Das Ist Whois: A Deep Dive into Internet Routing and Security
0:00:16 Introduction: The talk introduces the concept of Whois, an ancient but still relevant internet protocol used for querying domain names and internet number databases.
0:01:53 The Whois Protocol: It is a simple, text-based protocol running over TCP/IP port 43, used to query DNS and internet number databases (domains and IP addresses/autonomous systems).
0:05:28 Historical Context and RIPE NCC: The talk explains the role of RIPE NCC as one of the five Regional Internet Registries (RIRs) responsible for issuing IP addresses and managing a Whois database.
0:06:37 RIPE Community: RIPE is a community of network operators older than RIPE NCC, defining policies for the European region (broadly defined).
0:07:49 Transparency and Security: The importance of uniqueness, transparency, and open access to IP address allocation data is highlighted, along with the challenge of balancing this with security.
0:08:06 Whois Database Objects: Everyone can create objects in the database, but they need to be protected using maintainer objects with authentication data (PGP or password).
0:09:41 Authentication Methods: The talk discusses different authentication methods, some of which are outdated (e.g., MD5, publicly available until 2011). RIPE NCC's portal also offers web-based single sign-on.
0:10:54 BGP Security: The talk emphasizes that network operators rely on Whois databases to secure their BGP routing, which is crucial for connecting networks globally.
0:11:21 BGP Overview: Each network has a unique Autonomous System Number (ASN). Networks announce their IP prefixes to each other, and trust is essential for proper routing.
0:12:28 Importance of Trust: While personal relationships within the community play a role, the Whois database provides a way to verify information when operators don't know each other.
0:13:11 Risks of Misinformation: Incorrect or malicious information in BGP announcements can disrupt connectivity for large parts of the internet.
0:14:40 Routing Security with Whois: Registering correct prefixes in the Routing Registry allows others to filter out incorrect or malicious BGP announcements, improving routing security.
0:15:55 Other Reasons for Editing Lists: Besides identifying legitimate address space users, lists can be used for managing customer relationships, implementing censorship, or traffic engineering for political/economic reasons.
0:16:34 Routing Policy: The database can represent routing policies, and tools exist to translate them into manufacturer-specific router configurations.
0:17:20 Filtering Bogons and Other Addresses: Certain prefixes (bogons, special-use addresses) should always be filtered out.
0:18:10 Route Objects: The talk explains how route objects in the database show the origin of a route and who is authorized to create them (owners of address space and ASN).
0:19:07 AS Objects: Larger, more complex objects containing routing policies that specify accepted prefixes and other information.
0:19:46 Routing Policy Specification Language (RPSL): A meta-language for describing routing policies, with tools to convert them into router configurations.
0:20:57 AS-Set Objects: A shorthand way to represent lists of IP prefixes recursively, simplifying the process of managing complex routing policies.
0:22:32 Tool Example: The talk mentions a tool that combines data from multiple Routing Registries (RIPE, NTT, RADB) and generates prefix lists for filtering.
0:25:13 Call to Action: The speakers encourage the hacker community to help improve BGP security by cleaning up data (if they are network operators) or contributing to the development of tools.
0:25:59 Community Involvement: The talk highlights opportunities to get involved in the RIPE community through meetings, fellowships, and hackathons.
0:28:54 RPKI as a Newer Solution: Resource Public Key Infrastructure (RPKI) is introduced as a more modern approach to route security, using digital certificates to validate routing information.
0:29:27 RPKI Overview: It involves a chain of trust where RIRs sign resources, and users confirm the security.
0:30:37 Comparison of RPSL and RPKI: RPKI uses a hierarchical distribution of IP addresses with X.509 certificates, providing stronger security than the text-based RPSL.
0:31:44 Benefits of RPKI: It leads to fewer routing errors and reduces the impact of misconfigurations or attacks.
0:32:58 RPKI vs. DNSSEC: The talk clarifies that RPKI and DNSSEC are different systems with different underlying technologies, although the communities may have some overlap.
0:33:58 Using Both RPSL and RPKI: The best approach is to use both systems, as RPKI cannot fully replace all the functionalities of RPSL.
0:34:49 Future Developments: Further developments are ongoing, particularly in authentication path validation.
0:35:51 Importance of Widespread Adoption: The speakers emphasize that the more people use RPKI, the more secure the internet becomes.
0:36:22 Balancing Security and Openness: The talk acknowledges the tension between network operators' desire for autonomy and the need for security measures, highlighting the importance of voluntary cooperation and community involvement.
0:37:44 Impossibility of Forcing RPKI Adoption: There is no central authority to enforce its use, but the community encourages it.
0:38:49 Gradual Improvement: The system is constantly being improved through community efforts and the development of new tools.
0:40:23 Using Delegated RPKI: The speakers encourage operators to run their own Certificate Authorities (CAs) for their prefixes to gain more control and decentralize the system.
0:41:34 Impact of Forcing Validation: If all routes were RPKI-validated, switching it on would have a negligible impact, as misconfigurations have been gradually cleaned up over time.
0:42:44 Timeline for Legacy to Hierarchical Data Networks: No specific timeline exists, but the community is encouraged to switch to the new system.
0:43:28 Name Collisions: Different databases may have name collisions, and tools should prioritize databases with correct entries.
0:44:43 RIPE NCC's Role: As an association under Dutch law, RIPE NCC listens to its community and can implement changes based on their feedback.
0:46:43 X.509 Certificate and Trust Anchor: The root certificate is defined by the RIRs, and there are no national root certificates in the RIPE region, ensuring a degree of independence from government control.
0:48:57 Monitoring and Misconfigurations: RIPE NCC monitors for unassigned prefixes appearing on the internet, and various tools exist for operators to monitor their networks.
0:51:39 Self-Correcting Dynamic: The BGP community has a self-correcting dynamic where errors are often detected and addressed through communication between operators.
0:52:37 Building a Topology of the Entire Network: It is possible to build a graph of network connections based on public routing policies, and tools exist to simulate traffic flow.