- Security-wg - mailman.ripe.net

Call for Presentation – RIPE 91 Security WG
by Markus de Brün 13 Aug '25

13 Aug '25

Dear colleagues, It might still seem far away, but RIPE 91 in Bucharest is approaching. Our Security Working Group session is currently scheduled for Tuesday, 21 October 2025 at 16:00. From RIPE 91 onwards, all plenary and working group proposals can be submitted through the same system, Pretalx. Please submit your proposals by 15 September 2025 via: https://pretalx.ripe.net/ripe91/cfp When submitting, please keep in mind: - Talk type: This field is not relevant for our WG – you may simply choose “Talk”. - Track: Please select "Security WG". - Duration: Indicate the total time you will need, including Q&A. More information on how to submit a talk can be found here: https://ripe91.ripe.net/present/how-to-submit-a-talk/ If you have questions about potential topics or the session in general, feel free to reach us at security-wg-chairs(a)ripe.net. As usual, both in-person and remote participation in the working group will be possible. We look forward to your submissions. Best regards, Brian, Tobias, Markus

2 1

Source Address Validation (SAV) Deployment and Operational Practices
by Scaglione, Nicholas 07 Aug '25

07 Aug '25

Friends: uRPF and similar SAV techniques have been around for long, with new variants recently/being standardized by the IETF (EFP-uRPF, BAR-SAV). We have done simulations to evaluate the impacts of these variants. To improve our research, we set up a short, quick survey for network managers and administrators of ASNs. In this study, we want to understand the deployment challenges, operational considerations, adoption trends and operator concerns in this area. It would be amazing if you could respond to the survey, available in: https://forms.gle/3rRtCTa2xk217tyd6 We really appreciate your help. The form also contains an option to leave your email for us to send you our research results (paper, simulations, survey). Thanks a lot!! ----------------------------------- Nicholas Scaglione Ph.D. Student School of Computing [UConn Wordmark]

1 0

European Commission informal Expert Group for a Technology Roadmap on Encryption
by Romain Bosc 08 Jul '25

08 Jul '25

Colleagues, As you may know, the European Commission is setting up an informal "Expert Group for a Technology Roadmap on Encryption" -- deadline is September 1. The Commission is looking for technical profiles coming from either the public or private sectors with expertise in cyber security, encryption and decryption, crime investigation, forensics, telecoms, big data and AI, data protection, etc. This is an important one because the group will advise the Commission on the implementation of current legislation but also in the preparation of new legislative and policy initiatives. Find more information including the 'Terms of Reference' and 'Call for Applications' at: https://ec.europa.eu/transparency/expert-groups-register/screen/expert-grou… All best Romain -- Romain Bosc Sr Public Policy & Governance Officer RIPE NCC E: rbosc(a)ripe.net

1 0

Recent Emails
by Brian Nisbet 16 May '25

16 May '25

Colleagues, Recently there have been some very off topic and repeated emails to the group from someone who was previously removed from the Anti-Abuse WG Mailing List for repeated unacceptable behaviour. After the first email we put them into moderation and they chose to deal with this by subscribing a new address and sending the same email. The Co-Chairs will be reinforcing the ban as it did not carry over. And temporarily we have put a moderation hold on subscribing to the mailing list, but hopefully we won't need that for too long. If you have any questions about this, please ask, but we won't be going back over the reasons for the ban in the first place. Thank you, Brian Co-Chair, RIPE Security WG Brian Nisbet (he/him) Head of Service Operations HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Second post in NANOG
by elad＠afri.holdings 15 May '25

15 May '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I kindly bring my following linked second post in NANOG to the attention of the RIPE community: https://lists.nanog.org/archives/list/nanog@lists.nanog.org/thread/25GSIL2G… Kind Regards, Elad -----BEGIN PGP SIGNATURE----- Version: ProtonMail wrsEARYKAG0FgmgmRrAJkAOTxlTETyIURRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmeZxuCF42Y5ghWDY5XQRJjuBySZLBeyUbp675aY 082juRYhBIDKpTRODxrUC0u8qAOTxlTETyIUAACEDAD/ZxfZbIlbmMjFnUIY JeNLrfiZKdNWGsD/GSPQD3MRJ+4A/2q0GW9M1xTxWs56/6sGdZ6mWRcDxL7B nMMhpJ39bdMF =Dp/s -----END PGP SIGNATURE-----

1 0

Post in NANOG
by info＠netstyle.io 14 May '25

14 May '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I kindly bring my following linked post in NANOG to the attention of the RIPE community: https://lists.nanog.org/archives/list/nanog@lists.nanog.org/thread/25GSIL2G… Kind Regards, Elad -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsG5BAEBCgBtBYJoJHNXCZCAS+uEnipSW0UUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3JncpnCjtqDqw3hbUjc7g60Fq6RVx3RVpzEjxXI SYw6lvwWIQTD50Y2bI5NSOj/nnWAS+uEnipSWwAADCgP/RxcnOV09msZ7CPk jbJ8n6BKACQmOwzdTiqbU/cETyUj9ur868arK6iqVpt7U/MfmZ3ZF6LuIjs1 kz/8I69KewMpmKnsgu7v1yXlEY0WXubRix3KXoQsNFXm835SK2jgr7+rzyzU wzcYq8wlYRnfwAG4uyztEM76kmjl9Dql3q2E5UCk1hpLwPFOUjQmFwKYQKjx 7v9q2AKI+C24v15DwuubyT++FGMsAL9GQI9mJZ5S4wTaCmNj0Ma3/AFLnFbI +3ER5aiaGcbg8xVJHEHPXSbEJOxk3cjJxVm3fH44UOS7KZxdtA76/Jovfqqn 0uoB6HvRYhD66mU1GsQEGE2/HjAuYTSQYECOxcfTImtWelnqpg5N0y3Uyt9a v3LiskpP1Pw+xtoZK0ZqSGAB5SqROEFaGny3U5zALS4xI6T4Wqm4b2SgXwFx pFY1OnO/uA8iigHBNN85VcjXc1Vi3BX1rTGZil/JVkpoSZPP23Q90fvvp27p +7BQcpnmD7g/NyjCfjmylHG2Wx/rBBIPv8Q40aHfAy3EqDjMq6RZnNtWK1Iw miSAq+hfSiVhXL5wwMeZH8x7zS5sb8WbSU1fDViey3HpC5qUJU/wa31l2rnh /DqpINvlJ6XIzcXbdEWFV9kDGLkQvdiu7/PD88WDuWjoVvJepTeCiFc/siGc ConMBcs4 =kDGD -----END PGP SIGNATURE-----

1 0

Fwd: [comms-circle] [ripe-list] RIPE NCC Trust Portal Launched
by Dick Leaning 14 May '25

14 May '25

Morning - As I mentioned in my presentation yesterday during the security WG session at RIPE 90 - am keen to get feedback from the working group on how we can make sure the Trust Portal - Law enforcement and competent Authority section, is meaningful. What is missing for example - what materials, documents do we need to add, should there be a FAQ’s etc Any ideas/suggestions, can you please email me direclty dleaning(a)ripe.net <mailto:dleaning@ripe.net> Kind Regards Dick > Begin forwarded message: > > From: Eleonora Petridou <epetridou(a)ripe.net> > Subject: [comms-circle] [ripe-list] RIPE NCC Trust Portal Launched > Date: 8 May 2025 at 12:19:03 GMT+1 > To: ripe-list(a)ripe.net > > Dear colleagues, > > We have launched a new Trust Portal to provide greater transparency into our operations and to help members and stakeholders better understand how we manage our security, compliance, and governance: > https://trust.ripe.net/ > > The portal provides a comprehensive overview of how we protect the confidentiality, integrity, and availability of our services. It includes key policies and processes covering information security, data protection, vulnerability management, and incident response. It also highlights our compliance with frameworks like SOC 2 for RPKI services, our progress toward ISO 27001 certification, and adherence to GDPR and other relevant EU regulations. > > For law enforcement and other competent authorities, the Trust Portal also provides guidance on how to request information from the RIPE NCC, and links to other useful supporting information. > > We invite you to explore the Trust Portal, and welcome any feedback as we continue improving our transparency. Email security(a)ripe.net <mailto:security@ripe.net> if you would like to know more. > > Kind regards, > > Eleonora Petridou > Chief Information Security Officer > RIPE NCC > > ----- > To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ > As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. > More details at: https://www.ripe.net/membership/mail/mailman-3-migration/

1 0

Fw: [ripe-list] RIPE NCC Trust Portal Launched
by Brian Nisbet 08 May '25

08 May '25

Folks, In case there are people here who aren't on the RIPE List, I wanted to ensure you were aware of the launch of the NCC Trust Portal. Brian Brian Nisbet (he/him) Head of Service Operations HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________ From: Eleonora Petridou <epetridou(a)ripe.net> Sent: Thursday 8 May 2025 12:19 To: ripe-list(a)ripe.net <ripe-list(a)ripe.net> Subject: [ripe-list] RIPE NCC Trust Portal Launched CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Dear colleagues, We have launched a new Trust Portal to provide greater transparency into our operations and to help members and stakeholders better understand how we manage our security, compliance, and governance: https://trust.ripe.net/ The portal provides a comprehensive overview of how we protect the confidentiality, integrity, and availability of our services. It includes key policies and processes covering information security, data protection, vulnerability management, and incident response. It also highlights our compliance with frameworks like SOC 2 for RPKI services, our progress toward ISO 27001 certification, and adherence to GDPR and other relevant EU regulations. For law enforcement and other competent authorities, the Trust Portal also provides guidance on how to request information from the RIPE NCC, and links to other useful supporting information. We invite you to explore the Trust Portal, and welcome any feedback as we continue improving our transparency. Email security(a)ripe.net<mailto:security@ripe.net> if you would like to know more. Kind regards, Eleonora Petridou Chief Information Security Officer RIPE NCC

1 0

Fancy testing an email authentication protocol? Fix-forwarding
by Alessandro Vesely 02 May '25

02 May '25

Hi all, bear with me for a quick recap, please (or skip to the next paragraph.) SPF arose around 2000 and became popular within a few years. However, SPF breaks forwarding. So, as an authentication alternative, DomainKeys came along, which became DKIM in 2007. However, DKIM lacks a policy. It merely permits a domain "to claim some responsibility for a message". Policy discussions began in 2007 with DKIM Sender Signing Practices (SSP), which became ADSP in 2008, was published in 2009 and became historic in 2013. DMARC started in 2012, non-standard publication is in 2015, standard publication is expected later this year, after 11+ years of IETF discussion. However, DMARC breaks mailing lists. To address "the issues with indirect mail flows", the DMARC WG came up with the ARC protocol, 2019, a flop. A new protocol, codenamed DKIM2, is taking shape at the IETF now. It is intended to solve not only the mailing list problem, but also DKIM replay and the backscatter generated by provisionally accepted messages that are then bounced. However, DKIM2 is unlikely to become widespread quickly, in part because of the changes it requires at the SMTP level. The reason why ARC has not bee successful is that it isn't clear how to distinguish a legitimate forwarder from a malicious one, both of which ARC-seal. In fact, an attacker can produce an ARC set that is the last one after a chain composed of any domains she wants. IMHO, the only solution is to ask the recipient, for each forwarded flow, including mailing lists, whether it is wanted. I drafted a protocol for this, but I didn't have a chance to discuss it in the DMARC WG because, after years, it closed in a hurry. Other WGs or the ISE are not inclined to consider proposals that no one has implemented yet. So I'm looking for aspiring pioneers for this protocol (or at least figure out what would be wrong with it.) https://datatracker.ietf.org/doc/html/draft-vesely-fix-forwarding Fancy? Best Ale --

1 0

Abusive ASN
by Eric Schechter 29 Apr '25

29 Apr '25

Hello, there is a cloud provider with RIPE ASNs that is hosting all kinds of abusive content from port scanning to malware and doesnt respond to any abuse emails, they have been outed but pretend they are innocent I'm currently being port scanned by pfcloud.io IPs and they havent responded to a single abuse report in months can anything be done about this malicious host? https://x.com/pfcloudio/status/1877064925262012466

3 2