Internet 2 Routing Working Group Merit Route Registry

Internet 2 Routing Working Group Merit Route Registry Update July 30, 2002 Larry Blunk

Agenda Introductions I 2 RR Status IRRd Update RADB Status RPSL Issues (RPSLng/Authorization) Web interface for Registry Timelines Web interface demo Questions Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

Introductions - Merit staff Merit route registry staff Deb Evans - project manager Engineers Larry Blunk - lead engineer Jake Khuon - lead architect Not present - Dale Fay, Chris Frazier University of Michigan NOC provides 24 x 7 frontline support Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

I 2 RR Status I 2 RR introduced in September 2000 Web page at www. radb. net/i 2 rr Has not been actively embraced by Internet 2 community Merit staff departures in 2000/2001 led to lack of responsiveness Has restaffed project over the last 12 months Merit would like to get clarity regarding the role of the I 2 RR in the Internet 2 community. Merit believes the service is important, but needs to understand Internet 2's commitment to using it going forward Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

IRRd Update Reviewed state of code in June 2001 Initial goals Fix memory leaks and other significant bugs (zombie processes) Portability enhancements Targeted Linux and Free. BSD in addition to Solaris Code clean-up (compiler warnings, etc. ) RFC 2622 RPSL compliance Mandatory attributes and parsing correctness Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

IRRd Update. . . Initial goals cont'd. . . Documentation updates Support for Gnu. PG Performance issues IRRd 2. 1 released in September 2001 Several releases since (now at 2. 1. 4) Next release to support inverse lookups on maintainer names and performance improvements Available at www. irrd. net Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RADB Status RPSL compliance has been addressed Objects missing mandatory attributes Attributes with invalid values Orphaned objects cleaned up Maintainers deleted, but objects remain in the database with mnt-by referring to maintainer Approximately 1600 paid maintainers Around 3000 maintainers at start of year Source of stale data (defunct/acquired companies) New maintainers continue to be added daily Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RADB Consistency RADB consistency checks currently an ongoing project Route objects with prefixes which have been aggregated, announced by another AS, unrouted Announced prefixes not registered in RADB Aut-num objects with import/export policy which does not match observed policy in annouced prefixes (for example, AS PATH) Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RADB Consistency Analysis Recent analysis of route object consistency with global routing tables 75530 route objects - compare prefix/origin. AS 50. 8% exact or less specific prefix/match AS 35. 8% exact or less specific prefix/different AS 13. 4% no match (exact or less specific prefix) Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

Registry Maintainer reports Developing per maintainer reports Details number and type of objects Consistency with observed routing policy Route object prefix/origin. AS correctness Aut-num policy compared with AS Path info Provide an optional monthly email report as well as web based reports Allow maintainers to easily correct discrepancies Working with RIPC NCC to coordinate development efforts on consistency checking tools Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RPSLng Ipv 6/Multicast support not defined in RFC 2622 RPSLng task force formed to address issue Mailing list - rpslng@ripe. net Archive - www. ripe. net/ripe/mail-archives/rpslng Internet Draft submitted by Florent Parent in January (draft -parent-multiprotocol-rpsl-00. txt) Draft addresses the following classes: route, route-set, peering-set, aut-num, inet-rtr, filter-set Attempted to extend the syntax of existing attributes rather than creating new attribute names Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RPSLng. . . There was considerable concern that simply extending attributes may break existing tools Informal meeting held at March 2002 IETF Consensus reached on RPSLng attributes Will create new attribute names to avoid breaking tools Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RPSLng examples Example of new route object for IPv 6 mp-route: afi ipv 6 3 ffe: ffff: : /28 origin: AS 1 Example of aut-num object aut-num: AS 2 mp-import: afi ipv 6. unicast from AS 1 accept {3 FFE: FFFF: : /35}; Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RPSL Authentication security PGP is currently strongest mechanism MAIL-FROM is very weak due to ease of mail spoofing Confirmation messages provides some assurance CRYPT-PW suffers from short password support (8 characters) and dictionary attack vulnerability Email submission of RPSL objects protected by CRYPT -PW requires sending cleartext password Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

RPSL Authentication updates RIPE 41 meeting addressed current weaknesses in RPSL authentication RIPE to phase out support of MAIL-FROM New password-based auth mechanism based on Free. BSD's MD 5 -CRYPT Allows passwords much longer than 8 characters and more dictionary attack resistent Merit to move to Web-based form with SSL encryption and phase-out of MAIL-FROM Considering hiding password hashes to prevent dictionary attacks Will continue to support PGP for mail based updates Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

Registry Web interface Augment existing mail update process with a web based interface Provides a more intuitive interface (particularly for new users unfamiliar with email based submissions) Security improvement for maintainers with password based authentication (SSL encryption instead of cleartext in email) Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002

Timelines Web interface to be completed by August 31 RPSLng to be discussed at RIPE 43 meeting in early September and should be finalized by end of September Merit targeting RPSLng implementation by the end of October Consistency checking tools being coordinated with RIPE. Ongoing effort with initial maintainer reports to be available in November Merit Route Registry Update Internet 2 Routing Working Group July 30, 2002