Resource Public Key Infrastructure (RPKI), also known as Resource Certification, is a specialized

public key infrastructure A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to facilit ...

(PKI) framework to support improved security for the

Internet The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...

BGP Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the Internet. BGP is classified as a path-vector routing protocol, and it mak ...

routing Routing is the process of selecting a path for traffic in a network or between or across multiple networks. Broadly, routing is performed in many types of networks, including circuit-switched networks, such as the public switched telephone netw ...

infrastructure. RPKI provides a way to connect Internet number resource information (such as Autonomous System numbers and

IP address An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...

es) to a

trust anchor In cryptographic systems with hierarchical structure, a trust anchor is an authoritative entity for which trust is assumed and not derived. In the X.509 architecture, a root certificate would be the trust anchor from which the whole chain of trus ...

. The certificate structure mirrors the way in which Internet number resources are distributed. That is, resources are initially distributed by the

IANA The Internet Assigned Numbers Authority (IANA) is a standards organization that oversees global IP address allocation, autonomous system number allocation, root zone management in the Domain Name System (DNS), media types, and other Interne ...

to the

regional Internet registries A regional Internet registry (RIR) is an organization that manages the allocation and registration of Internet number resources within a region of the world. Internet number resources include IP addresses and autonomous system (AS) numbers. ...

(RIRs), who in turn distribute them to

local Internet registries A regional Internet registry (RIR) is an organization that manages the allocation and registration of Internet number resources within a region of the world. Internet number resources include IP addresses and autonomous system (AS) numbers. ...

(LIRs), who then distribute the resources to their customers. RPKI can be used by the legitimate holders of the resources to control the operation of Internet

routing protocol A routing protocol specifies how routers communicate with each other to distribute information that enables them to select routes between nodes on a computer network. Routers perform the traffic directing functions on the Internet; data packets ...

s to prevent route hijacking and other attacks. In particular, RPKI is used to secure the

Border Gateway Protocol Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the Internet. BGP is classified as a path-vector routing protocol, and it makes ...

(BGP) through BGP Route Origin Validation (ROV), as well as

Neighbor Discovery Protocol The Neighbor Discovery Protocol (NDP), or simply Neighbor Discovery (ND), is a protocol of the Internet protocol suite used with Internet Protocol Version 6 (IPv6). It operates at the link layer of the Internet model, and is responsible for gat ...

(ND) for

IPv6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communication protocol, communications protocol that provides an identification and location system for computers on networks and routes traffic ...

through the

Secure Neighbor Discovery The Secure Neighbor Discovery (SEND) protocol is a security extension of the Neighbor Discovery Protocol (NDP) in IPv6 defined in RFC 3971 and updated by RFC 6494. The Neighbor Discovery Protocol (NDP) is responsible in IPv6 for discovery of othe ...

protocol (SEND). The RPKI architecture is documented in RFC 6480. The RPKI specification is documented in a spread out series of RFCs: RFC 6481, RFC 6482, RFC 6483, RFC 6484, RFC 6485, RFC 6486, RFC 6487, RFC 6488, RFC 6489, RFC 6490, RFC 6491, RFC 6492, and RFC 6493. SEND is documented in RFC 6494 and RFC 6495. These RFCs are a product of the

IETF The Internet Engineering Task Force (IETF) is a standards organization for the Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster or requirements and a ...

's SIDR ("Secure Inter-Domain Routing") working group, and are based on a threat analysis which was documented in RFC 4593. These standards cover BGP origin validation, while path validation is provided by BGPsec, which has been standardized separately in RFC 8205. Several implementations for prefix origin validation already exist.

Resource Certificates and child objects

RPKI uses

X.509 In cryptography, X.509 is an International Telecommunication Union (ITU) standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS, the secu ...

PKI certificates (RFC 5280) with extensions for IP addresses and AS identifiers (RFC 3779). It allows the members of

, known as

(LIRs), to obtain a resource certificate listing the Internet number resources they hold. This offers them validatable proof of holdership, though the certificate does not contain identity information. Using the resource certificate, LIRs can create cryptographic attestations about the route announcements they authorise to be made with the prefixes they hold. These attestations, called Route Origination Authorizations (ROAs), are described below.

Route Origination Authorizations

A ''Route Origination Authorization'' (ROA) states which autonomous system (AS) is authorised to originate certain IP prefixes. In addition, it can determine the maximum length of the prefix that the AS is authorised to advertise.

Maximum prefix length

The maximum prefix length is an optional field. When not defined, the AS is only authorised to advertise exactly the prefix specified. Any more specific announcement of the prefix will be considered invalid. This is a way to enforce aggregation and prevent hijacking through the announcement of a more specific prefix. When present, this specifies the length of the most specific IP prefix that the AS is authorised to advertise. For example, if the IP address prefix is and the maximum length is 22, the AS is authorised to advertise any prefix under , as long as it is no more specific than . So, in this example, the AS would be authorised to advertise , or , but not .

RPKI route announcement validity

When a ROA is created for a certain combination of origin AS and prefix, this will have an effect on the RPKI validity of one or more route announcements. They can be: * VALID ** The route announcement is covered by at least one ROA * INVALID ** The prefix is announced from an unauthorised AS. This means: *** There is a ROA for this prefix for another AS, but no ROA authorising this AS; or *** This could be a hijacking attempt ** The announcement is more specific than is allowed by the maximum length set in a ROA that matches the prefix and AS * UNKNOWN ** The prefix in this announcement is not covered (or only partially covered) by an existing ROA Note that invalid BGP updates may also be due to incorrectly configured ROAs.

Management

There are open source tools available to run the certificate authority and manage the resource certificate and child objects such as ROAs. In addition, the RIRs have a hosted RPKI platform available in their member portals. This allows LIRs to choose to rely on a hosted system, or run their own software.

Publication

The system does not use a single repository publication point to publish RPKI objects. Instead, the RPKI repository system consists of multiple distributed and delegated repository publication points. Each repository publication point is associated with one or more RPKI certificates' publication points. In practice this means that when running a certificate authority, an LIR can either publish all cryptographic material themselves, or they can rely on a third party for publication. When an LIR chooses to use the hosted system provided by the RIR, in principle publication is done in the RIR repository.

Validation

Relying party software will fetch, cache, and validate repository data using

rsync rsync is a utility for efficiently transferring and synchronizing files between a computer and a storage drive and across networked computers by comparing the modification times and sizes of files. It is commonly found on Unix-like operat ...

or the RPKI Repository Delta Protocol (RFC 8182). It is important for a relying party to regularly synchronize with all the publication points to maintain a complete and timely view of repository data. Incomplete or stale data can lead to erroneous routing decisions.

Routing decisions

After validation of ROAs, the attestations can be compared to BGP routing and aid network operators in their decision making process. This can be done manually, but the validated prefix origin data can also be sent to a supported router using the RPKI to Router Protocol (RFC 6810),

Cisco Systems Cisco Systems, Inc., commonly known as Cisco, is an American-based multinational corporation, multinational digital communications technology conglomerate (company), conglomerate corporation headquartered in San Jose, California. Cisco develo ...

offers native support on many platforms for fetching the RPKI data set and using it in the router configuration. Juniper offers support on all platforms that run version 12.2 or newer.

Quagga The quagga ( or ) (''Equus quagga quagga'') is a subspecies of the plains zebra that was endemic to South Africa until it was hunted to extinction in the late 19th century. It was long thought to be a distinct species, but early genetic ...

obtains this functionality through BGP Secure Routing Extensions (BGP-SRx) or a RPKI implementation fully RFC-compliant based on RTRlib. The RTRlib provides an open source C implementation of the RTR protocol and prefix origin verification. The library is useful for developers of routing software but also for network operators.M. Wählisch, F. Holler, T.C. Schmidt, J.H. Schiller: "RTRlib: An Open-Source Library in C for RPKI-based Prefix Origin Validation, ''Proc. of USENIX Security Workshop CSET'13'', Berkeley, CA, USA:USENIX Assoc., 2013. Developers can integrate the RTRlib into the BGP daemon to extend their implementation towards RPKI. Network operators may use the RTRlib to develop monitoring tools (e.g., to check the proper operation of caches or to evaluate their performance). RFC 6494 updates the certificate validation method of the

protocol (SEND) security mechanisms for

(ND) to use RPKI for use in IPv6. It defines a SEND certificate profile utilizing a modified RFC 6487 RPKI certificate profile which must include a single RFC 3779 IP address delegation extension.

References

{{Reflist

External links

Tool provided by Cloudflare to test if ISP is doing RPKI validation

Tool by Cloudflare to explore RPKI

Open source RPKI Documentation

IETF Journal - Securing BGP and SIDR

An open source implementation of the complete set of RPKI protocols and tools

RTRlib - Open source RPKI-Router Client C Library

NLnet Labs open source RPKI tools developed in Rust

Quagga RPKI implementation

BGP-SrX - Quagga router implementation of RPKI-based Origin and Path validation.

RPKI-Monitor - Global and regional monitoring and analysis of RPKI deployment and use.

RPKI Deployment statistics for all RIRs

Global ROA deployment heatmap

EuroTransit GmbH RPKI Testbed

BGPMON - Validating BGP announcement with RPKI

An APNIC primer on RPKI

RIPE NCC Resource Certification (RPKI) information

LACNIC RPKI Information

ARIN RPKI Information

NRO statement on RPKI

Internet Architecture Board statement on RPKI

* ttps://web.archive.org/web/20120206105421/http://www.ir.bbn.com/sbgp/IEEE-JSAC-April2000/IEEE-JSAC-S-BGP.html Secure Border Gateway Protocol (Secure-BGP)
RPKI Router Implementation Report
Public-key cryptography Routing protocols Internet architecture