2 Jul
2020
2 Jul
'20
8:51 p.m.
[written by two ARDC Board members kc claffy and John Gilmore]
Along with all the other activities Phil mentioned in his mail, the
ARDC board is talking about RPKI, catalyzed by the mailing list thread
last month. Although John (W0GNU) sent some of his personal thoughts
to the list, he emphasized that he was not communicating a Board position.
As others noted in the thread, it is a complicated issue that admits no
easy solution. There are unknown but presumably small amounts of BGP
hijacking that occur in the wild. (Well, it doesn't matter how small the
amount is if it's your prefix..) Current systems diagnose these mistakes
after they occur; RPKI is an attempt to stop them before they occur.
But it isn't clear to everyone that having that solution, in the political
and litigious economies in which it is embeded, is better than having
the problem it's trying to solve.
Some incorrect assumptions have appeared on this thread, most importantly
regarding the status of the AMPRnet address space, which is, without a
doubt, legacy IP address space. This status has implications for trying
to integrate into an RPKI system that is "rooted" in 5 roots run by RIRs
that don't (always) trust each other. The idea of establishing a new
independent RPKI Trust Anchor is -- as Job points out -- not something
that has much precedent. A comparison to the web's PKI does not lend
confidence in the trustworthiness of the ecosystem. Any organization
that operated a new Trust Anchor would also be subject to tremendous
liability. ARIN's response to that is tremendous indemnification (denying
its RPKI users the right to successfully sue them), even in a hypothetical
situation when ARIN were judged to be clearly at fault. This self-defensive
behavior, plus some policy problems, are limiting RPKI uptake in the
ARIN region. (For data geeks: https://rpki-monitor.antd.nist.gov/ )
Further complicating the issue, ARIN and the other RIRs decided to use
routing certification as a wedge to require legacy users to sign contracts
that both financially support the RIRs (maintaining high integrity
databases is not cheap), and increase the RIRs' control over the legacy
users' address space. At a deeper level, we recognize the architectural
(not to mention sociopolitical) concerns John raised regarding inserting
centralized cryptographic chokepoint(s) into the truly distributed BGP
protocol. Questions we have heard in the debate, which we assume many
amateur radio operators are sympathetic to, include: Who'll watch the
watchers when they control the ability to block or allow users to be
part of the routable Internet? And who will be able to effectively
protest the RIRs' mistakes or overreaches when they can forcibly take
anyone who disagrees with them off the Internet?
We recognize the importance, magnitude, and sociotechnical depth of the
problem. We admit that at this time we do not see a clear path forward
that the whole AMPRnet community would stand behind. Since our mission
is focused on network research, experimentation, and education, we would
welcome one or more serious proposals in the area of BGP routing security.
Approaches that do not require a hierarchical root of trust would be
most consistent with the nature of our mission and the distributed nature
of the Internet. Solutions that expose ARDC to the liability that ARIN
has tried so diligently to avoid are much less likely to be adopted. We
are also aware that routing security is a decades-old problem, and IETF
working groups have argued over solutions for many years without resolution.
We understand that RPKI as currently deployed is a compromise that has
grown out of this history of tension and debate.
Besides trying to solve the routing security problem for the world, we
would also welcome ideas about merely solving it for 44net. If someone
(or two) is inclined to (co)chair a working group on this topic, we could
support workshops (virtual for now) to discuss AMPRnet-specific measures.
https://www.ampr.org/giving/
kc and jg,
on behalf of ARDC Board