Origin Validation Operation Based on the Resource Public Key Infrastructure (RPKI)
RFC 7115

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23

Internet Engineering Task Force (IETF)                           R. Bush
Request for Comments: 7115                     Internet Initiative Japan
BCP: 185                                                    January 2014
Category: Best Current Practice
ISSN: 2070-1721

                      Origin Validation Operation
         Based on the Resource Public Key Infrastructure (RPKI)

Abstract

   Deployment of BGP origin validation that is based on the Resource
   Public Key Infrastructure (RPKI) has many operational considerations.
   This document attempts to collect and present those that are most
   critical.  It is expected to evolve as RPKI-based origin validation
   continues to be deployed and the dynamics are better understood.

Status of This Memo

   This memo documents an Internet Best Current Practice.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It has been approved for publication by the Internet
   Engineering Steering Group (IESG).  Further information on BCPs is
   available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7115.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Bush                      Best Current Practice                 [Page 1]
RFC 7115             RPKI-Based Origin Validation Op        January 2014

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Requirements Language . . . . . . . . . . . . . . . . . .   3
   2.  Suggested Reading . . . . . . . . . . . . . . . . . . . . . .   3
   3.  RPKI Distribution and Maintenance . . . . . . . . . . . . . .   3
   4.  Within a Network  . . . . . . . . . . . . . . . . . . . . . .   6
   5.  Routing Policy  . . . . . . . . . . . . . . . . . . . . . . .   6
   6.  Notes and Recommendations . . . . . . . . . . . . . . . . . .   8
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
   8.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  10
   9.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  10
     9.1.  Normative References  . . . . . . . . . . . . . . . . . .  10
     9.2.  Informative References  . . . . . . . . . . . . . . . . .  10

1.  Introduction

   RPKI-based origin validation relies on widespread deployment of the
   Resource Public Key Infrastructure (RPKI) [RFC6480].  How the RPKI is
   distributed and maintained globally is a serious concern from many
   aspects.

   While the global RPKI is in the early stages of deployment, there is
   no single root trust anchor, initial testing is being done by the
   Regional Internet Registries (RIRs), and there are technical
   testbeds.  It is thought that origin validation based on the RPKI
   will continue to be deployed incrementally over the next few years.
   It is assumed that eventually there must be a single root trust
   anchor for the public address space, see [IAB].

   Origin validation needs to be done only by an AS's border routers and
   is designed so that it can be used to protect announcements that are
   originated by any network participating in Internet BGP routing:
   large providers, upstream and downstream routers, and by edge
   networks (e.g., small stub or enterprise networks).

   Origin validation has been designed to be deployed on current routers
   without significant hardware upgrades.  It should be used in border
   routers by operators from large backbones to small stub/enterprise/
   edge networks.

   RPKI-based origin validation has been designed so that, with prudent
   local routing policies, there is little risk that what is seen as
   today's normal Internet routing is threatened by imprudent deployment
   of the global RPKI; see Section 5.

Bush                      Best Current Practice                 [Page 2]
RFC 7115             RPKI-Based Origin Validation Op        January 2014

1.1.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are to
   be interpreted as described in RFC 2119 [RFC2119] only when they
   appear in all upper case.  They may also appear in lower or mixed
   case as English words, without normative meaning.