Requirements for Resource Public Key Infrastructure (RPKI) Relying Parties
RFC 8897

Document Type RFC - Informational (September 2020; No errata)
Authors Di Ma  , Stephen Kent 
Last updated 2020-09-03
Replaces draft-madi-sidrops-rp
Stream IETF
Formats plain text html xml pdf htmlized bibtex
Stream WG state Submitted to IESG for Publication
Document shepherd Nathalie Trenaman
Shepherd write-up Show (last changed 2020-02-05)
IESG IESG state RFC 8897 (Informational)
Consensus Boilerplate Yes
Telechat date
Responsible AD Warren Kumari
Send notices to Nathalie Trenaman <>
IANA IANA review state IANA OK - No Actions Needed
IANA action state No IANA Actions

Internet Engineering Task Force (IETF)                             D. Ma
Request for Comments: 8897                                          ZDNS
Category: Informational                                          S. Kent
ISSN: 2070-1721                                              Independent
                                                          September 2020

   Requirements for Resource Public Key Infrastructure (RPKI) Relying


   This document provides a single reference point for requirements for
   Relying Party (RP) software for use in the Resource Public Key
   Infrastructure (RPKI).  It cites requirements that appear in several
   RPKI RFCs, making it easier for implementers to become aware of these
   requirements.  Over time, this RFC will be updated to reflect changes
   to the requirements and guidance specified in the RFCs discussed

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Not all documents
   approved by the IESG are candidates for any level of Internet
   Standard; see Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at

Copyright Notice

   Copyright (c) 2020 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   ( in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction
   2.  Fetching and Caching RPKI Repository Objects
     2.1.  TAL Configuration and Processing
     2.2.  Locating RPKI Objects Using Authority and Subject
           Information Extensions
     2.3.  Dealing with Key Rollover
     2.4.  Dealing with Algorithm Transition
     2.5.  Strategies for Efficient Cache Maintenance
   3.  Certificate and CRL Processing
     3.1.  Verifying Resource Certificate and Syntax
     3.2.  Certificate Path Validation
     3.3.  CRL Processing
   4.  Processing RPKI Repository Signed Objects
     4.1.  Basic Signed Object Syntax Checks
     4.2.  Syntax and Validation for Each Type of Signed Object
       4.2.1.  Manifest
       4.2.2.  ROA
       4.2.3.  Ghostbusters
       4.2.4.  Verifying BGPsec Router Certificate
     4.3.  How to Make Use of Manifest Data
     4.4.  What To Do with Ghostbusters Information
   5.  Distributing Validated Cache
   6.  Local Control
   7.  Security Considerations
   8.  IANA Considerations
   9.  References
     9.1.  Normative References
     9.2.  Informative References
   Authors' Addresses

1.  Introduction

   RPKI Relying Party (RP) software is used by network operators and
   others to acquire and verify Internet Number Resource (INR) data
   stored in the RPKI repository system.  RPKI data, when verified,
   allows an RP to verify assertions about which Autonomous Systems
   (ASes) are authorized to originate routes for IP address prefixes.
   RPKI data also establishes a binding between public keys and BGP
   routers and indicates the AS numbers that each router is authorized
   to represent.

   The essential requirements imposed on RP software to support secure
   Internet routing [RFC6480] are scattered throughout numerous
   protocol-specific RFCs and Best Current Practice RFCs.  The following
   RFCs define these requirements:

      RFC 6481 (Repository Structure)
      RFC 6482 (ROA format)
      RFC 6486 (Manifests)
      RFC 6487 (Certificate and CRL profile)
      RFC 6488 (RPKI Signed Objects)
      RFC 6489 (Key Rollover)
      RFC 6810 (RPKI to Router Protocol)
      RFC 6916 (Algorithm Agility)
      RFC 7935 (Algorithms)
      RFC 8209 (Router Certificates)
      RFC 8210 (RPKI to Router Protocol, Version 1)
      RFC 8360 (Certificate Validation Procedure)
      RFC 8630 (Trust Anchor Locator)

   The distribution of RPKI RP requirements across these 13 documents
   makes it hard for an implementer to be confident that he/she has
   addressed all of these requirements.  Additionally, good software
   engineering practice may call for segmenting the RP system into
   components with orthogonal functionalities so that those components
Show full document text