like IPv4 and IPv6) over the same BGP session, it includes two instances of this capability in the BGP OPEN message, one for each address family 🌈. But here's the thing, no cap: a BGP speaker MUST NOT announce the BGPsec capability if it doesn't support the BGP multiprotocol extension [RFC4760] 🙈. And it also MUST NOT advertise BGPsec support for a particular AFI unless it has also advertised the multiprotocol extension capability for that same AFI [RFC4760] 💀. Read that twice, it's a whole vibe check.
So when does a peer actually get to send UPDATE messages carrying the BGPsec_PATH attribute? Only if, and I mean only if 🫶:
- The given peer sent the BGPsec capability for a particular version of BGPsec and a particular address family with the Direction bit set to
1, and - The other (receiving) peer sent the BGPsec capability for the same version of BGPsec and the same address family with the Direction bit set to
0.
When both of those are true, we say that the use of that version of BGPsec has been negotiated for that address family 🎀. Traditional, unsigned BGP UPDATE messages (the ones with the AS_PATH attribute) MAY still be sent in the session whether or not BGPsec got successfully negotiated 🌸. BUT, if BGPsec is not successfully negotiated, then UPDATE messages containing the BGPsec_PATH attribute MUST NOT be sent. Period. 😭
This document only defines how implementations behave when BGPsec version 0 is the only version successfully negotiated. Any future document that specifies additional versions of BGPsec will need to spell out what happens when support for multiple versions is negotiated 🧚.
Also, BGPsec can't provide meaningful security guarantees without support for 4-byte AS numbers 🍓. So any BGP speaker that announces the BGPsec capability MUST also announce the 4-byte AS support capability [RFC6793]. If a speaker sends the BGPsec capability but not the 4-byte AS support capability, then BGPsec has not been successfully negotiated, and UPDATE messages containing the BGPsec_PATH attribute MUST NOT be sent within that session 💖.
Bestie, the 4-byte AS thing is non-negotiable. No BGPsec without it. 🚫
3. The BGPsec_PATH Attribute
okay the BGPsec_PATH attribute is an optional non-transitive BGP path attribute 🦋.
This document registers an attribute type code for it: BGPsec_PATH (see Section 9) 🎀.
So the BGPsec_PATH attribute carries the secured info about the path of ASes that an UPDATE message travels through, including the digital signatures that protect the path info ✨. UPDATE messages containing it are called "BGPsec UPDATE messages" 💅. The BGPsec_PATH attribute replaces the AS_PATH attribute in a BGPsec UPDATE message. So UPDATE messages that contain the BGPsec_PATH attribute MUST NOT contain the AS_PATH attribute, and vice versa 🙈.
The BGPsec_PATH attribute has several parts. Here's the high-level picture in Figure 2 (SKI in that figure means "Subject Key Identifier") 🌈:
+---------------------------------------------------------+
| +-----------------+ |
| | Secure_Path | |
| +-----------------+ |
| | pCount X | |
| | Flags X | |
| | AS X | |
| | pCount Y | |
| | Flags Y | |
| | AS Y | |
| | ... | |
| +-----------------+ |
| |
| +---------------------+ +---------------------+ |
| | Signature_Block 1 | | Signature_Block 2 | |
| +---------------------+ +---------------------+ |
| | Algorithm Suite 1 | | Algorithm Suite 2 | |
| | SKI X1 | | SKI X2 | |
| | Signature X1 | | Signature X2 | |
| | SKI Y1 | | SKI Y2 | |
| | Signature Y1 | | Signature Y2 | |
| | ... | | .... | |
| +---------------------+ +---------------------+ |
| |
+---------------------------------------------------------+
Figure 2: High-Level Diagram of the BGPsec_PATH AttributeAnd Figure 3 gives the format spec for the BGPsec_PATH attribute 📐:
+-------------------------------------------------------+
| Secure_Path (variable) |
+-------------------------------------------------------+
| Sequence of one or two Signature_Blocks (variable) |
+-------------------------------------------------------+
Figure 3: BGPsec_PATH Attribute FormatThe Secure_Path holds the AS path info for the BGPsec UPDATE message. It's logically equivalent to what a non-BGPsec AS_PATH attribute holds, and BGPsec speakers use it the same way non-BGPsec speakers use AS_PATH info 🫶. The format of the Secure_Path is covered below in Section 3.1.
The BGPsec_PATH attribute will contain one or two Signature_Blocks, and each one corresponds to a different algorithm suite 🔥. Each Signature_Block has a Signature Segment for each AS number (i.e., Secure_Path Segment) in the Secure_Path. In the most common case there's just a single Signature_Block 🍓. But to move from an old algorithm suite to a new one without a flag day, you'll need two Signature_Blocks during the transition period, one for the old suite and one for the new 🧚. (See Section 6.1 for more on algorithm transitions.) The format of the Signature_Blocks is described below in Section 3.2.
3.1. Secure_Path
okay, this is the deep dive on the Secure_Path 🔍💜. The spec for the Secure_Path field is in Figures 4 and 5.
+-----------------------------------------------+
| Secure_Path Length (2 octets) |
+-----------------------------------------------+
| One or more Secure_Path Segments (variable) |
+-----------------------------------------------+
Figure 4: Secure_Path FormatThe Secure_Path Length is the length (in octets) of the entire Secure_Path, including the 2 octets used to express this length field 🎀. Each Secure_Path Segment is 6 octets long, so the Secure_Path Length is two greater than six times the number of Secure_Path Segments (i.e., the number of AS numbers in the path) 🧮.
The Secure_Path has one Secure_Path Segment (see Figure 5) for each AS in the path back to the originating AS of the prefix in the UPDATE message 🛤️. (Note: repeated ASes get "compressed out" using the pCount field, more on that below 🗜️.)
+------------------------------------------------------+
| pCount (1 octet) |
+------------------------------------------------------+
| Confed_Segment flag (1 bit) | Unassigned (7 bits) | (Flags)
+------------------------------------------------------+
| AS Number (4 octets) |
+------------------------------------------------------+
Figure 5: Secure_Path Segment FormatThe AS Number (from Figure 5) is the AS number of the BGP speaker that added this Secure_Path Segment to the BGPsec_PATH attribute 🌟. (See Section 4 for more on populating this field.)
The pCount field is how many repetitions of the associated AS number the signature covers 🔁. This lets a BGPsec speaker copy the effect of prepending its AS several times to the AS_PATH without having to generate multiple signatures, which is so smart 🧠. Heads up: Section 9.1.2.2 ("Breaking Ties (Phase 2)") in [RFC4271] talks about the "number of AS numbers" in the AS_PATH attribute used in route selection. That metric is the same as the AS path length you get in BGPsec by summing the pCount values in the BGPsec_PATH attribute 📏. pCount is also handy for route servers (see Section 4.2), AS confederations (see Section 4.3), and AS Number migrations (see [RFC8206] for details) 🛠️.
The leftmost (most significant) bit of the Flags field in Figure 5 is the Confed_Segment flag 🚩. It's set to 1 when the BGPsec speaker that built this Secure_Path Segment is sending the UPDATE to a peer AS inside the same AS confederation [RFC5065] 🏰. (So a run of consecutive Confed_Segment flags set to 1 shows up in a BGPsec UPDATE wherever an AS_PATH segment of type AS_CONFED_SEQUENCE shows up in a non-BGPsec UPDATE.) In every other case, the Confed_Segment flag is set to 0 🙅♀️.
The other 7 bits of the Flags field are unassigned. They MUST be set to 0 by the sender and ignored by the receiver 🫧. Note though that the signature is computed over all 8 bits of the Flags field, so those bits really do count 🔐.
Remember from Section 2.2 that BGPsec peering requires that the peering ASes MUST each support 4-byte AS numbers 💖. Currently assigned 2-byte AS numbers get turned into 4-byte AS numbers by setting the two high-order octets of the 4-octet field to 0 [RFC6793] ✨.
3.2. Signature_Block 🎀
okay bestie, so the Signature_Block is basically the part of the BGPsec_PATH attribute where all the signatures live, and we're gonna look at it using Figures 6 and 7 ✨ it's giving organized, no cap 💅
+---------------------------------------------+
| Signature_Block Length (2 octets) |
+---------------------------------------------+
| Algorithm Suite Identifier (1 octet) |
+---------------------------------------------+
| Sequence of Signature Segments (variable) |
+---------------------------------------------+
Figure 6: Signature_Block Formatso the Signature_Block Length in Figure 6 is the total number of octets in the whole Signature_Block, and yes that includes the 2 octets used for the length field itself 🫶
the Algorithm Suite Identifier is a 1-octet identifier that tells you which digest algorithm and which digital signature algorithm got used to make the signature in each Signature Segment 🔥 the IANA registry of these algorithm suite identifiers for BGPsec is specified in the BGPsec algorithms document [RFC8208] 🌈
a Signature_Block in Figure 6 has exactly one Signature Segment (see Figure 7) for each Secure_Path Segment in the Secure_Path portion of the BGPsec_PATH attribute. so basically, one Signature Segment for each distinct AS on the path for the prefix in the UPDATE message 🦋
+---------------------------------------------+
| Subject Key Identifier (SKI) (20 octets) |
+---------------------------------------------+
| Signature Length (2 octets) |
+---------------------------------------------+
| Signature (variable) |
+---------------------------------------------+
Figure 7: Signature Segment Formatthe Subject Key Identifier (SKI) field in Figure 7 holds the value from the Subject Key Identifier extension of the RPKI router certificate [RFC6487] that's used to verify the signature. (for the details on whether BGPsec UPDATE messages are valid, check Section 5 🎀) the SKI field is always exactly 20 octets, and Section 6.2 has the considerations for the SKI size 🧚
the Signature Length field holds the size, in octets, of the value in the Signature field of that Signature Segment 💜
the Signature field in Figure 7 holds a digital signature that protects the prefix and the BGPsec_PATH attribute. for how signatures get generated and validated, see Sections 4 and 5 respectively 🌸
4. BGPsec UPDATE Messages 💖
okay this section is the big one for BGPsec UPDATE messages, aka UPDATE messages that carry the BGPsec_PATH attribute 🫶
Section 4.1 gives general guidance on making BGPsec UPDATE messages 💅
Section 4.2 explains how a BGPsec speaker generates the BGPsec_PATH attribute to put in a BGPsec UPDATE message ✨
Section 4.3 has special processing instructions for members of an AS confederation [RFC5065]. a BGPsec speaker that is NOT in such a confederation MUST NOT set the Confed_Segment flag in its Secure_Path Segment (so just leave the Confed_Segment flag at its default value of 0) in every BGPsec UPDATE message it sends 🙈
Section 4.4 has instructions for rebuilding the AS_PATH attribute when a BGPsec speaker gets an UPDATE message with a BGPsec_PATH attribute and wants to pass it along to a peer that doesn't support BGPsec 🦋
4.1. General Guidance 🌈
okay so the signature on a BGPsec UPDATE message protects the AS number of the peer the message is being sent to 😭 which means if a BGPsec speaker wants to send a BGPsec UPDATE message to multiple BGP peers, it MUST generate a separate BGPsec UPDATE message for each unique peer AS it's sending to 💅
a BGPsec UPDATE message MUST advertise a route to only a single prefix. why? because a BGPsec speaker that gets an UPDATE with multiple prefixes wouldn't be able to build a valid BGPsec UPDATE message (aka valid path signatures) containing just a subset of those prefixes 💀 so if a BGPsec speaker wants to advertise routes to multiple prefixes, it MUST generate a separate BGPsec UPDATE message for each prefix. plus, a BGPsec UPDATE message MUST use the MP_REACH_NLRI attribute [RFC4760] to encode the prefix 🎀
the BGPsec_PATH attribute and the AS_PATH attribute are mutually exclusive, which means any UPDATE message with the BGPsec_PATH attribute MUST NOT contain the AS_PATH attribute 🙅♀️ the info that would've been in AS_PATH gets carried in the Secure_Path portion of the BGPsec_PATH attribute instead 🧚
to create or add a new signature to a BGPsec UPDATE message with a given algorithm suite, the BGPsec speaker MUST have a private key that's suitable for generating signatures for that algorithm suite 🔑 and this private key MUST correspond to the public key in a valid RPKI end entity certificate whose AS number resource extension includes the BGPsec speaker's AS number [RFC8209] 🌸 also, new signatures only get added when the BGPsec speaker is generating an UPDATE to send to an external peer (aka when the peer's AS number isn't equal to the speaker's own AS number) 🫶
heads up: the RPKI lets the legit holder of IP address prefix(es) issue a signed object called a Route Origin Authorization (ROA), which authorizes a given AS to originate routes to a given set of prefixes (see RFC 6482 [RFC6482]) 🔥 it's expected that most Relying Parties (RPs) will use BGPsec together with origin validation (see RFC 6483 [RFC6483] and RFC 6811 [RFC6811]) 💜
so because of that, it is RECOMMENDED that a BGPsec speaker only originate a BGPsec UPDATE message advertising a route for a given prefix if there exists a valid ROA authorizing the speaker's AS to originate routes to that prefix 🦋
if a BGPsec router gets only a non-BGPsec UPDATE message containing the AS_PATH attribute (instead of the BGPsec_PATH attribute) from a peer for a given prefix, then it MUST NOT attach a BGPsec_PATH attribute when it propagates that UPDATE message 🙈 (side note: a BGPsec router might also get a non-BGPsec UPDATE from an internal peer without the AS_PATH attribute, aka just the Network Layer Reachability Information (NLRI). in that case the prefix is originating from that AS, and if it gets selected for advertisement, the BGPsec speaker SHOULD attach a BGPsec_PATH attribute and send a signed route for that prefix to its external BGPsec-speaking peers 🌈)
the other way around: if a BGPsec router gets a BGPsec UPDATE message (with the BGPsec_PATH attribute) from a peer for a given prefix and it chooses to propagate that peer's route for the prefix, then it SHOULD propagate the route as a BGPsec UPDATE message containing the BGPsec_PATH attribute 💖
warning, this one matters a lot 😭 removing BGPsec signatures (aka propagating a route advertisement without the BGPsec_PATH attribute) has significant security ramifications. (see Section 8 for the discussion of those ramifications 💀) so when a route advertisement is received via a BGPsec UPDATE message, propagating it WITHOUT the BGPsec_PATH attribute is NOT RECOMMENDED, unless the message is going to a peer that didn't advertise the capability to receive BGPsec UPDATE messages (see Section 4.4) 🍓
also, when a BGPsec speaker propagates a route advertisement with the BGPsec_PATH attribute, it is NOT attesting to the validation state of the UPDATE message it received. (see Section 8 for more on the security semantics of BGPsec signatures 🔮)
if the BGPsec speaker is producing an UPDATE message that would otherwise contain an AS_SET (like when the speaker is doing proxy aggregation), then the BGPsec speaker MUST NOT include the BGPsec_PATH attribute 🙅♀️ in that case it MUST remove any existing BGPsec_PATH in the received advertisement(s) for this prefix and produce a traditional (non-BGPsec) UPDATE message 🧚 fyi, BCP 172 [RFC6472] recommends against using AS_SET and AS_CONFED_SET in the AS_PATH of BGP UPDATE messages 🎀
the iBGP case (sending a BGPsec UPDATE to an internal BGP peer) is pretty chill 🦋 when a speaker originates a new route advertisement and sends it to a BGPsec-capable iBGP peer, it omits the BGPsec_PATH attribute ✨ when it originates a new route advertisement and sends it to a non-BGPsec iBGP peer, it includes an empty AS_PATH attribute in the UPDATE message (an empty AS_PATH is one whose length field contains the value 0 [RFC4271]) 🌸 when a BGPsec speaker chooses to forward a BGPsec UPDATE to an iBGP peer, the BGPsec_PATH attribute SHOULD NOT be removed, unless that peer doesn't support BGPsec 🫶 if an iBGP peer doesn't support BGPsec, then a BGP UPDATE message with AS_PATH gets rebuilt from the BGPsec UPDATE message and then forwarded (see Section 4.4) 💅 and especially, when forwarding to a BGPsec-capable iBGP (or eBGP) peer, the BGPsec_PATH attribute SHOULD NOT be removed EVEN IF the BGPsec UPDATE message hasn't been successfully validated 😭 (see Section 5 for more on validation and Section 8 for the security ramifications of removing BGPsec signatures 🔥)
all BGPsec UPDATE messages MUST conform to BGP's maximum message size 🌈 if the resulting message goes over the maximum message size, then the guidelines in Section 9.2 of RFC 4271 [RFC4271] MUST be followed ✨
4.2. Constructing the BGPsec_PATH Attribute ✨
Okay bestie, so when a BGPsec speaker gets a BGPsec UPDATE message containing a BGPsec_PATH attribute (with one or more signatures) from an (internal or external) peer, it may choose to pass the route advertisement along to its other (internal or external) peers. 💌 When it sends that route ad to an internal BGPsec-speaking peer, the BGPsec_PATH attribute SHALL NOT be modified. 🙅♀️ When it sends the route ad to an external BGPsec-speaking peer, these steps are used to form or update the BGPsec_PATH attribute.
To make the BGPsec_PATH attribute on the outgoing UPDATE message, the BGPsec speaker first generates a brand-new Secure_Path Segment. 🧩 Note that if the BGPsec speaker is not the origin AS and there is already an existing BGPsec_PATH attribute, the speaker prepends its new Secure_Path Segment (placing it in first position) onto the existing Secure_Path. It's giving "new one goes on the front" energy. 🎀
The AS number in this Secure_Path Segment MUST match the AS number in the Subject field of the RPKI router certificate that will be used to verify the digital signature constructed by this BGPsec speaker (see Section 3.1.1 in [RFC8209] and RFC 6487 [RFC6487]). 📜 This is non-negotiable, so no cap, it's a MUST. 💅
The pCount field of the Secure_Path Segment is typically set to the value 1. 🌸 However, a BGPsec speaker may set the pCount field to a value greater than 1. Setting pCount to a value greater than 1 has the same semantics as repeating an AS number multiple times in the AS_PATH of a non-BGPsec UPDATE message (for example, for traffic engineering purposes). 🚦
To prevent unnecessary processing load when validating BGPsec signatures, a BGPsec speaker SHOULD NOT produce multiple consecutive Secure_Path Segments with the same AS number. 😭 Instead, if you want the semantics of prepending the same AS number k times, a BGPsec speaker SHOULD produce a single Secure_Path Segment -- with a pCount of k -- and a single corresponding Signature Segment. Lowkey the most efficient move ever. 🧠✨
A route server that participates in the BGP control plane but does not act as a transit AS in the data plane may choose to set pCount to 0. 🧚 This lets the route server take part in BGPsec and get the associated security guarantees without making the AS path longer. (Quick note: BGPsec speakers compute the length of the AS path by summing the pCount values in the BGPsec_PATH attribute; see Section 5.) However, when a route server sets pCount to 0, it still inserts its AS number into the Secure_Path Segment, because that info is needed to validate the signature the route server adds. 🔍 See [RFC8206] for a discussion of setting pCount to 0 to facilitate AS Number migration. Also, see Section 4.3 for the use of pCount=0 in the context of an AS confederation. And see Section 7.2 for operational guidance on configuring a BGPsec router to set pCount=0 and/or accept pCount=0 from a peer. 📚🫶
Next, the BGPsec speaker generates one or two Signature_Blocks. 🎁 Typically, a BGPsec speaker will use only a single algorithm suite, so it creates only a single Signature_Block in the BGPsec_PATH attribute. But to keep things backwards compatible during a transition from a 'current' algorithm suite to a 'new' algorithm suite, it will be necessary to originate UPDATE messages that contain a Signature_Block for both the 'current' and the 'new' algorithm suites (see Section 6.1). It's a whole glow-up era. ✨🦋
If the received BGPsec UPDATE message contains two Signature_Blocks and the BGPsec speaker supports both of the corresponding algorithm suites, then the new UPDATE message generated by the BGPsec speaker MUST include both of the Signature_Blocks. 👯 If the received BGPsec UPDATE message contains two Signature_Blocks and the BGPsec speaker only supports one of the two corresponding algorithm suites, then the BGPsec speaker MUST remove the Signature_Block corresponding to the algorithm suite it does not understand. 🗑️ If the BGPsec speaker does not support the algorithm suites in any of the Signature_Blocks contained in the received UPDATE message, then the BGPsec speaker MUST NOT propagate the route advertisement with the BGPsec_PATH attribute. 🚫 (That is, if it chooses to propagate this route advertisement at all, it MUST do so as an unsigned BGP UPDATE message. See Section 4.4 for more information on converting to an unsigned BGP UPDATE message.) ✌️
Note that when the BGPsec_PATH has two Signature_Blocks (corresponding to different algorithm suites), the validation algorithm (see Section 5.2) deems a BGPsec UPDATE message to be 'Valid' if there is at least one supported algorithm suite (and corresponding Signature_Block) that is deemed 'Valid'. 🤔 This means a 'Valid' BGPsec UPDATE message may contain a Signature_Block that is not deemed 'Valid' (for example, one with signatures that BGPsec does not successfully verify). Nonetheless, such Signature_Blocks MUST NOT be removed. 🙈 (See Section 8 for a discussion of the security ramifications of this design choice. It's giving drama, and it's deserved. 💀)
For each Signature_Block corresponding to an algorithm suite that the BGPsec speaker does support, the BGPsec speaker MUST add a new Signature Segment to the Signature_Block. 🖊️ This Signature Segment is prepended to the list of Signature Segments (placed in the first position), so the list of Signature Segments appears in the same order as the corresponding Secure_Path Segments. 🔁 The BGPsec speaker populates the fields of this new Signature Segment as follows.
The Subject Key Identifier field in the new segment is populated with the identifier contained in the Subject Key Identifier extension of the RPKI router certificate corresponding to the BGPsec speaker [RFC8209]. 🔑 Recipients of the route advertisement use this Subject Key Identifier to find the proper certificate for verifying the signature. Main character energy for that certificate. 👑
The Signature field in the new segment contains a digital signature that binds the prefix and BGPsec_PATH attribute to the RPKI router certificate corresponding to the BGPsec speaker. ✍️ The digital signature is computed as follows:
- For clarity, let's number the Secure_Path and corresponding Signature Segments from 1 to N, like so. Let Secure_Path Segment 1 and Signature Segment 1 be the segments produced by the origin AS. Let Secure_Path Segment 2 and Signature Segment 2 be the segments added by the next AS after the origin. Keep going with this numbering, and eventually Secure_Path Segment N and Signature Segment N are the ones being added by the current AS. The current AS (the Nth AS) is signing and forwarding the UPDATE message to the next AS (that is, the (N+1)th AS) in the chain of ASes that form the AS path. 🍓
- To construct the digital signature for Signature Segment N (the Signature Segment being produced by the current AS), first build the sequence of octets to be hashed as shown in Figure 8. This sequence includes all the data that the Nth AS attests to by adding its digital signature in the UPDATE message that gets forwarded to a BGPsec speaker in the (N+1)th AS. (For the design rationale behind the specific structure in Figure 8, please see [Borchert]. 🤓)
+------------------------------------+
| Target AS Number |
+------------------------------------+----\
| Signature Segment : N-1 | \
+------------------------------------+ |
| Secure_Path Segment : N | |
+------------------------------------+ \
... > Data from
+------------------------------------+ / N Segments
| Signature Segment : 1 | |
+------------------------------------+ |
| Secure_Path Segment : 2 | |
+------------------------------------+ /
| Secure_Path Segment : 1 | /
+------------------------------------+---/
| Algorithm Suite Identifier |
+------------------------------------+
| AFI |
+------------------------------------+
| SAFI |
+------------------------------------+
| NLRI |
+------------------------------------+Figure 8: Sequence of Octets to Be Hashed
The elements in this sequence (Figure 8) MUST be ordered exactly as shown. 📐 The 'Target AS Number' is the AS the BGPsec speaker intends to send the UPDATE message to. (Note that the 'Target AS Number' is the AS number announced by the peer in the OPEN message of the BGP session the UPDATE message is sent within.) The Secure_Path and Signature Segments (1 through N-1) come from the BGPsec_PATH attribute. Finally, the Address Family Identifier (AFI), Subsequent Address Family Identifier (SAFI), and NLRI fields are obtained from the MP_REACH_NLRI attribute [RFC4760]. Also, in the Prefix field within the NLRI field (see Section 5 in RFC 4760 [RFC4760]), all of the trailing bits MUST be set to 0 when constructing this sequence. 🫧
- Apply the digest algorithm (for the algorithm suite of this Signature_Block) to this octet sequence (in Figure 8) to get a digest value. 🥣
- Apply the signature algorithm (for the algorithm suite of this Signature_Block) to this digest value to get the digital signature. Then populate the Signature field (in Figure 7) with this digital signature. 💖
The Signature Length field (in Figure 7) is populated with the length (in octets) of the value in the Signature field. 🌈
4.3. Processing Instructions for Confederation Members ✨
Okay so if you're a member of an AS confederation [RFC5065], you MUST additionally follow the instructions in this section when processing BGPsec UPDATE messages. Non-negotiable, bestie 💅
When a BGPsec speaker in an AS confederation gets a BGPsec UPDATE message from a peer outside the confederation and decides to pass it along inside the confederation, it first adds a signature signed for its own Member-AS. The 'Target AS Number' is the speaker's Member-AS Number 🎀. In this internally modified UPDATE message, the newly added Secure_Path Segment holds the public AS number (the Confederation Identifier), its pCount is set to 0, and its Confed_Segment flag is set to 1. Setting pCount=0 here helps make sure the AS path length doesn't get bumped up for no reason 📈. The new signature is generated using a private key that corresponds to the public AS number of the confederation. Then the speaker sends the modified UPDATE to its peers within the confederation 🦋.
Any BGPsec_PATH changes described below for propagating the UPDATE within the confederation are on top of the change above (the one with pCount=0). Layers, bestie 🧁.
When a BGPsec speaker sends a BGPsec UPDATE message to a peer that belongs in its own Member-AS, the confederation member SHALL NOT modify the BGPsec_PATH attribute. Iconic restraint 👑.
When a BGPsec speaker sends a BGPsec UPDATE message to a peer that is in the same confederation but a different Member-AS, the BGPsec speaker puts its Member-AS Number in the AS Number field of the Secure_Path Segment that it adds to the BGPsec UPDATE message. In this case, the Member-AS that generates the Secure_Path Segment also sets the Confed_Segment flag to 1. The signature is generated with a private key that corresponds to the BGPsec speaker's Member-AS Number 🔑.
(Note: In this document, intra-Member-AS peering is regarded as iBGP, and inter-Member-AS peering is regarded as eBGP. The latter is also known as confederation-eBGP. 🌸)
Within a confederation, verifying BGPsec signatures added by other members of the confederation is optional. Note that if a confederation chooses not to verify digital signatures within the confederation, then BGPsec is not able to provide any assurances about the integrity of the Member-AS Numbers placed in Secure_Path Segments where the Confed_Segment flag is set to 1. Lowkey important, so pay attention 🙈.
When a confederation member receives a BGPsec UPDATE message from a peer within the confederation and propagates it to a peer outside the confederation, it needs to remove all of the Secure_Path Segments added by confederation members, as well as the corresponding Signature Segments. To do this, the confederation member propagating the route outside the confederation does the following:
- First, starting with the most recently added
Secure_Path Segment, remove all of the consecutiveSecure_Path Segments that have theConfed_Segmentflag set to1. Stop this process once aSecure_Path Segmentthat has itsConfed_Segmentflag set to0is reached. Keep a count of the number of segments removed in this fashion. 🧹 - Second, starting with the most recently added Signature Segment, remove a number of Signature Segments equal to the number of
Secure_Path Segments removed in the previous step. (That is, remove the K most recently added Signature Segments, where K is the number ofSecure_Path Segments removed in the previous step.) 🧮 - Finally, add a
Secure_Path Segmentcontaining, in the AS field, the AS Confederation Identifier (the public AS number of the confederation), as well as a corresponding Signature Segment. Note that all fields other than the AS field are populated as per Section 4.2. ✨
Finally, as discussed above, an AS confederation MAY optionally decide that its members will not verify digital signatures added by members. In that kind of confederation, when a BGPsec speaker runs the algorithm in Section 5.2, the BGPsec speaker first checks, during signature verification, whether the Confed_Segment flag in a Secure_Path Segment is set to 1. If the flag is set to 1, the BGPsec speaker skips verification for the corresponding signature and immediately moves on to the next Secure_Path Segment 🏃♀️. Note that, as specified in Section 5.2, it is an error when a BGPsec speaker receives a BGPsec UPDATE message containing a Confed_Segment flag set to 1 from a peer who is not in the same AS confederation. Absolutely not, bestie 🚫.
4.4. Reconstructing the AS_PATH Attribute 🧩
BGPsec UPDATE messages do not contain the AS_PATH attribute. However, the AS_PATH attribute can be reconstructed from the BGPsec_PATH attribute. This is needed when a route advertisement is received via a BGPsec UPDATE message and then propagated to a peer via a non-BGPsec UPDATE message (for example, because that peer doesn't support BGPsec 🥺). Note that there may be additional cases where an implementation finds it useful to perform this reconstruction. Before attempting to reconstruct an AS_PATH for the purpose of forwarding an unsigned (non-BGPsec) UPDATE message to a peer, a BGPsec speaker MUST perform the basic integrity checks listed in Section 5.2 to ensure that the received BGPsec UPDATE message is properly formed. Checks first, then vibes 🔍.
The AS_PATH attribute can be constructed from the BGPsec_PATH attribute as follows. Start with a blank AS_PATH attribute, then process the Secure_Path Segments in order, from least recently added (corresponding to the origin) to most recently added. For each Secure_Path Segment, perform the following steps:
- If the
Secure_Path SegmenthaspCount=0, then do nothing (i.e., move on to process the nextSecure_Path Segment). 🫥 - If the
Secure_Path SegmenthaspCountgreater than0and theConfed_Segmentflag is set to1, then look at the most recently added segment in theAS_PATH.- If the
AS_PATHis blank, or the most recently added segment is of typeAS_SEQUENCE, add (prepend to theAS_PATH) a newAS_PATHsegment of typeAS_CONFED_SEQUENCE. This segment of typeAS_CONFED_SEQUENCEshall contain a number of elements equal to thepCountfield in the currentSecure_Path Segment. Each of these elements shall be the AS number contained in the currentSecure_Path Segment. (That is, if thepCountfield isX, then the segment of typeAS_CONFED_SEQUENCEcontainsXcopies of theSecure_Path Segment's AS Number field.) - If the most recently added segment in the
AS_PATHis of typeAS_CONFED_SEQUENCE, then add (prepend to the segment) a number of elements equal to thepCountfield in the currentSecure_Path Segment. The value of each of these elements shall be the AS number contained in the currentSecure_Path Segment. (That is, if thepCountfield isX, then addXcopies of theSecure_Path Segment's AS Number field to the existingAS_CONFED_SEQUENCE.)
- If the
- If the
Secure_Path SegmenthaspCountgreater than0and theConfed_Segmentflag is set to0, then look at the most recently added segment in theAS_PATH.- If the
AS_PATHis blank, or the most recently added segment is of typeAS_CONFED_SEQUENCE, add (prepend to theAS_PATH) a newAS_PATHsegment of typeAS_SEQUENCE. This segment of typeAS_SEQUENCEshall contain a number of elements equal to thepCountfield in the currentSecure_Path Segment. Each of these elements shall be the AS number contained in the currentSecure_Path Segment. (That is, if thepCountfield isX, then the segment of typeAS_SEQUENCEcontainsXcopies of theSecure_Path Segment's AS Number field.) - If the most recently added segment in the
AS_PATHis of typeAS_SEQUENCE, then add (prepend to the segment) a number of elements equal to thepCountfield in the currentSecure_Path Segment. The value of each of these elements shall be the AS number contained in the currentSecure_Path Segment. (That is, if thepCountfield isX, then addXcopies of theSecure_Path Segment's AS Number field to the existingAS_SEQUENCE.)
- If the
As part of the procedure described above, the following additional actions are performed so as not to exceed the size limitations of AS_SEQUENCE and AS_CONFED_SEQUENCE. While adding the next Secure_Path Segment (with its prepends, if any) to the AS_PATH being assembled, if it would cause the AS_SEQUENCE (or AS_CONFED_SEQUENCE) at hand to exceed the limit of 255 AS numbers per segment [RFC4271] [RFC5065], then the BGPsec speaker follows the recommendations in RFC 4271 [RFC4271] and RFC 5065 [RFC5065]: it creates another segment of the same type (AS_SEQUENCE or AS_CONFED_SEQUENCE) and keeps filling that one. Size limits, but make it a whole new segment 🌈.
Finally, one special case of AS_PATH reconstruction is when the BGPsec_PATH attribute is absent. As explained in Section 4.1, when a BGPsec speaker originates a prefix and sends it to a BGPsec-capable iBGP peer, the BGPsec_PATH is not attached. So, when received from a BGPsec-capable iBGP peer, no BGPsec_PATH attribute in a BGPsec UPDATE message is equivalent to an empty AS_PATH [RFC4271]. Empty but make it iconic 🦢💜.
5. Processing a Received BGPsec UPDATE Message ✨
Okay bestie, so when a BGPsec UPDATE message comes in from an external (eBGP) peer, the BGPsec speaker SHOULD validate it 🔍 to check that the path info in the BGPsec_PATH attribute is actually authentic 🔐. Think of it as verifying the receipt is real. Typically, a BGPsec speaker will also want to do origin validation (see RFC 6483 [RFC6483] and RFC 6811 [RFC6811]) on incoming BGPsec UPDATE messages 💅, but that check is totally separate from the one in this section.
Section 5.1 gives you the overview of BGPsec validation 🦋, and Section 5.2 has a specific algorithm for doing it. (Note that an implementation doesn't have to follow the exact Section 5.2 algorithm, as long as its input/output behavior matches the algorithm in Section 5.2 🫶.) During exceptional conditions (e.g., the BGPsec speaker gets an incredibly large number of UPDATE messages all at once 😭), a BGPsec speaker MAY temporarily defer validation of incoming BGPsec UPDATE messages. How deferred messages get treated is a matter of local policy. However, an implementation SHOULD ensure that the deferment of validation and the status of deferred messages is visible to the operator 👑.
The validity of BGPsec UPDATE messages depends on the current RPKI state 🌸. When a BGPsec speaker learns that the RPKI state has changed (e.g., from an RPKI validating cache via the RPKI-Router protocol [RFC8210]), the BGPsec speaker MUST rerun validation on all affected UPDATE messages stored in its Adj-RIB-In [RFC4271]. For example, when a given RPKI router certificate stops being valid (e.g., it expires or gets revoked), all UPDATE messages containing a signature whose SKI matches the SKI in that certificate MUST be reassessed to see if they're still valid. If this reassessment shows that an UPDATE message's validity state has changed, then, depending on local policy, it may be necessary to rerun best path selection 💖.
BGPsec UPDATE messages don't contain an AS_PATH attribute 🙈. The Secure_Path has the AS path info for the BGPsec UPDATE message instead. So a BGPsec speaker MUST utilize the AS path information in the Secure_Path in all cases where it would otherwise use the AS path information in the AS_PATH attribute. The only exception is when AS path info has to be updated to propagate a route to a peer (in which case the BGPsec speaker follows the instructions in Section 4 🎀). Section 4.4 gives an algorithm for building an AS_PATH attribute from a BGPsec_PATH attribute 🧚. Whenever AS path info is needed (e.g., loop detection or using the AS path length in best path selection), the externally visible behavior of the implementation shall be the same as if it had run the algorithm in Section 4.4 and used the resulting AS_PATH attribute as it would for a non-BGPsec UPDATE message 🔥.
5.1. Overview of BGPsec Validation 🦋
Validating a BGPsec UPDATE message uses data from RPKI router certificates 🔑. Specifically, the recipient needs access to the following data from valid RPKI router certificates: the AS Number, Public Key, and Subject Key Identifier from each valid RPKI router certificate.
Note that the BGPsec speaker could do the RPKI router certificate validation itself and pull out the data it needs 💜. Or it could get the same data from a trusted cache that does RPKI validation on behalf of (some set of) BGPsec speakers. (For example, the trusted cache could deliver the necessary validity info to the BGPsec speaker using the Router Key PDU (Protocol Data Unit) for the RPKI-Router protocol [RFC8210].)
To validate a BGPsec UPDATE message containing the BGPsec_PATH attribute, the recipient runs the validation steps in Section 5.2. The result is one of two states: 'Valid' or 'Not Valid' ✅❌.
The validation output is expected to feed into BGP route selection 🌈. That said, route selection, and so how the validation states get handled, is a matter of local policy and is handled through local policy mechanisms. Implementations SHOULD enable operators to set that local policy on a per-session basis 🍓. (So yes, some operators might treat BGPsec validation status differently for UPDATE messages received over different BGP sessions 🙃.)
BGPsec validation only needs to happen at the eBGP edge ✨. The validation status of a BGP signed/unsigned UPDATE message MAY be conveyed via iBGP from an ingress edge router to an egress edge router by some mechanism, according to local policy within an AS. As discussed in Section 4, when a BGPsec speaker chooses to forward a (syntactically correct) BGPsec UPDATE message, it SHOULD be forwarded with its BGPsec_PATH attribute intact (regardless of the validation state of the UPDATE message) 💅. Based entirely on local policy, an egress router receiving a BGPsec UPDATE message from within its own AS MAY choose to perform its own validation 🫶.
5.2. Validation Algorithm 🔍✨
okay so this section lays out a validation algorithm for BGPsec UPDATE messages 💖. A conformant implementation MUST include a BGPsec update validation algorithm that is functionally equivalent to the externally visible behavior of this algorithm. the vibe is "match what's visible from outside," not "copy every internal step" 🫶
First, the recipient of a BGPsec UPDATE message does a check to make sure the message is properly formed 💅. Both syntactical and protocol violation errors get checked. The BGPsec_PATH attribute MUST be present when a BGPsec UPDATE message is received from an external (eBGP) BGPsec peer, and also when such an UPDATE message is propagated to an internal (iBGP) BGPsec peer (see Section 4.2). The error checks specified in Section 6.3 of [RFC4271] are performed, except that for BGPsec UPDATE messages the checks on the AS_PATH attribute do not apply. Instead, the following checks on the BGPsec_PATH attribute are performed:
- Check to ensure that the entire
BGPsec_PATHattribute is syntactically correct (conforms to the specification in this document). 🎀 - Check that the AS number in the most recently added
Secure_PathSegment (i.e., the one corresponding to the eBGP peer from which the UPDATE message was received) matches the AS number of that peer as specified in the BGP OPEN message. (Note: This check is performed only at an ingress BGPsec router where the UPDATE message is first received from a peer AS.) 🦋 - Check that each
Signature_Blockcontains oneSignature Segmentfor eachSecure_Path Segmentin theSecure_Pathportion of theBGPsec_PATHattribute. (Note that the entirety of eachSignature_BlockMUST be checked to ensure that it is well formed, even though the validation process may terminate before all signatures are cryptographically verified.) 🌸 - Check that the UPDATE message does not contain an
AS_PATHattribute. 🙈 - If the UPDATE message was received from a BGPsec peer that is not a member of the BGPsec speaker's AS confederation, check to ensure that none of the
Secure_Path Segmentscontain aFlagsfield with theConfed_Segmentflag set to 1. 🧚 - If the UPDATE message was received from a BGPsec peer that is a member of the BGPsec speaker's AS confederation, check to ensure that the
Secure_Path Segmentcorresponding to that peer contains aFlagsfield with theConfed_Segmentflag set to 1. 🍓 - If the UPDATE message was received from a peer that is not expected to set
pCount=0(see Sections 4.2 and 4.3), then check to ensure that thepCountfield in the most recently addedSecure_Path Segmentis not equal to 0. (Note: See Section 7.2 for router configuration guidance related to this item.) 💜 - Using the equivalent of
AS_PATHcorresponding to theSecure_Pathin the UPDATE message (see Section 4.4), check that the local AS number is not present in the AS path (i.e., rule out an AS loop). 👑
If any of these checks fail, it is an error in the BGPsec_PATH attribute. BGPsec speakers MUST handle any syntactical or protocol errors in the BGPsec_PATH attribute by using the "treat-as-withdraw" approach as defined in RFC 7606 [RFC7606]. (Note: Since the AS number of a transparent route server does appear in the Secure_Path with pCount=0, the route server MAY check to see if its local AS is listed in the Secure_Path, and this check MAY be included in the loop-detection check listed above.) > this is the part where the route server gets a little discretion, so don't skip it 👀
Next, the BGPsec speaker examines the Signature_Blocks in the BGPsec_PATH attribute. A Signature_Block corresponding to an algorithm suite that the BGPsec speaker does not support is not considered in the validation process. If there is no Signature_Block corresponding to an algorithm suite that the BGPsec speaker supports, then in order to consider the UPDATE message in the route selection process, the BGPsec speaker MUST strip the Signature_Block(s), reconstruct the AS_PATH from the Secure_Path (see Section 4.4), and treat the UPDATE message as if it were received as an unsigned BGP UPDATE message. no signature we can use means it gets downgraded to plain BGP, honestly so main character of fallbacks 🌈
For each remaining Signature_Block (corresponding to an algorithm suite supported by the BGPsec speaker), the BGPsec speaker iterates through the Signature Segments in the Signature_Block, starting with the most recently added segment (and concluding with the least recently added segment). Note that there is a one-to-one correspondence between Signature Segments and Secure_Path Segments within the BGPsec_PATH attribute. The following steps make use of this correspondence:
- Step 1: Let there be K AS hops in a received
BGPsec_PATHattribute that is to be validated. LetAS(1), AS(2), ..., AS(K+1)denote the sequence of AS numbers from the origin AS to the validating AS. LetSecure_Path Segment NandSignature Segment Nin theBGPsec_PATHattribute refer to those corresponding toAS(N)(where N = 1, 2, ..., K). The BGPsec speaker that is processing and validating theBGPsec_PATHattribute resides inAS(K+1). LetSignature Segment Nbe theSignature Segmentthat is currently being verified. 🔢 - Step 2: Locate the public key needed to verify the signature (in the current
Signature Segment). To do this, consult the valid RPKI router certificate data and look up all valid (AS Number, Public Key, Subject Key Identifier) triples in which the AS matches the AS number in the correspondingSecure_Path Segment. Of these triples that match the AS number, check whether there is an SKI that matches the value in theSubject Key Identifierfield of theSignature Segment. If this check finds no such matching SKI value, then mark the entireSignature_Blockas 'Not Valid' and proceed to the nextSignature_Block. 🔑 - Step 3: Compute the digest function (for the given algorithm suite) on the appropriate data.
In order to verify the digital signature in Signature Segment N, construct the sequence of octets to be hashed as shown in Figure 9 (using the notations defined in Step 1). (Note that this sequence is the same sequence that was used by AS(N) that created the Signature Segment N (see Section 4.2 and Figure 8).)
+------------------------------------+
| Target AS Number |
+------------------------------------+----\
| Signature Segment : N-1 | \
+------------------------------------+ |
| Secure_Path Segment : N | |
+------------------------------------+ \
... > Data from
+------------------------------------+ / N Segments
| Signature Segment : 1 | |
+------------------------------------+ |
| Secure_Path Segment : 2 | |
+------------------------------------+ /
| Secure_Path Segment : 1 | /
+------------------------------------+---/
| Algorithm Suite Identifier |
+------------------------------------+
| AFI |
+------------------------------------+
| SAFI |
+------------------------------------+
| NLRI |
+------------------------------------+Figure 9: Sequence of Octets to Be Hashed for Signature Verification of Signature Segment N; N = 1,2, ..., K, Where K Is the Number of AS Hops in the BGPsec_PATH Attribute
The elements in this sequence (Figure 9) MUST be ordered exactly as shown. For the first segment to be processed (the most recently added segment (i.e., N = K) given that there are K hops in the Secure_Path), the 'Target AS Number' is AS(K+1), the AS number of the BGPsec speaker validating the UPDATE message. Note that if a BGPsec speaker uses multiple AS Numbers (e.g., the BGPsec speaker is a member of a confederation), the AS number used here MUST be the AS number announced in the OPEN message for the BGP session over which the BGPsec UPDATE message was received.
For each other Signature Segment (N smaller than K), the 'Target AS Number' is AS(N+1), the AS number in the Secure_Path Segment that corresponds to the Signature Segment added immediately after the one being processed (that is, in the Secure_Path Segment that corresponds to the Signature Segment that the validator just finished processing). 🧩
The Secure_Path and Signature Segment are obtained from the BGPsec_PATH attribute. The AFI, SAFI, and NLRI fields are obtained from the MP_REACH_NLRI attribute [RFC4760]. Additionally, in the Prefix field within the NLRI field (see Section 5 in RFC 4760 [RFC4760]), all of the trailing bits MUST be set to 0 when constructing this sequence. the trailing bits are zeroed, no exceptions, babe 🫶
- Step 4: Use the signature validation algorithm (for the given algorithm suite) to verify the signature in the current segment. That is, invoke the signature validation algorithm on the following three inputs: the value of the
Signaturefield in the current segment, the digest value computed in Step 3 above, and the public key obtained from the valid RPKI data in Step 2 above. If the signature validation algorithm determines that the signature is invalid, then mark the entireSignature_Blockas 'Not Valid' and proceed to the nextSignature_Block. If the signature validation algorithm determines that the signature is valid, then continue processingSignature Segments(within the currentSignature_Block). ✅
If all Signature Segments within a Signature_Block pass validation (i.e., all segments are processed and the Signature_Block has not yet been marked 'Not Valid'), then the Signature_Block is marked as 'Valid'.
If at least one Signature_Block is marked as 'Valid', then the validation algorithm terminates and the BGPsec UPDATE message is deemed 'Valid'. (That is, if a BGPsec UPDATE message contains two Signature_Blocks, then the UPDATE message is deemed 'Valid' if the first Signature_Block is marked 'Valid' OR the second Signature_Block is marked 'Valid'.) 🎉
6. Algorithms and Extensibility ✨
6.1. Algorithm Suite Considerations 🎀
Okay bestie, so there's currently no support for bilateral negotiation (using BGP capabilities) between BGPsec peers to pick a particular (digest and signature) algorithm suite 💅. Why? Because the algorithm suite used by the sender of a BGPsec UPDATE message MUST be understood not only by the peer it's sent to directly, but also by every BGPsec speaker that the route advertisement eventually gets propagated to 🌸. So picking a suite can't be a local thing that BGP peers work out between themselves. It has to be coordinated across the whole Internet ✨.
To that end, [RFC8208] specifies a mandatory-to-use 'current' algorithm suite for use by all BGPsec speakers 🔥.
It's anticipated that, in the future, [RFC8208] or its successor will be updated to specify a transition from the 'current' algorithm suite to a 'new' algorithm suite. During the period of transition, all BGPsec UPDATE messages SHOULD simultaneously use both the 'current' algorithm suite and the 'new' algorithm suite. (Note that Sections 3 and 4 specify how the BGPsec_PATH attribute can contain signatures, in parallel, for two algorithm suites.) Once the transition is complete, the use of the old 'current' algorithm will be deprecated, the use of the 'new' algorithm will be mandatory, and a subsequent 'even newer' algorithm suite may be specified as "recommended to implement" 🦋. Once the transition has successfully been completed in this manner, BGPsec speakers SHOULD include only a single Signature_Block (corresponding to the 'new' algorithm) 👑.
6.2. Considerations for the SKI Size 🌈
Depending on the method of generating key identifiers [RFC7093], the size of the SKI in an RPKI router certificate may vary 🧚. The SKI field in the BGPsec_PATH attribute has a fixed size of 20 octets (see Figure 7). If the SKI is longer than 20 octets, then use the leftmost 20 octets of the SKI (excluding the tag and length) [RFC7093]. If the SKI value is shorter than 20 octets, then pad the SKI (excluding the tag and length) to the right (least significant octets) with octets having "0" values 🍓.
6.3. Extensibility Considerations ✨
This section talks about potential changes to BGPsec that would require substantial changes to the processing of the BGPsec_PATH and thus necessitate a new version of BGPsec 🔮. Examples of such changes include:
- A new type of signature algorithm that produces signatures of variable length
- A new type of signature algorithm for which the number of signatures in the Signature_Block is not equal to the number of ASes in the Secure_Path (e.g., aggregate signatures)
- Changes to the data that is protected by the BGPsec signatures (e.g., attributes other than the AS path)
In the case that such a change to BGPsec were deemed desirable, it is expected that a subsequent version of BGPsec would be created and that this version of BGPsec would specify a new BGP path attribute -- let's call it "BGPsec_PATH_Two" -- that is designed to accommodate the desired changes to BGPsec 💜. In such a case, [RFC8208] or its successor would be updated to specify algorithm suites appropriate for the new version of BGPsec.
At this point, a transition would begin that is analogous to the algorithm transition discussed in Section 6.1. During the transition period, all BGPsec speakers SHOULD simultaneously include both the BGPsec_PATH attribute and the new BGPsec_PATH_Two attribute. Once the transition is complete, the use of BGPsec_PATH could then be deprecated, at which point BGPsec speakers should include only the new BGPsec_PATH_Two attribute. Such a process could facilitate a transition to a new BGPsec semantics in a backwards-compatible fashion 🫶.
7. Operations and Management Considerations ✨
Some operations and management issues that are closely relevant to BGPsec protocol specification and deployment are highlighted here 💅. The best practices concerning operations and deployment of BGPsec are provided in [RFC8207].
7.1. Capability Negotiation Failure 😭
Section 2.2 describes the negotiation required to establish a BGPsec-capable peering session. Not only must the BGPsec capability be exchanged (and agreed on), but the BGP multiprotocol extension [RFC4760] for the same AFI and the 4-byte AS capability [RFC6793] MUST also be exchanged. Failure to properly negotiate a BGPsec session -- due to a missing capability, for example -- may still result in the exchange of BGP (unsigned) UPDATE messages. It is RECOMMENDED that an implementation log the failure to properly negotiate a BGPsec session 📝. Also, an implementation MUST have the ability to prevent a BGP session from being established if configured to only use BGPsec 🚫.
7.2. Preventing Misuse of pCount=0 🙈
A peer that is an Internet Exchange Point (IXP) (i.e., route server) with a transparent AS is expected to set pCount=0 in its Secure_Path Segment while forwarding an UPDATE message to a peer (see Section 4.2). Clearly, such an IXP MUST configure its BGPsec router to set pCount=0 in its Secure_Path Segment. This also means that a BGPsec speaker MUST be configured so that it permits pCount=0 from an IXP peer. Two other cases where pCount is set to 0 are in the contexts of an AS confederation (see Section 4.3) and of AS migration [RFC8206]. In these two cases, pCount=0 is set and accepted within the same AS (albeit the AS has two different identities). Note that if a BGPsec speaker does not expect a peer AS to set its pCount=0 and if an UPDATE message received from that peer violates this, then the UPDATE message MUST be considered to be in error (see the list of checks in Section 5.2). See Section 8.4 for a discussion of security considerations concerning pCount=0 🔐.
7.3. Early Termination of Signature Verification ⚡
During the validation of a BGPsec UPDATE message, route processor performance speedup can be achieved by incorporating the following observations. An UPDATE message is deemed 'Valid' if at least one of the Signature_Blocks is marked as 'Valid' (see Section 5.2). Therefore, if an UPDATE message contains two Signature_Blocks and the first one verified is found 'Valid', then the second Signature_Block does not have to be verified. And if the UPDATE message is chosen for best path, then the BGPsec speaker adds its signature (generated with the respective algorithm) to each of the two Signature_Blocks and forwards the UPDATE message. Also, a BGPsec UPDATE message is deemed 'Not Valid' if at least one signature in each of the Signature_Blocks is invalid. This principle can also be used for route processor workload savings, i.e., the verification for a Signature_Block terminates early when the first invalid signature is encountered 🏃♀️.
7.4. Non-deterministic Signature Algorithms 🎲
Many signature algorithms are non-deterministic. That is, many signature algorithms will produce different signatures each time they are run (even when they are signing the same data with the same key) 🌀. Therefore, if a BGPsec router receives a BGPsec UPDATE message from a peer and later receives a second BGPsec UPDATE message from the same peer for the same prefix with the same Secure_Path and SKIs, the second UPDATE message MAY differ from the first UPDATE message in the signature fields (for a non-deterministic signature algorithm). However, the two sets of signature fields will not differ if the sender caches and reuses the previous signature. For a deterministic signature algorithm, the signature fields MUST be identical between the two UPDATE messages. On the basis of these observations, an implementation MAY incorporate optimizations in update validation processing 🧠.
7.5. Private AS Numbers 🕵️♀️
It is possible that a stub customer of an ISP employs a private AS number. Such a stub customer cannot publish a ROA in the Global RPKI for the private AS number and the prefixes that they use. Also, the Global RPKI cannot support private AS numbers (i.e., BGPsec speakers in private ASes cannot be issued router certificates in the Global RPKI). For interactions between the stub customer (with the private AS number) and the ISP, the following two scenarios are possible:
- The stub customer sends an unsigned BGP UPDATE message for a prefix to the ISP's AS. An edge BGPsec speaker in the ISP's AS may choose to propagate the prefix to its non-BGPsec and BGPsec peers. If so, the ISP's edge BGPsec speaker MUST strip the AS_PATH with the private AS number and then (a) re-originate the prefix without any signatures towards its non-BGPsec peer and (b) re-originate the prefix including its own signature towards its BGPsec peer. In both cases (i.e., (a) and (b)), the prefix MUST have a ROA in the Global RPKI authorizing the ISP's AS to originate it.
- The ISP and the stub customer may use a local RPKI repository (using a mechanism such as one of the mechanisms described in [SLURM]). Then, there can be a ROA for the prefix originated by the stub AS, and the eBGP speaker in the stub AS can be a BGPsec speaker having a router certificate, albeit the ROA and router certificate are valid only locally. With this arrangement, the stub AS sends a signed UPDATE message for the prefix to the ISP's AS. An edge BGPsec speaker in the ISP's AS validates the UPDATE message, using RPKI data based on the local RPKI view. Further, it may choose to propagate the prefix to its non-BGPsec and BGPsec peers. If so, the ISP's edge BGPsec speaker MUST strip the Secure_Path and the Signature Segment received from the stub AS with the private AS number and then (a) re-originate the prefix without any signatures towards its non-BGPsec peer and (b) re-originate the prefix including its own signature towards its BGPsec peer. In both cases (i.e., (a) and (b)), the prefix MUST have a ROA in the Global RPKI authorizing the ISP's AS to originate it.
It is possible that private AS numbers are used in an AS confederation [RFC5065]. The BGPsec protocol requires that when a BGPsec UPDATE message propagates through a confederation, each Member-AS that forwards it to a peer Member-AS MUST sign the UPDATE message (see Section 4.3). However, the Global RPKI cannot support private AS numbers. In order for the BGPsec speakers in Member-ASes with private AS numbers to have digital certificates, there MUST be a mechanism in place in the confederation that allows the establishment of a local, customized view of the RPKI, augmenting the Global RPKI repository data as needed. Since this mechanism (for augmenting and maintaining a local image of RPKI data) operates locally within an AS or AS confederation, it need not be standard based. However, a standard-based mechanism can be used (see [SLURM]). Recall that in order to prevent exposure of the internals of AS confederations, a BGPsec speaker exporting to a non-member removes all intra-confederation Secure_Path Segments and Signatures (see Section 4.3) 🌷.
7.6. Robustness Considerations for Accessing RPKI Data ✨
Okay so, the way Global RPKI data gets to routers is kind of a whole glow-up story 🦋 It goes through local RPKI caches, and the setup, technologies, and best practices for that are described in [RFC6810], [RFC8210], [RFC8181], [RFC7115], [RFC8207], and [RFC8182]. For example, Serial-Number-based incremental updates are used so only the data records that changed since the last update get transferred [RFC6810] [RFC8210]. Relying Parties (RPs) use the update notification file to check whether anything has changed between the Global RPKI repository and their cache [RFC8182]. The notification tells them where to find (1) the files with the snapshot and (2) the incremental deltas, which the RP can use to sync up with the repository 💅
Using all of this gives you robustness, efficiency, and better security for BGPsec routers and RPKI caches, bestie, for the whole flow of RPKI data from repositories to caches to routers 🫶 It's believed that with these mechanisms, an attacker wouldn't be able to meaningfully correlate RPKI data flows with BGPsec RP (or router) actions. That helps avoid attacks that try to figure out which ASes are interacting with an RP by watching the interactions between the RP and RPKI servers. Lowkey iconic 🔒
7.7. Graceful Restart ✨
So during Graceful Restart (GR), restarting BGPsec speakers and receiving BGPsec speakers MUST follow the procedures in [RFC4724] for restarting and receiving BGP speakers, respectively 💖 The big parts are keeping the forwarding state for routes in the Loc-RIB [RFC4271] and marking them as stale. Also, not telling stale routing information apart from other information during forwarding. All of that behaves exactly the same as what [RFC4724] specifies 🌸
7.8. Robustness of Secret Random Number in ECDSA ✨
Okay this one is kind of serious, so pay attention 👀 The Elliptic Curve Digital Signature Algorithm (ECDSA) with curve P-256 is used for signing UPDATE messages in BGPsec [RFC8208]. For ECDSA, Section 6.3 of [FIPS186-4] says that a new secret random number "k" shall be generated before each digital signature is generated. A high-entropy random bit generator (RBG) must be used to generate "k", and any potential bias in the "k" generation algorithm must be mitigated (see the methods described in [FIPS186-4] and [SP800-90A]). Not optional, periodt 🔥
7.9. Incremental/Partial Deployment Considerations ✨
What does migrating from BGP to BGPsec actually look like? And what do the first adopters get out of it? 🧚 Initially, small groups of contiguous ASes would be doing BGPsec. There could be one or more of these groups in different geographic regions of the global Internet. Only routes that get originated within each group and propagated inside its borders would get the benefits of cryptographic AS path protection. As BGPsec adoption grows, each group gets bigger, and eventually they join together to form even larger BGPsec-capable groups of contiguous ASes. Early adopters start out with AS path security within the regions of contiguous ASes their groups span, and over time they'd see those regions grow way bigger 📈✨
During partial deployment, if an AS in the path doesn't support BGPsec, then BGP goes back to traditional mode. That means BGPsec UPDATE messages get converted to unsigned UPDATE messages before they're forwarded to that AS (see Section 4.4) 💀 At that point, the assurance that the UPDATE message propagated via the listed sequence of ASes is lost. In other words, for the BGPsec routers in the ASes from the origin AS up to the AS right before the one that doesn't support BGPsec, the assurance can still be provided. But it can't go any further than that (for the UPDATE messages in question) 🥲
8. Security Considerations 🔐
Okay, security time, and this part is important 🫶 For a discussion of the BGPsec threat model and related security considerations, please see RFC 7132 [RFC7132].
8.1. Security Guarantees ✨
When BGPsec is used together with origin validation (see RFC 6483 [RFC6483] and RFC 6811 [RFC6811]), a BGPsec speaker who receives a valid BGPsec UPDATE message containing a route advertisement for a given prefix gets these security guarantees 💖
- The origin AS number corresponds to an AS that the IP address space holder has authorized, in the RPKI, to originate route advertisements for the given prefix.
- For each AS in the path, a BGPsec speaker authorized by the holder of the AS number intentionally chose (in accordance with local policy) to propagate the route advertisement to the next AS in the path.
So basically, the recipient of a valid BGPsec UPDATE message is assured that the UPDATE message propagated via the sequence of ASes listed in the Secure_Path portion of the BGPsec_PATH attribute 🛣️ (Quick reality check, though: BGPsec does not guarantee that data packets will flow along the indicated path. It only guarantees that the BGP UPDATE message carrying the path actually propagated along the indicated path 🙈) The recipient is also assured that this path ends at an AS that the IP address space holder has authorized as a legitimate destination for traffic to the given prefix. Main character energy for real 👑
Now, BGPsec gives an AS a way to check that a received UPDATE message has certain security properties, but whether that check gets used to influence route selection is completely a matter of local policy. So a BGPsec speaker can't make any assumptions about whether a route received from an external (eBGP) BGPsec peer is valid. A compliant BGPsec peer may (depending on the peer's local policy) send UPDATE messages that fail the validity test in Section 5. So a BGPsec speaker MUST completely validate all BGPsec UPDATE messages it receives from external peers 🚨 (Validating UPDATE messages from internal peers is also a matter of local policy; see Section 5.)
8.2. On the Removal of BGPsec Signatures ✨
Sometimes a BGPsec speaker will deem a BGPsec UPDATE message 'Valid' (per the validation algorithm in Section 5.2) even though it contains both a 'Valid' and a 'Not Valid' Signature_Block 🤔 So the UPDATE message has two sets of signatures for two algorithm suites. One set verifies correctly, and the other one fails to verify. In this situation, the protocol says that a BGPsec speaker who chooses to propagate the route advertisement in that UPDATE message MUST add its signature to each of the Signature_Blocks (see Section 4.2). So the speaker signs with both algorithm suites and creates a new UPDATE message containing both the 'Valid' and the 'Not Valid' sets of signatures (from its own vantage point) 💅
Here's why that design makes sense. Imagine the BGPsec speaker gets an UPDATE message with a set of algorithm A signatures that are 'Valid' and a set of algorithm B signatures that are 'Not Valid'. It's possible, maybe even likely depending on where the algorithm transition is, that some of the speaker's peers (or other entities further downstream in the BGP topology) don't support algorithm A. If the speaker removed the 'Not Valid' set of algorithm B signatures, those entities would treat the message as though it were unsigned 😬 By including the 'Not Valid' set when propagating a route advertisement, the BGPsec speaker makes sure downstream entities have as much information as possible to form an informed opinion about the validation status of the BGPsec UPDATE message 🧠✨
Also, during partial BGPsec deployment, a downstream entity might reasonably treat unsigned messages differently from BGPsec UPDATE messages that contain a single set of 'Not Valid' signatures. So if the BGPsec speaker removes the 'Not Valid' set, it might actually cause a downstream entity to 'upgrade' the status of a route advertisement from 'Not Valid' to unsigned 📉 And here's a tricky one: the BGPsec speaker might have deemed algorithm A signatures 'Valid' only because of some issue with the RPKI state local to its AS. For example, its AS might not have obtained yet a Certificate Revocation List (CRL) showing that a key used to verify an algorithm A signature belongs to a newly revoked certificate. In a case like that, it's highly desirable for a downstream entity to treat the UPDATE message as 'Not Valid' (because of the revocation) and not as 'unsigned' (which would happen if the 'Not Valid' Signature_Blocks were removed en route) 🙅♀️
A similar argument applies when a BGPsec speaker (for some reason, such as a lack of viable alternatives) selects as its best path to a given prefix a route it got from a 'Not Valid' BGPsec UPDATE message. In that case, the BGPsec speaker should propagate a signed BGPsec UPDATE message, adding its signature to the 'Not Valid' signatures that already exist. Again, this makes sure downstream entities can make an informed decision and don't mistakenly treat the route as unsigned 🫶 It should also be noted that because RPKI data can differ at different vantage points in the network, a BGPsec UPDATE message deemed 'Not Valid' at an upstream BGPsec speaker may be deemed 'Valid' by another BGP speaker downstream 🌈
Honestly, the key thing to get is this: when a BGPsec speaker signs an outgoing UPDATE message, it is not saying that every signature before its own is valid. It's only asserting that:
- The BGPsec speaker received the given route advertisement with the indicated prefix, AFI, SAFI, and Secure_Path, and
- The BGPsec speaker chose to propagate an advertisement for this route to the peer (implicitly) indicated by the 'Target AS Number'. 🦋
8.3. Mitigation of Denial-of-Service Attacks 🛡️
Okay so bestie, the BGPsec update validation procedure is a juicy target for denial-of-service attacks against a BGPsec speaker 😭. We're going to look at how to mitigate the DoS attacks that are specific to the BGPsec protocol 💅.
To mitigate how well these DoS attacks work, BGPsec speakers SHOULD implement an update validation algorithm that does the expensive checks (like signature verification) after doing the cheaper ones (like syntax checks) 🫶. The validation algorithm in Section 5.2 was picked so that the likely-expensive checks come after the likely-cheap ones ✨. BUT the relative cost of the required validation steps can vary between implementations, so the algorithm in Section 5.2 may not give the best DoS protection for every implementation 🙈.
Also, sending UPDATE messages with super long AS paths (and therefore a huge number of signatures) is another way to try a DoS attack 💀. That's why it's important that an implementation of the validation algorithm MUST stop trying to verify signatures as soon as it finds an invalid one 🔥. (This makes sure that long runs of invalid signatures can't be used for DoS attacks 👑.) Furthermore, implementations can help with these attacks by only validating UPDATE messages that, if valid, would get picked as the best path 🦋. So if an UPDATE message has a route that would lose in best path selection for other reasons (like a very long AS path), then it's not necessary to figure out the BGPsec-validity status of that route 🌸.
8.4. Additional Security Considerations 🔐
Okay this section is so important, bestie 😭. The pCount field being set to 0 is in this spec so route servers in the control path can take part in BGPsec without making the AS path longer 🧚. Two other situations where pCount=0 gets used are AS confederations (see Section 4.3) and AS migration [RFC8206] 🎀. In both of those, pCount=0 is set AND accepted within the same AS (even though the AS has two different identities) 💖.
BUT, entities other than route servers, confederation ASes, or migrating ASes could in theory use this (set pCount to 0) to pull in traffic illegitimately by shortening the AS path 🚨. This risk is mostly handled if every BGPsec speaker follows the operational guidance in Section 7.2 about setting pCount=0 and/or accepting pCount=0 from a peer 🫶. Heads up though: a recipient of a BGPsec UPDATE message where an upstream entity two or more hops away set pCount to 0 cannot verify for themselves whether pCount was set to 0 legitimately 👀.
There's also a possibility of passing a BGPsec UPDATE message through tunneling between colluding ASes 🙈. For example, say AS-X doesn't peer with AS-Y but colludes with AS-Y, and it signs and sends a BGPsec UPDATE message to AS-Y through a tunnel 🦋. AS-Y can then sign it again and propagate it to its peers 😭. Detecting this kind of malicious behavior is beyond the scope of the BGPsec protocol 💀. BGPsec is designed to protect messages sent within BGP (so within the control plane), NOT when the control plane gets bypassed 🚫.
A version of the collusion-by-tunneling thing can happen with AS confederations 🌈. When a BGPsec router (outside of a confederation) forwards an UPDATE message to a Member-AS in the confederation, it signs the UPDATE message to the public AS number of the confederation, NOT to the member's AS number (see Section 4.3) 💅. The Member-AS can tunnel the signed UPDATE message to another Member-AS just as it received it (so, without adding a signature) 🎀. The UPDATE message can then get propagated with BGPsec to other confederation members or to BGPsec neighbors outside of the confederation 🧚. This kind of operation is possible, but no grave security or reachability compromise is feared, and here's why:
- The confederation members belong to one organization, and strong internal trust is expected 🫶.
- Recall that the signatures that are internal to the confederation MUST be removed prior to forwarding the UPDATE message to an outside BGPsec router (see Section 4.3) ✨.
BGPsec does NOT protect against attacks at the transport layer 😭. As with any BGP session, an adversary on the path between a BGPsec speaker and its peer can do things like modifying valid BGPsec UPDATE messages so they fail validation, injecting (unsigned) BGP UPDATE messages without BGPsec_PATH attributes, injecting BGPsec UPDATE messages with BGPsec_PATH attributes that fail validation, or making the peer tear down the BGP session 💀. Using BGPsec doesn't make an on-path adversary any more powerful 💪. Even an on-path adversary CANNOT make a BGPsec speaker believe that a BGPsec-invalid route is valid 🛡️. BUT, as with any BGP session, BGPsec sessions SHOULD be protected by appropriate transport security mechanisms (see the Security Considerations section in [RFC4271]) 🔐.
Now, replay attacks 👻. A replay attack, as defined here, is when a malicious BGPsec speaker in the AS path suppresses a prefix withdrawal (implicit or explicit) 😱. A replay attack also happens when a malicious BGPsec speaker replays a previously received BGPsec announcement for a prefix that has since been withdrawn 🙀. The mitigation strategy for replay attacks involves router certificate rollover, so check [ROLLOVER] for the details 🔁.
- IANA Considerations 📋
IANA registered a new BGP capability described in Section 2.1 in the "Capability Codes" registry's "IETF Review" range [RFC8126] 🎀. The description for the new capability is "BGPsec Capability" ✨. This document is the reference for the new capability 💖.
IANA also registered a new path attribute described in Section 3 in the "BGP Path Attributes" registry 🌸. The code for this new attribute is "BGPsec_PATH" 🦋. This document is the reference for the new attribute 🫶.
IANA defined the "BGPsec Capability" registry in the "Resource Public Key Infrastructure (RPKI)" group 🔑. The registry looks like Figure 10, with values assigned from Section 2.1 👑:
+------+------------------------------------+------------+
| Bits | Field | Reference |
+------+------------------------------------+------------+
| 0-3 | Version | [RFC8205] |
| | Value = 0x0 | |
+------+------------------------------------+------------+
| 4 | Direction | [RFC8205] |
| |(Both possible values 0 and 1 are | |
| | fully specified by this RFC) | |
+------+------------------------------------+------------+
| 5-7 | Unassigned | [RFC8205] |
| | Value = 000 (in binary) | |
+------+------------------------------------+------------+
Figure 10: IANA Registry for BGPsec CapabilityThe Direction bit (fourth bit) has a value of either 0 or 1, and BOTH values are fully specified by this document 🧚. Future Version values and future values of the Unassigned bits are assigned using the "Standards Action" registration procedures defined in RFC 8126 [RFC8126] 💅.
IANA defined the "BGPsec_PATH Flags" registry in the "Resource Public Key Infrastructure (RPKI)" group 🌈. The registry looks like Figure 11, with one value assigned from Section 3.1 ✨:
+------+-------------------------------------------+------------+
| Flag | Description | Reference |
+------+-------------------------------------------+------------+
| 0 | Confed_Segment | [RFC8205] |
| | Bit value = 1 means Flag set | |
| | (indicates Confed_Segment) | |
| | Bit value = 0 is default | |
+------+-------------------------------------------+------------+
| 1-7 | Unassigned | [RFC8205] |
| | Value: All 7 bits set to zero | |
+------+-------------------------------------------+------------+
Figure 11: IANA Registry for BGPsec_PATH Flags FieldFuture values of the Unassigned bits are assigned using the "Standards Action" registration procedures defined in RFC 8126 [RFC8126] 🫶.
- References 📚
10.1. Normative References ✨
okay bestie, this is the reading list 📚💅 these are the docs this spec leans on the hardest, so keep them open in another tab while you read 🔖
[IANA-AF]: IANA, "Address Family Numbers", <https://www.iana.org/assignments/address-family-numbers>.[RFC2119]: Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>.[RFC4271]: Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border Gateway Protocol 4 (BGP-4)", RFC 4271, DOI 10.17487/RFC4271, January 2006, <https://www.rfc-editor.org/info/rfc4271>.[RFC4724]: Sangli, S., Chen, E., Fernando, R., Scudder, J., and Y. Rekhter, "Graceful Restart Mechanism for BGP", RFC 4724, DOI 10.17487/RFC4724, January 2007, <https://www.rfc-editor.org/info/rfc4724>.[RFC4760]: Bates, T., Chandra, R., Katz, D., and Y. Rekhter, "Multiprotocol Extensions for BGP-4", RFC 4760, DOI 10.17487/RFC4760, January 2007, <https://www.rfc-editor.org/info/rfc4760>.[RFC5065]: Traina, P., McPherson, D., and J. Scudder, "Autonomous System Confederations for BGP", RFC 5065, DOI 10.17487/RFC5065, August 2007, <https://www.rfc-editor.org/info/rfc5065>.[RFC5492]: Scudder, J. and R. Chandra, "Capabilities Advertisement with BGP-4", RFC 5492, DOI 10.17487/RFC5492, February 2009, <https://www.rfc-editor.org/info/rfc5492>.[RFC6482]: Lepinski, M., Kent, S., and D. Kong, "A Profile for Route Origin Authorizations (ROAs)", RFC 6482, DOI 10.17487/RFC6482, February 2012, <https://www.rfc-editor.org/info/rfc6482>.[RFC6487]: Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, DOI 10.17487/RFC6487, February 2012, <https://www.rfc-editor.org/info/rfc6487>.[RFC6793]: Vohra, Q. and E. Chen, "BGP Support for Four-Octet Autonomous System (AS) Number Space", RFC 6793, DOI 10.17487/RFC6793, December 2012, <https://www.rfc-editor.org/info/rfc6793>.[RFC7606]: Chen, E., Ed., Scudder, J., Ed., Mohapatra, P., and K. Patel, "Revised Error Handling for BGP UPDATE Messages", RFC 7606, DOI 10.17487/RFC7606, August 2015, <https://www.rfc-editor.org/info/rfc7606>.[RFC8126]: Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10.17487/RFC8126, June 2017, <https://www.rfc-editor.org/info/rfc8126>.[RFC8174]: Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>.[RFC8208]: Turner, S. and O. Borchert, "BGPsec Algorithms, Key Formats, and Signature Formats", RFC 8208, DOI 10.17487/RFC8208, September 2017, <https://www.rfc-editor.org/info/rfc8208>.[RFC8209]: Reynolds, M., Turner, S., and S. Kent, "A Profile for BGPsec Router Certificates, Certificate Revocation Lists, and Certification Requests", RFC 8209, DOI 10.17487/RFC8209, September 2017, <https://www.rfc-editor.org/info/rfc8209>.
10.2. Informative References 🦋
these ones are the extra-credit reading 🧚 they give you background and context without being the core rules
[Borchert]: Borchert, O. and M. Baer, "Subject: Modification request: draft-ietf-sidr-bgpsec-protocol-14", message to the IETF SIDR WG Mailing List, 10 February 2016, <https://mailarchive.ietf.org/arch/msg/sidr/8B_e4CNxQCUKeZ_AUzsdnn2f5Mu>.[FIPS186-4]: National Institute of Standards and Technology, "Digital Signature Standard (DSS)", NIST FIPS Publication 186-4, DOI 10.6028/NIST.FIPS.186-4, July 2013, <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf>.[RFC6472]: Kumari, W. and K. Sriram, "Recommendation for Not Using AS_SET and AS_CONFED_SET in BGP", BCP 172, RFC 6472, DOI 10.17487/RFC6472, December 2011, <https://www.rfc-editor.org/info/rfc6472>.[RFC6480]: Lepinski, M. and S. Kent, "An Infrastructure to Support Secure Internet Routing", RFC 6480, DOI 10.17487/RFC6480, February 2012, <https://www.rfc-editor.org/info/rfc6480>.[RFC6483]: Huston, G. and G. Michaelson, "Validation of Route Origination Using the Resource Certificate Public Key Infrastructure (PKI) and Route Origin Authorizations (ROAs)", RFC 6483, DOI 10.17487/RFC6483, February 2012, <https://www.rfc-editor.org/info/rfc6483>.[RFC6810]: Bush, R. and R. Austein, "The Resource Public Key Infrastructure (RPKI) to Router Protocol", RFC 6810, DOI 10.17487/RFC6810, January 2013, <https://www.rfc-editor.org/info/rfc6810>.[RFC6811]: Mohapatra, P., Scudder, J., Ward, D., Bush, R., and R. Austein, "BGP Prefix Origin Validation", RFC 6811, DOI 10.17487/RFC6811, January 2013, <https://www.rfc-editor.org/info/rfc6811>.[RFC7093]: Turner, S., Kent, S., and J. Manger, "Additional Methods for Generating Key Identifiers Values", RFC 7093, DOI 10.17487/RFC7093, December 2013, <https://www.rfc-editor.org/info/rfc7093>.[RFC7115]: Bush, R., "Origin Validation Operation Based on the Resource Public Key Infrastructure (RPKI)", BCP 185, RFC 7115, DOI 10.17487/RFC7115, January 2014, <https://www.rfc-editor.org/info/rfc7115>.[RFC7132]: Kent, S. and A. Chi, "Threat Model for BGP Path Security", RFC 7132, DOI 10.17487/RFC7132, February 2014, <https://www.rfc-editor.org/info/rfc7132>.[RFC8181]: Weiler, S., Sonalker, A., and R. Austein, "A Publication Protocol for the Resource Public Key Infrastructure (RPKI)", July 2017, <https://www.rfc-editor.org/info/rfc8181>.[RFC8182]: Bruijnzeels, T., Muravskiy, O., Weber, B., and R. Austein, "The RPKI Repository Delta Protocol (RRDP)", RFC 8182, DOI 10.17487/RFC8182, July 2017, <https://www.rfc-editor.org/info/rfc8182>.[RFC8206]: George, W. and S. Murphy, "BGPsec Considerations for Autonomous System (AS) Migration", RFC 8206, DOI 10.17487/RFC8206, September 2017, <https://www.rfc-editor.org/info/rfc8206>.[RFC8207]: Bush, R., "BGPsec Operational Considerations", BCP 211, RFC 8207, DOI 10.17487/RFC8207, September 2017, <https://www.rfc-editor.org/info/rfc8207>.[RFC8210]: Bush, R. and R. Austein, "The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 1", RFC 8210, DOI 10.17487/RFC8210, September 2017, <https://www.rfc-editor.org/info/rfc8210>.[ROLLOVER]: Weis, B., Gagliano, R., and K. Patel, "BGPsec Router Certificate Rollover", Work in Progress, draft-ietf-sidrops-bgpsec-rollover-01, August 2017.[SLURM]: Mandelberg, D., Ma, D., and T. Bruijnzeels, "Simplified Local internet nUmber Resource Management with the RPKI", Work in Progress, draft-ietf-sidr-slurm-04, March 2017.[SP800-90A]: National Institute of Standards and Technology, "Recommendation for Random Number Generation Using Deterministic Random Bit Generators", NIST SP 800-90A Rev 1, DOI 10.6028/NIST.SP.800-90Ar1, June 2015, <http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf>.
Acknowledgements 🙌
the authors gave a massive shoutout to everyone who reviewed, commented on, and suggested stuff while they were building this 🫶 thank you to Michael Baer, Oliver Borchert, David Mandelberg, Mehmet Adalier, Sean Turner, Wes George, Jeff Haas, Alvaro Retana, Nevil Brownlee, Matthias Waehlisch, Tim Polk, Russ Mundy, Wes Hardaker, Sharon Goldberg, Ed Kern, Doug Maughan, Pradosh Mohapatra, Mark Reynolds, Heather Schiller, Jason Schiller, Ruediger Volk, and David Ward 💖 and a huge thanks to the many IESG reviewers whose comments made the clarity, accuracy, and presentation way better ✨
the authors especially wanted to call out Oliver Borchert and Michael Baer 👑 for their review and suggestions [Borchert] about the sequence of octets to be hashed (Figures 8 and 9 in Sections 4.2 and 5.2, respectively). their implementation experience made that a seriously important contribution 🔥
Contributors 💜
these people made significant contributions to this document and should be treated as co-authors 🌈
Rob Austein
Dragon Research Labs
Email: sra@hactrn.net
Steven Bellovin
Columbia University
Email: smb@cs.columbia.edu
Russ Housley
Vigil Security
Email: housley@vigilsec.com
Stephen Kent
BBN Technologies
Email: kent@alum.mit.edu
Warren Kumari
Google
Email: warren@kumari.net
Doug Montgomery
USA National Institute of Standards and Technology
Email: dougm@nist.gov
Chris Morrow
Google, Inc.
Email: morrowc@google.com
Sandy Murphy
SPARTA, Inc., a Parsons Company
Email: sandy@tislabs.com
Keyur Patel
Arrcus
Email: keyur@arrcus.com
John Scudder
Juniper Networks
Email: jgs@juniper.net
Samuel Weiler
W3C/MIT
Email: weiler@csail.mit.eduAuthors' Addresses 🎀
the editors you'll want to find if you have questions 🧚
Matthew Lepinski (editor)
New College of Florida
5800 Bay Shore Road
Sarasota, FL 34243
United States of America
Email: mlepinski@ncf.edu
Kotikalapudi Sriram (editor)
USA National Institute of Standards and Technology
100 Bureau Drive
Gaithersburg, MD 20899
United States of America
Email: kotikalapudi.sriram@nist.gov📦 where this page comes from
- ietf: rfc8205 2017-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms