Das Ist Das Protokoll Fürs Internet Routing: A Summary of the 38C3 Talk
0:00:16 Introduction: The talk, originally given 17 years ago, focuses on the "ancient" yet still relevant internet protocol and its use in routing security.
0:01:57 H Protocol Basics: The protocol is text-based, runs over TCP/IP port 43, and queries DNS and internet number databases (like those maintained by the RIPE NCC).
0:05:28 RIPE NCC vs. RIPE: RIPE NCC is one of five Regional Internet Registries (RIRs) that allocates IP addresses and ASNs. RIPE is the community of network operators in the region served by the RIPE NCC (Europe, the Middle East, and parts of Central Asia).
0:07:59 Balancing Transparency and Security: The RIPE database stores network information, including contact details, and is designed to be open and transparent. This creates challenges for maintaining security.
0:08:16 Object Creation and Authentication: Anyone can create objects in the database, but they must be protected using maintainer objects. Authentication methods include PGP and crypt-pw (MD5, to be phased out).
0:09:41 Security Concerns: The talk highlights potential security issues with older authentication methods, particularly in databases outside the RIPE NCC's control.
0:11:09 BGP Routing Security: BGP (Border Gateway Protocol) relies on trust between networks. The RIPE database helps verify routing information, but misconfigurations or malicious actions can disrupt traffic.
0:13:59 Preventing Routing Issues: Registering correct prefixes in the Routing Registry allows networks to filter BGP announcements and prevent the acceptance of incorrect or malicious routes.
0:15:55 Other Uses of the Routing Registry: Beyond security, the registry can be used to define customer relationships, implement traffic engineering, and reflect political or economic considerations.
0:16:39 Routing Policy Specification Language (RPSL): A specialized language for defining complex routing policies, allowing for interoperability between different router manufacturers.
0:17:27 Tools and Resources: Various open-source tools exist to work with the Routing Registry data, including tools to generate router configurations.
0:25:34 Community Involvement: The speakers emphasize the importance of community participation in maintaining routing security, encouraging network operators to keep their data accurate and software developers to improve the tools.
0:28:54 RPKI as a Newer Solution: Resource Public Key Infrastructure (RPKI) is introduced as a more modern approach to routing security, using digital certificates to validate routing information.
0:31:13 RPKI vs. RPSL: RPKI uses a hierarchical certificate-based system, while RPSL is text-based. Both systems have advantages and limitations, and using them together is recommended.
0:35:00 Future of Routing Security: RPKI is still under development, with ongoing work to improve its ability to handle different types of attacks.
0:36:22 Voluntary Cooperation: The talk stresses that routing security relies on voluntary cooperation among network operators and transparency.
0:45:45 Q&A: The Q&A session addresses various topics, including the possibility of enforcing RPKI usage, the handling of legacy address space, and the challenges of maintaining data accuracy in a distributed system.
0:46:31 RPKI and X.509 Certificates: Clarifies that RPKI uses X.509 certificates, but the trust model is different from DNS, and there are no national root certificates in the RIPE region.
0:48:57 Monitoring and Validation: RIPE NCC monitors for misconfigurations and provides tools for network operators to validate routing information, but ultimately, operators are responsible for securing their own networks.
0:52:44 Topology Discovery: Discusses the possibility of using the public routing data to build a topology of the internet, but also acknowledges the limitations of this approach due to incomplete or inaccurate data.