RFC 2754

RPS IANA Issues 💖

okay bestie, this RFC is literally about who gets to be the root of the whole routing trust tree 👑 It came out in January 2000 as an Informational doc, so it's not a standard, just useful info for the community 🌸

Authors: C. Alaettinoglu (USC/ISI), C. Villamizar (Avici Systems), and R. Govindan (USC/ISI) 🫶

Obsoletes / Updates: the header doesn't list anything it obsoletes or updates 🦋

Status of This Memo ✨

This memo gives information to the Internet community. It is not an Internet standard of any kind. Distribution is unlimited 🌈

Copyright Notice 🎀

Copyright (C) The Internet Society (2000). All Rights Reserved. 💜

Abstract 🔥

okay so RPS Security [2] needs certain RPSL [1] objects in the IRR to be hierarchically delegated 🌳 The objects sitting at the top of that hierarchy have to be created and digitally signed by IANA, and this doc is where those seed objects live, plus a list of the stuff IANA needs to do 💅

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. 🙈

1 Initial Seed 🌱

So a public key for IANA needs to ship with the software for the Distributed Routing Policy System [3] 🔑 A bunch of seed objects also need to be signed with that key. The transaction below (the transaction format is defined in [3]) holds those objects and gets signed with this key 🧚

mntner:        mnt-iana
descr:         iana's maintainer
admin-c:       JKR1
tech-c:        JKR1
upd-to:        JKRey@ISI.EDU
mnt-nfy:       JKRey@ISI.EDU
auth:          pgpkey-7F6AA1B9
mnt-by:        mnt-iana
referral-by:   mnt-iana
source:        IANA

key-cert: pgpkey-7F6AA1B9
method: pgp
owner:  iana-root (est. Nov 98) <iana@iana.org>
fingerpr: 71 09 2E 37 71 B8 0A 9C  3B 28 98 B4 F1 21 13 BB
certif: # this is the real IANA key
+ -----BEGIN PGP PUBLIC KEY BLOCK-----
+ Version: 2.6.2
+
+ mQCNAzZJ52sAAAEEAJ//C01YnlaGuXyrC16V7FphkRvBmcNU22TPOzrKnKjnWjH5
+ sJ5UQnGOpyhDc796gqBjY+lTLvPB9sFGJPWgxfNk2JQaxxLTD+tfqSsiURc/srpp
+ XohFAVR/fez8MOecISwvNpFh5VADuFuoNi7ZLuOwVTC4tM5RU0NJa8l/aqG5AAUR
+ tCdpYW5hLXJvb3QgKGVzdC4gTm92IDk4KSA8aWFuYUBpYW5hLm9yZz4=
+ =sF4q
+ -----END PGP PUBLIC KEY BLOCK-----
mnt-by: mnt-iana
source: IANA

repository:         IANA
repository-cert:    PGPKEY-88BAC849
query-address:      http://www.iana.org
response-auth-type: none
submit-address:     http://www.iana.org
submit-auth-type:   none
expire:             0000 04:00:00
heartbeat-interval: 0000 01:00:00
admin-c:            JKR1
tech-c:             JKR1
mnt-by:             mnt-iana
source:             IANA
as-block:     AS0 - AS65535
descr:        as number space
country:      us
admin-c:      JKR1
tech-c:       JKR1
status:       UNALLOCATED
source:       IANA
mnt-by:       mnt-iana
mnt-lower:    mnt-iana

inetnum:      0.0.0.0 - 255.255.255.255
netname:      Internet
descr:        ip number space
country:      us
admin-c:      JKR1
tech-c:       JKR1
status:       UNALLOCATED
source:       IANA
mnt-by:       mnt-iana
mnt-lower:    mnt-iana

timestamp: 19991001 01:00:00 +00:00

signature:
+ -----BEGIN PGP SIGNATURE-----
+ Version: 2.6.2
+
+ iQCVAwUBOAd3YENJa8l/aqG5AQFVdAP9Ho2TSLGXiDi6v1McsKY4obO32EtP44Jv
+ tpNWiRRz47WIpMBmzUrQajBDNNXzwq9r9mGC75Pg0MMwTDfvA47o6mnIGdT9XyZz
+ s9HlDGOqhklIjHOxXFDrBiz3u7eWEf3vmDCXt6UYg9lUtRKefkWtR5wD1Q1zDMSc
+ 7Ya7PE6X8SU=
+ =sAft
+ -----END PGP SIGNATURE-----

formatting check 🤓 The text above has no extra whitespace at the end of any line and no tab characters. Every run of blank lines is exactly one blank line, and so is the page break 📄

Also, in this case we assumed IANA runs its own repository, but that's not a must-have 💁‍♀️ IANA can also publish this transaction through an existing routing registry, which is so flexible 🦋

2 IANA Assignments 💌

Every time IANA makes an assignment, it needs to create inetnum and as-block objects where they fit, then digitally sign them with the key in its key-cert object 🔏 For example:

as-block:     AS0 - AS500
descr:        arin's space
country:      us
status:       ALLOCATED
source:       iana
delegated:    arin
mnt-by:       mnt-iana

inetnum:      128.0.0.0 - 128.255.255.255
netname:      Internet portion
descr:        ip number space
country:      us
status:       ALLOCATED
source:       iana
delegated:    arin
mnt-by:       mnt-iana

3 Creating Routing Repositories 🏗️

To turn on a brand new routing repository, you need a repository object, a maintainer object, and a key-cert object, all created and digitally signed by IANA ✨ Here's an example:

mntner:        mnt-ripe
descr:         RIPE's maintainer
auth:          <ripe's choice>
mnt-by:        mnt-ripe
referral-by:   mnt-iana
admin-c:       . . .
tech-c:        . . .
upd-to:        . . .
mnt-nfy:       . . .
source:        RIPE

key-cert: pgpkey-979979
method: pgp
owner:  . . .
fingerpr: . . .
certif: # this key is for illustration only
+       -----BEGIN PGP PUBLIC KEY BLOCK-----
+       Version: PGP for Personal Privacy 5.0
+
+       . . .
+       -----END PGP PUBLIC KEY BLOCK-----
mnt-by: mnt-ripe
source: RIPE
repository:         RIPE
query-address:      whois://whois.ripe.net
response-auth-type: PGPKEY-23F5CE35 # pointer to key-cert object
response-auth-type: none
remarks:            you can request rsa signature on queries
remarks:            PGP required on submissions
submit-address:     mailto://auto-dbm@ripe.net
submit-address:     rps-query://whois.ripe.net:43
submit-auth-type:   pgp-key, crypt-pw, mail-from
remarks:            these are the authentication types supported
mnt-by:             maint-ripe-db
expire:             0000 04:00:00
heartbeat-interval: 0000 01:00:00
...
remarks:            admin and technical contact, etc
source:             RIPE

the big plot twist 🙀 That very first transaction for a new repository lives in the new repository itself, NOT in the IANA one 💅

4 Security Considerations 🛡️

This is the serious part, so pay attention 🥹 The routing policy system security document [2] defines a hierarchical authorization model for the objects stored in the routing registries 🌳 This doc spells out the seed objects and the steps IANA needs to take to look after the root of that authorization hierarchy. Keep that root safe, it's giving load-bearing 💀

5 IANA Considerations 📋

Ngl, this whole document is basically for IANA to read closely and think through 🤓

References 📚

[1] Alaettinoglu, C., Bates, T., Gerich, E., Karrenberg, D., Meyer, D., Terpstra, M. and C. Villamizar, "Routing Policy Specification Language (RPSL)", RFC 2622, June 1999.

[2] Villamizar, C., Alaettinouglu, C., Meyer, D., Murphy, S. and C. Orange, "Routing Policy System Security", RFC 2725, December 1999.

[3] Villamizar, C., Alaettinouglu, C., Govindan, R. and D. Meyer, "Distributed Routing Policy System", Work in Progress.

6 Authors' Addresses 💜

Cengiz Alaettinoglu USC Information Sciences Institute EMail: cengiz@isi.edu

Curtis Villamizar Avici Systems EMail: curtis@avici.com

Ramesh Govindan USC Information Sciences Institute EMail: govindan@isi.edu

7 Notices 🙏

The IETF doesn't take a position on whether any intellectual property or other rights claimed about the tech in this doc are valid or how far they reach, and it hasn't tried to find out what rights exist 🤷‍♀️ Info on the IETF's procedures for rights in standards-track and standards-related docs is in BCP-11. Any claims of rights that were filed for publication, plus any promises of licenses, or results from trying to get a general license for implementers or users, can be requested from the IETF Secretariat.

The IETF invites anyone to flag any copyrights, patents, patent applications, or other proprietary rights that might cover tech needed to implement this standard. Send that info to the IETF Executive Director 📮

8 Full Copyright Statement 🎀

Copyright (C) The Internet Society (2000). All Rights Reserved. 💖

This doc and translations of it can be copied and shared, and people can make derivative works that comment on, explain, or help implement it. Those can be prepared, copied, published, and distributed in whole or in part with no restrictions, as long as the copyright notice and this paragraph stay on every copy and derivative work 🌈 The document itself can't be modified in any way, like removing the copyright notice or the references to the Internet Society or other Internet orgs. The exceptions: you can change it to develop Internet standards (and then you follow the copyright procedures in the Internet Standards process), or you can translate it into languages other than English 🌍

These permissions are perpetual and won't be revoked by the Internet Society or its successors or assigns ♾️

The disclaimer, which I'm keeping exactly as written: 😭

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🫶

Funding for the RFC Editor function is currently provided by the Internet Society. ✨