YD/T 4964-2024
BGPsec Technical Requirements BGPsec Protocol (English Version)

Standard No.

YD/T 4964-2024

Language

Chinese, Available in English version

Release Date

2024

Published By

Professional Standard - Post and Telecommunication  CN  /  YD

Latest

YD/T 4964-2024

Introduction

Analysis of BGPsec Core Security Mechanism

BGPsec achieves three major security guarantees through digital signature chain:

Security dimension	Traditional BGP	BGPsec enhancement
Path verification	No encryption verification	Each AS generates ECDSA signature
Source authorization	Depends on IP prefix announcement	Requires matching RPKI's ROA authorization
Anti-tampering	AS_PATH can be forged	Secure_Path is protected by hashing

---

Key technology implementation of the protocol

1. BGPsec_PATH attribute structure

Contains two core components:

• Secure Path: records AS path information, each segment contains a 4-byte AS number, pCount repeat count and Confed_Segment alliance identifier
• Signature Block: stores elliptic curve signatures (default P-256 curve), each signature segment contains a 20-byte SKI and a variable-length signature value

Typical application scenario example

When AS64500 announces the route to AS64501:

1. Hash the (prefix + target AS number + path history) using the RPKI certificate private key
2. Generate ECDSA signature and encapsulate it into Signature Segment
3. Combine Secure Path segment and signature segment to form BGPsec_PATH attribute

---

In-depth analysis of verification algorithm

The receiver verification process adopts reverse chain verification:

Steps	Operation	Failure handling
1	Check syntax structure and AS number continuity	Immediately discard malformed messages
2	Query certificate public key from RPKI cache	Mark as "invalid" status
3	Verify the validity of the signature hop by hop	Terminate the current signature block verification

---

Deployment Implementation Recommendations

1. Incremental Deployment Strategy

• Transition period: Maintain both the old and new algorithm signature blocks (RFC 8208 regulations)
• Confederation network: Configure Confed_Segment flag processing rules
• Routing server: Set pCount=0 to avoid path expansion

2. Key points of operation and maintenance

1. Ensure that the RPKI cache synchronization cycle is ≤1 hour
2. Monitor the success rate of Signature Block verification
3. Configure pCount processing rules during AS migration

---

Comparative analysis of security enhancements

Attack Type	Traditional BGP	BGPsec Protection
Route Hijacking	High Risk	Need to break through ECDSA signature
Path Shortening	Common	pCount=0 requires explicit configuration
Replay Attack	Undetectable	Defense through Nonce Mechanism

YD/T 4964-2024 history

• 2024 YD/T 4964-2024 BGPsec Technical Requirements BGPsec Protocol

Standard and Specification