Podcast
Root Causes 327: What Is Multi-perspective Domain Validation? (MPIC)


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
August 18, 2023
In this episode we explain Border Gateway Protocol (BGP) attacks and how multi-perspective domain validation (MPDV, also known as multi-vantage point domain validation - MPIC) can defeat them.
Podcast Transcript
Lightly edited for flow and brevity.
So Jason, BGP, which stands for Border Gateway Protocol, what is BGP attack?
Well, don't forget, the internet is decentralized. And so the off ramps, the analogy to the off ramps on the internet to get to your location as you're traveling down the intertubes, well, those exit signs are decentralized, and there is no state authority to be able to determine exit here in order to get to this particular IP address, as an example. And so BGP is the routing protocol that provides the directions. We could get into real technical mumbo jumbo here, but part of the reasoning that you need BGP is because of the scalability of the internet. If you think of the analogy of the highway, well, not too many new highways are built on a daily basis, but think about how many new routes on the internet are created on a daily basis? A ton.
So BGP is a way to be able to quickly create signage. I'll stick with that analogy. Quickly be able to create that signage so that the intention is to allow the Internet to grow and to change and be very dynamic, so that all the routings can be figured out and announced to one another in nearly real time, which is an incredible achievement of human intellect that I think we should all be very proud of. The internet really is an amazing invention. However, however, think like a bad guy for a moment.
It also is not really as yet built into any of our real standards. So there's no requirement from CA/Browser forum, or ETSI, or any of the major root programs that DCV be conducted this way. If public CAs are doing DCV, multi-vantage DCV or not, they are doing it without talking about it. So we can't say the degree to which this is actually used in the real world today, but my money is mostly not used if I had had to make a prediction.
And so one of the other things that we've seen as this has started to show up as a topic of conversation and again, we're not at the point where there's a ballot looming or anything like that, but we're seeing this being discussed in places like those standards bodies. We're seeing it being discussed on places like MSDP. We're seeing it being discussed by people like root programs and public CAs and so I feel like this is the direction the wind is blowing, and I predict that we're going to hear more about this topic and that somewhere down the road, this is going to become first an accepted standard and then eventually a hard requirement. And I do think that's the direction that these things are going.

