Resource Public Key Infrastructure (RPKI) Validation ReconsideredAsia Pacific Network Information Centre6 Cordelia StSouth BrisbaneQLD4101Australia+61 7 3858 3100gih@apnic.netAsia Pacific Network Information Centre6 Cordelia StSouth BrisbaneQLD4101Australia+61 7 3858 3100ggm@apnic.netLatin American and Caribbean IP Address Regional RegistryRambla Mexico 6125Montevideo11400Uruguay+598 2604 2222carlos@lacnic.netRIPE Network Coordination CentreSingel 258Amsterdam1016 ABThe Netherlandstim@ripe.netAmerican Registry for Internet Numbers3635 Concorde ParkwayChantillyVA20151United States of Americaandy@arin.netAfrican Network Information Centre (AFRINIC)11th Floor, Standard Chartered TowerCybercityEbeneMauritius+230 403 51 00daniel@afrinic.netThis document specifies an alternative to the certificate
validation procedure specified in RFC 6487 that
reduces aspects of operational fragility in the management of
certificates in the Resource Public Key Infrastructure (RPKI), while retaining essential security
features.The procedure specified in RFC 6487 requires that Resource
Certificates are rejected entirely if they are found to overclaim any resources not
contained on the issuing certificate, whereas the validation process defined
here allows an issuing Certification Authority (CA) to chose to communicate
that such Resource Certificates should be accepted for the intersection
of their resources and the issuing certificate.It should be noted that the validation process defined here considers
validation under a single trust anchor (TA) only. In particular, concerns regarding overclaims
where multiple configured TAs claim overlapping resources are considered
out of scope for this document.This choice is signaled by a set of alternative Object Identifiers (OIDs) per
"X.509 Extensions for IP Addresses and AS Identifiers" (RFC 3779) and "Certificate Policy (CP) for
the Resource Public Key Infrastructure (RPKI)" (RFC 6484). It should be noted that in case these
OIDs are not used for any certificate under a trust anchor, the validation procedure
defined here has the same outcome as the procedure defined in RFC 6487.Furthermore, this document provides an alternative to Route Origin Authorization (ROA) (RFC 6482) and BGPsec Router
Certificate (BGPsec PKI Profiles -- publication requested) validation.
This document specifies an alternative to the certificate validation
procedure specified in RFC 6487. Where the procedure specified in
RFC 6487 will require that Resource Certificates be rejected entirely
if they are found to overclaim any resources not contained on the
issuing certificate, the procedure defined here dictates that these
Resource Certificates be accepted for the intersection of their
resources and the issuing certificate only.
The outcome of both procedures is the same as long as no overclaims
occur. Furthermore, the new procedure can never lead to the acceptance
of resources that are not validly held on the path of issuing certificates.
However, the procedure defined here will limit the impact in case
resources are no longer validly held on the path of issuing certificates to
attestations, such as Route Origin Authorizations that
refer to these resources only. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
"MAY", and "OPTIONAL" in this document are to be interpreted as
described in BCP 14 when, and only when, they
appear in all capitals, as shown here.As currently defined in Section 7.2 of ,
validation of PKIX certificates that conform to the RPKI
profile relies on the use of a path validation process where
each certificate in the validation path is required to meet the
certificate validation criteria.These criteria require, in particular, that the Internet Number
Resources (INRs) of each certificate in the validation path are
"encompassed" by INRs on the issuing certificate. The first certificate in
the path is required to be a trust anchor, and its resources are
considered valid by definition.For example, in the following sequence:All certificates in this scenario are considered valid since the INRs
of each certificate are encompassed by those of the issuing certificate.
ROA1 is valid because the specified prefix is encompassed by the embedded
end entity (EE) certificate, as required by .The allocations recorded in the RPKI change as a result of resource
transfers. For example, the CAs involved in transfer might choose to
modify CA certificates in an order that causes some of these certificates
to "overclaim" temporarily. A certificate is said to "overclaim" if it
includes INRs not contained in the INRs of the CA that issued the
certificate in question.It may also happen that a child CA does not voluntarily request a
shrunk Resource Certificate when resources are being transferred or
reclaimed by the parent. Furthermore, operational errors that may occur
during management of RPKI databases also may create CA certificates that,
temporarily, no longer encompass all of the INRs of subordinate
certificates.Consider the following sequence:Here, Certificate 2 from the previous example was reissued by
TA to CA1, and the prefix 198.51.100.0/24 was removed. However, CA1
failed to reissue a new Certificate 3 to CA2. As a result, Certificate 3
is now overclaiming and considered invalid; by recursion, the embedded
Certificate 4 used for ROA1 is also invalid. And ROA1 is invalid because
the specified prefix contained in the ROA is no longer encompassed by a
valid embedded EE certificate, as required by .However, it should be noted that ROA1 does not make use of any of the
address resources that were removed from CA1's certificate; thus,
it would be desirable if ROA1 could still be viewed as valid. Technically,
CA1 should reissue a Certificate 3 to CA2 without 198.51.100.0/24, and
then ROA1 would be considered valid according to .
But as long as CA1 does not take this action, ROA1 remains invalid. It
would be preferable if ROA1 could be considered valid, since the assertion
it makes was not affected by the reduced scope of CA1's certificate.The problem described above can be considered a low probability
problem today. However, the potential impact on routing security
would be high if an overclaiming occurred near the apex of the RPKI
hierarchy, as this would invalidate the entirety of the subtree
located below this point.The changes specified here to the validation procedure in
do not change the probability of this
problem, but they do limit the impact to just the overclaimed
resources. This revised validation algorithm is intended to avoid
causing CA certificates to be treated as completely invalid as a result
of overclaims. However, these changes are designed to not degrade the
security offered by the RPKI. Specifically, ROAs and router
certificates will be treated as valid only if all of the resources
contained in them are encompassed by all superior certificates along a
path to a trust anchor.The way this is achieved conceptually is by maintaining a Verified
Resource Set (VRS) for each certificate that is separate from the INRs
found in the resource extension in the
certificate.Note that Section 1.2 of defines the "Certificate Policy
(CP) for the Resource PKI (RPKI)" with the following OID:This document requests an assignment of a new OID for an alternative "Certificate Policy
(CP) for use with validation reconsidered in the Resource PKI (RPKI)" as follows:This alternative Certificate Policy is the same as the Certificate Policy described in
, except that it is used to drive the decision in Step 8
of the validation procedure described in .This document defines an alternative to . All specifications
and procedures described in apply, with the
notable exceptions described in the following subsections.This document requests an OID for the extension id-pe-ipAddrBlocks-v2 (id-pe 28).
This OID MUST only be used in conjunction with the alternative Certificate Policy
OID defined in .The following is an amended specification to be used as an alternative to the
specification in Section 2.2.1 of .The OID for this extension is id-pe-ipAddrBlocks-v2.where defines:Note that the descriptions of objects referenced in the syntax above are defined
in Sections 2.2.3.1 through 2.2.3.9 of .This document requests an OID for the extension id-pe-autonomousSysIds-v2 (id-pe 29).
This OID MUST only be used in conjunction with the alternative Certificate Policy
OID defined in .The following is an amended specification to be used as an alternative to the
specification in Section 3.2.1 of .The OID for this extension is id-pe-autonomousSysIds-v2.where defines:Certificate path validation is performed as specified in
.Certificate path validation is performed as specified in
.This document requests an OID for id-mod-ip-addr-and-as-ident-v2, as follows:The following is an amended specification to be used as an alternative to the
specification in Appendix A of .This normative appendix describes the IP address and AS identifiers
extensions used by conforming PKI components in ASN.1 syntax.This document requests an OID for id-mod-ip-addr-and-as-ident-2v2
as follows: is an informational RFC that updates some
auxiliary ASN.1 modules to conform to the 2008 version of ASN.1; the
1988 ASN.1 modules in
remain the normative version.The following is an additional module conforming to the 2008 version
of ASN.1 to be used with the extensions defined in Sections
and .This document defines an alternative profile for X.509 PKIX Resource
Certificates. This profile follows all definitions and procedures described
in with the following notable exceptions.The following is an amended specification to be used in this profile, in place of
Section 4.8.9 of .This extension MUST be present and MUST be marked critical. It MUST
include exactly one policy of type id-cp-ipAddr-asNumber-v2, as
specified in the updated RPKI CP in .The following is an amended specification to be used in this profile, in place of
Section 4.8.10 of .Either the IP resources extension or the AS resources extension, or
both, MUST be present in all RPKI certificates and MUST
be marked critical.This extension contains the list of IP address resources as per
. The value may
specify the "inherit" element for a particular Address Family
Identifier (AFI) value. In the context of Resource Certificates
describing public number resources for use in the public Internet, the
Subsequent AFI (SAFI) value MUST NOT be used.This extension MUST either specify a non-empty set of IP address
records or use the "inherit" setting to indicate that the IP address
resource set of this certificate is inherited from that of the
certificate's issuer.The following is an amended specification to be used in this profile, in place of
Section 4.8.11 of .Either the AS resources extension or the IP resources extension, or
both, MUST be present in all RPKI certificates and MUST
be marked critical.This extension contains the list of AS number resources as per
, or it may specify
the "inherit" element. Routing Domain Identifier (RDI) values are NOT
supported in this profile and MUST NOT be used.This extension MUST either specify a non-empty set of AS number
records or use the "inherit" setting to indicate that the AS number
resource set of this certificate is inherited from that of the
certificate's issuer.The following is an amended specification for path validation to be used in
place of Section 7.2 of , which allows for the validation of
both certificates following the profile defined in , as
well as certificates following the profile described above.The following algorithm is employed to validate CA and EE resource
certificates. It is modeled on the path validation algorithm from
but is modified to make use of the IP Address
Delegation and AS Identifier Delegation extensions from
.There are two inputs to the validation algorithm:a trust anchora certificate to be validatedThe algorithm is initialized with two new variables for use in the
RPKI: Verified Resource Set-IP (VRS-IP) and Verified Resource Set&nbhy;AS
(VRS-AS). These sets are used to track the set of INRs (IP address
space and AS numbers) that are considered valid for each CA certificate.
The VRS-IP and VRS-AS sets are initially set to the IP Address
Delegation and AS Identifier Delegation values, respectively, from the
trust anchor used to perform validation.This path validation algorithm verifies, among other things, that a
prospective certification path (a sequence of n certificates) satisfies
the following conditions:for all 'x' in {1, ..., n-1}, the subject of certificate 'x' is the
issuer of certificate ('x' + 1);certificate '1' is issued by a trust anchor;certificate 'n' is the certificate to be validated; andfor all 'x' in {1, ..., n}, certificate 'x' is valid.Certificate validation requires verifying that all of the following
conditions hold, in addition to the certification path validation
criteria specified in Section 6 of . The signature of certificate x (x>1) is verified using the public
key of the issuer's certificate (x-1), using the signature algorithm
specified for that public key (in certificate x-1).The current time lies within the interval defined by the
NotBefore and NotAfter values in the Validity field of certificate
x.The Version, Issuer, and Subject fields of certificate x satisfy
the constraints established in Sections 4.1 to 4.7 of RFC 6487.If certificate x uses the Certificate Policy defined in Section 4.8.9 of
, then the certificate MUST contain all extensions
defined in Section 4.8 of that must be present.
The value(s) for each of these extensions MUST satisfy the constraints
established for each extension in the respective sections. Any extension not
thus identified MUST NOT appear in certificate x.If certificate x uses the Certificate Policy defined in ,
then all extensions defined in Section 4.8 of ,
except Sections 4.8.9, 4.8.10, and 4.8.11 MUST be present. The certificate
MUST contain an extension as defined in Sections or
, or both. The value(s) for each of these
extensions MUST satisfy the constraints established for each extension
in the respective sections. Any extension not thus identified MUST NOT
appear in certificate x.Certificate x MUST NOT have been revoked, i.e., it MUST NOT
appear on a Certificate Revocation List (CRL) issued by the CA represented by certificate x-1.Compute the VRS-IP and VRS-AS set values as indicated below:
If the IP Address Delegation extension is present in certificate x
and x=1, set the VRS-IP to the resources found in this extension.If the IP Address Delegation extension is present in certificate x
and x>1, set the VRS-IP to the intersection of the resources between
this extension and the value of the VRS&nbhy;IP computed for certificate x-1.If the IP Address Delegation extension is absent in
certificate x, set the VRS-IP to NULL.If the IP Address Delegation extension is present in certificate x
and x=1, set the VRS-IP to the resources found in this extension.If the AS Identifier Delegation extension is present in certificate x
and x>1, set the VRS-AS to the intersection of the resources between
this extension and the value of the VRS&nbhy;AS computed for certificate x-1.If the AS Identifier Delegation extension is absent in certificate x,
set the VRS-AS to NULL.If there is any difference in resources in the VRS-IP and the IP
Address Delegation extension on certificate x, or the VRS-AS and the
AS Identifier Delegation extension on certificate x, then:
If certificate x uses the Certificate Policy defined in
, a warning listing the
overclaiming resources for certificate x SHOULD be issued.If certificate x uses the Certificate Policy defined in Section 4.8.9 of
, then certificate x MUST be rejected.These rules allow a CA certificate to contain resources that are not
present in (all of) the certificates along the path from the trust
anchor to the CA certificate. If none of the resources in the CA
certificate are present in all certificates along the path, no
subordinate certificates could be valid. However, the certificate is not
immediately rejected as this may be a transient condition. Not
immediately rejecting the certificate does not result in a security
problem because the associated VRS sets accurately reflect the resources
validly associated with the certificate in question.Section 4 of currently has the following
text on the validation of resources on a ROA:The IP address delegation extension is present in the
end-entity (EE) certificate (contained within the ROA), and each
IP address prefix(es) in the ROA is contained within the set of IP
addresses specified by the EE certificate's IP address delegation
extension.If the end entity certificate uses the Certificate Policy defined in
, then the following approach must be
used instead.The amended IP Address Delegation extension described in
is present in the end entity (EE) certificate
(contained within the ROA), and each IP address prefix(es) in the ROA is
contained within the VRS-IP set that is specified as an outcome of EE
certificate validation described in .Note that this ensures that ROAs can be valid only if all IP address
prefixes in the ROA are encompassed by the VRS-IP of all certificates
along the path to the trust anchor used to verify it.Operators MAY issue separate ROAs for each IP address prefix, so that
the loss of one or more IP address prefixes from the VRS-IP of any certificate
along the path to the trust anchor would not invalidate authorizations
for other IP address prefixes.If a BGPsec Router Certificate
uses the Certificate Policy defined in , then
in addition to the BGPsec Router Certificate Validation defined in
Section 3.3 of , the
following constraint MUST be met:
The VRS-AS of BGPsec Router Certificates MUST encompass all Autonomous System Numbers (ASNs)
in the AS Resource Identifier Delegation extension.Operators MAY issue separate BGPsec Router Certificates for different ASNs, so
that the loss of an ASN from the VRS-AS of any certificate along the path to the
trust anchor would not invalidate router keys for other ASNs.In this section, we will demonstrate the outcome of RPKI validation performed
using the algorithm and procedures described in Sections ,
, and , under three deployment
scenarios:An RPKI tree consisting of certificates using the old OIDs onlyAn RPKI tree consisting of certificates using the new OIDs onlyAn RPKI tree consisting of a mix of certificates using either the old or the new OIDsIn this context, we refer to a certificate as using the 'old' OIDs, if the
certificate uses a combination of the OIDs defined in Section 1.2 of ,
Section 2.2.1 of , and/or Section 3.2.1 of .
We refer to a certificate as using the 'new' OIDS, if the certificate uses a
combination of OIDs defined in Sections , ,
and/or .Consider the following example:Consider the following example under the amended approach:In the following example, new OIDs are used only for CA certificates where
the issuing CA anticipates that an overclaim could occur and has a desire
to limit the impact of this to just the overclaimed resources in question:This document defines an alternative RPKI validation algorithm, but it does not
dictate how this algorithm will be deployed. This should be discussed as a separate
effort. That said, the following observations may help this discussion.Because this document introduces new OIDs and an alternative to the profile for
X.509 PKIX Resource Certificates described in , the use
of such certificates in the global RPKI will lead to the rejection of such
certificates by Relying Party tools that do not (yet) implement the alternative
profile described in this document.For this reason, it is important that such tools are updated before Certification
Authorities start to use this specification.However, because the OIDs are defined in each RPKI certificate, there is no
strict requirement for all Certification Authorities, or even for all the certificates
they issue, to migrate to the new OIDs at
the same time. The example in
illustrates a possible deployment where the new OIDs
are used only in CA certificates where an accidental overclaim may occur.The authors believe that the revised validation algorithm introduces no
new security vulnerabilities into the RPKI, because it cannot lead to any
ROA and/or router certificates to be accepted if they contain resources
that are not held by the issuer.IANA has added the following to the "SMI Security for PKIX Certificate
Policies" registry:IANA has added the following to the "SMI Security for PKIX Certificate
Extension" registry:IANA has added the following to the "SMI Security for PKIX Module
Identifier" registry:The authors would like to thank Stephen Kent for reviewing and
contributing to this document. We would like to thank Rob Austein for
suggesting that separate OIDs should be used to make the behavior of
Relying Party tools deterministic, and we would like to thank Russ Housley,
Sean Turner, and Tom Petch for their contributions on OID and ASN.1 updates.
Finally, we would like to thank Tom Harrison for a general review of this
document.