The whois protocol for internet routing policy, or how plaintext retrieved over TCP/43 ends up in router configurations (38c3)

Chaos Computer Club - recent events feed (low quality)

Whois is one of the historic internet protocols. There are two types of whois databases on the Internet: domain names, and internet numbers (IP addresses, autonomous system numbers). In this talk, we introduce the history of the whois databases for Internet numbers and explain how they are used (and what is ongoing to replace this way of accessing this information). Spoiler: yes, people still use MD5 to authenticate updates, and still put policy derived from data retrieved over unauthenticated protocols in their router configurations. Whois is one of the older protocols still in use on the Internet, playing a critical role in managing and distributing information about domain names and Internet numbers, such as IP addresses and autonomous system numbers (ASNs). This talk focuses on using whois for internet routing information, aka as an internet routing registry. It's well known that BGP is a trust-based protocol for distributing internet routes. When network operators configure a BGP link with a peer [another network], they often want to restrict the routes accepted from that peer; A small customer is very unlikely to be the upstream network of a hyperscaler. But how do you gather information about what prefixes and networks are likely announced by that network? The session will start by exploring what whois databases contain ("RPLS - Routing Policy Specification Language"), and how they have a role as a database for internet routing registry (IRR) information. We explain the various (authoritative and non-authoritative) IRR databases and how they differ. We then continue by describing the routing policy present in these databases. After introducing the information present, we will explain how this policy is applied to routers... as well as the surprisingly fragile aspects of this mechanism (unauthenticated retrieval channels, updates via email with plaintext passwords). Finally, we introduce the more modern alternatives under development; not only for access to the same IRR information (Registration Data Access Protocol) but also the Routing Public Key Infrastructure, that is currently actively being deployed. We will gloss over the RPKI architecture, and explain that it stores part of the information available in the IRR (and how policy from this distributed system is fed into routers), including the trade-off (centralisation). Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/the-whois-protocol-for-internet-routing-policy-or-how-plaintext-retrieved-over-tcp-43-ends-up-in-router-configurations/