F26-SC: Yes
Rationale
SCION hop fields authenticate ingress/egress interface choices and expiry. The v0.12.0 router process path checks expiry, ingress and the current hop MAC before egress dispatch. Invalid authority therefore stops normal forwarding to the selected onward link. This is native base-SCION path authorization, sufficient for the local-transit boundary in F26.
Assessment method
Pinned source ordering and native admission-boundary analysis; no execution
Source context
SCION v0.12.0 router/dataplane.go: process, verifyCurrentMAC, validateHopExpiry and processEgress
Outstanding qualification
Path authority is not individual source or destination-service authorization. Base-SCION hop authenticators are reusable by a party that obtains them; this Yes does not establish protection against a flood using a valid path. Ingress UDP/IP bandwidth and MAC-checking work are already consumed, and an invalid packet can trigger SCMP slow-path processing. No EPIC, COLIBRI, bandwidth reservation or added policing is credited. Source mapping is not an executed deployment or benchmark.
Public sources
- https://raw.githubusercontent.com/scionproto/scion/v0.12.0/router/dataplane.go
- https://docs.scion.org/en/latest/protocols/scion-header.html
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round447-sources.json
- round447.html