RFC 6481
A Profile for Resource Certificate Repository Structure
Abstract ✨
Okay bestie, this one is RFC 6481, A Profile for Resource Certificate Repository Structure 🎀. It was published in February 2012 by G. Huston, R. Loomans and G. Michaelson, all from APNIC (ISSN 2070-1721). It's on the Standards Track, so it's a real Internet standard and not just a brainstorm 👑. The header doesn't list anything it obsoletes or updates, so no drama there 🫶.
The main idea is a profile for how the RPKI distributed repository is laid out 🦋. Every repository publication point is a directory full of files for X.509/PKIX Resource Certificates, Certificate Revocation Lists and signed objects. The profile covers three things: the object (file) naming scheme, what goes inside each publication point directory, and a suggested internal structure for a local repository cache. That structure is meant to make syncing across a bunch of publication points easier, and to help with building certification paths 🧚.
Status of This Memo 📜
This is an Internet Standards Track document 💖.
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 5741 ✨.
Info about the current status, any errata, and how to send feedback is at http://www.rfc-editor.org/info/rfc6481 🌸.
Copyright Notice ©️
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved 🔒.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 📖. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 💅.
Table of Contents 🗂️
1. Introduction ....................................................3
1.1. Terminology ................................................3
2. RPKI Repository Publication Point Content and Structure .........4
2.1. Manifests ..................................................5
2.2. CA Repository Publication Points ...........................6
3. Resource Certificate Publication Repository Considerations ......8
4. Certificate Reissuance and Repositories ........................10
5. Synchronizing Repositories with a Local Cache ..................10
6. Security Considerations ........................................11
7. IANA Considerations ............................................12
7.1. Media Types ...............................................12
7.1.1. application/rpki-manifest ..........................12
7.1.2. application/rpki-roa ...............................13
7.2. RPKI Repository Name Scheme Registry ......................13
8. Acknowledgements ...............................................13
9. References .....................................................14
9.1. Normative References ......................................14
9.2. Informative References ....................................141. Introduction 🌟
Before relying parties (RPs) can check the attestations made in the context of the Resource Public Key Infrastructure (RPKI) [RFC6480], they need access to every X.509/PKIX Resource Certificate, Certificate Revocation List (CRL) and signed object that together make up the RPKI 🔍.
Every issuer of a certificate, CRL or signed object makes it downloadable for RPs by publishing it in an RPKI repository 📦.
The repository system is a collection of all signed objects that MUST be globally accessible to all RPs 🌍. When certificates, CRLs and signed objects get created, they're uploaded to a repository publication point, and RPs can download them from there 💜.
This profile defines the recommended object (file) naming scheme, the recommended contents of repository publication points (directories), and a suggested internal structure for a local repository cache. That cache structure is meant to make synchronization across a distributed collection of repository publication points easier, and to help with certification path construction 🧚.
A resource certificate binds an entity's public key to a set of IP address blocks and AS numbers 🦋. The subject of a resource certificate proves that they hold the resources listed in it by using their private key to make a digital signature, which anyone can verify with the public key from the certificate 🔑.
1.1. Terminology 📚
It's assumed you already know the terms and concepts in "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile" [RFC5280] and "X.509 Extensions for IP Addresses and AS Identifiers" [RFC3779] 🤓.
On top of those, this document uses the following terms:
Repository Object (or Object): This is a terminal object in a repository publication point. A terminal object is usually a file in a publicly accessible directory, as long as the file isn't a directory itself. Any other form of object that looks publicly like a file also counts under this term 📄.
Repository Publication Point: This is a collection of Repository Objects published at a common publication point. It's usually a directory in a publicly accessible filesystem that's identified by a URI [RFC3986]. Any other form of local storage that looks publicly like a simple directory of files is also covered by this term 🗃️.
Repository Instance: This is a collection of one or more Repository Publication Points that share a common publication instance. It's usually a set of filesystem directories that share a common URI prefix, where each directory also has its own unique URI 🫧.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💅.
2. RPKI Repository Publication Point Content and Structure 🎀
The RPKI doesn't require a single repository instance to hold every published RPKI object 🙅♀️. Instead, the RPKI repository system is made up of multiple repository instances. Each repository instance is built from one or more repository publication points. Each repository publication point is used by one or more entities that are referenced in RPKI certificates, as defined in the certificate's Subject Information Access (SIA) extension 🗺️.
This section describes the collection of objects (RPKI certificates, CRLs, manifests, and signed objects) held in repository publication points 📦.
For every Certification Authority (CA) certificate in the RPKI, there's a matching repository publication point that's the authoritative publication point for all current certificates and CRLs issued by that CA 👑. The certificate's SIA extension contains a URI [RFC3986] that points to this repository publication point and says how to access it. The certificate's Authority Information Access (AIA) extension also contains a URI, pointing to the authoritative location of the CA certificate that issued the given certificate 🔗.
For example, say the subject of certificate A has issued certificates B and C. Then the AIA extensions of certificates B and C both point to the publication point for certificate A's object, and the SIA extension of certificate A points to a repository publication point (directory) that contains certificates B and C (see Figure 1) 🦋.
+--------+
+--------->| Cert A |<----+
| | AIA | |
| +--------- SIA | |
| | +--------+ |
| | |
| | +-------------------|------------------+
| | | | |
| +->| +--------+ | +--------+ |
| | | Cert B | | | Cert C | |
| | | CRLDP-------+ | | CRLDP-----+ |
+----------- AIA | | +----- AIA | | |
| | SIA------+ | | SIA------------+
| +--------+ | | +--------+ | | |
| | V V | |
| | +-----------------+ | |
| | | CRL issued by A | | |
| A's Repository| +-----------------+ | |
| Directory | | |
+---------------|----------------------+ |
| |
+----------------+ | +----------------+ |
| B's Repository |<-------+ | C's Repository |<--+
| Directory | | Directory |
+----------------+ +----------------+
Figure 1. Use of AIA and SIA Extensions in the RPKIIn Figure 1, certificates B and C are issued by CA A 🎀. So the AIA extensions of certificates B and C point to certificate A, and the SIA extension of certificate A points to the repository publication point for CA A's subordinate products. That directory holds certificates B and C, plus the CRL issued by A 📁. The CRL Distribution Points (CRLDP) extensions in certificates B and C both point to the CRL issued by A 💖.
In this distributed repository structure, an instance of a CA's repository publication point holds all the published certificates that CA has issued, plus the CRL that CA issued 🌈. This repository also holds all the published digitally signed objects that are verified by an end-entity (EE) certificate issued by this CA ✨.
2.1. Manifests ✨
okay so bestie, every repository publication point MUST contain a manifest [RFC6486] 📋 💖 The manifest is basically a list of the names of all the objects, plus the hash value of each object's contents, for everything that's currently published by a CA or an EE. it's giving inventory check 💅
An authority MAY do a bunch of object operations on a publication repository inside the scope of one repository change, and then issue a single manifest that covers all of them 🦋 Repository operators SHOULD set up some kind of directory management regime on the repository so that RPs doing retrieval operations aren't exposed to intermediate states while the changes and the associated manifest are happening 🫶 (Not gonna lie, if there's no such access regime in place, RPs MAY be exposed to intermediate repository states where the manifest and the repository contents don't perfectly line up 😭 The specific cases and actions for that kind of misalignment are covered in [RFC6486], so go check there, bestie 🌸)
2.2. CA Repository Publication Points 🎀
okay so a CA certificate has two accessMethod elements in its SIA field 🧚 The id-ad-caRepository accessMethod element has an accessLocation element that points to the repository publication point for the certificates this CA issues, as specified in [RFC6487] 💜 The id-ad-rpkiManifest accessMethod element has an accessLocation element that points to the manifest object, written as an object URI (not a directory URI), and that's the manifest associated with this CA ✨
A CA's publication repository holds the current (non-expired and non-revoked) certificates this CA issued, the most recent CRL this CA issued, the current manifest, and all the other current signed objects that can be verified using an EE certificate [RFC6487] issued by this CA 🌈 It's lowkey a whole collection 🍓
The CA's manifest lists the names of this whole collection, together with the hash value of each object's contents, with the one single exception of the manifest itself 🙈
The RPKI design requires that a CA be uniquely associated with a single key pair 🔑 So the administrative entity that is a CA does key rollover by generating a new CA certificate with a new subject name, plus a new key pair [RFC6489] ✨ (The reason for the new subject name is that in the RPKI, the subject names in all certificates a CA issues are supposed to be unique. Since the RPKI key rollover procedure creates a new instance of a CA with the new key, the name constraint means the CA with the new key needs a new subject name 💅) In that situation, the entity SHOULD keep using the same repository publication point for both CA instances during the key rollover 🦋 This keeps the value of the AIA extension in indirect subordinate objects that refer to the certificates this CA issued valid across the key rollover, and it limits the reissuance of subordinate certificates in a key rollover to the collection of immediate subordinate products of this CA [RFC6489] 🫶 In that case, the repository publication point holds the CRL, manifest and subordinate certificates of both CA instances 💖 (It is feasible to use distinct repository publication points for the old and new CA keys, but then very careful coordination would be needed with subordinate CAs and EEs so the AIA pointers in the indirect subordinate levels of the RPKI hierarchy line up correctly with the subordinate products of the new CA 😵💫)
Here are the guidelines for naming objects in a CA's repository publication point, bestie 🎀
- CRL: When a CA issues a new CRL, it replaces the previous CRL (issued under the same CA key pair) in the repository publication point. CAs MUST NOT keep publishing previous CRLs in the repository publication point. So it MUST replace (overwrite) previous CRLs signed by the same CA (instance). A non-normative guideline for naming these objects is that the file name for the CRL be a value derived from the CA's public key. One method for generating a CRL publication name is described in Section 2.1 of [RFC4387]: convert the 160-bit hash of a CA's public key value into a 27-character string using a modified form of Base64 encoding, with an additional modification as proposed in Section 5, table 2, of [RFC4648] 🧁 The filename extension of
.crlMUST be used to denote the file as a CRL. Each.crlfile contains exactly one CRL encoded in DER format 💜 - Manifest: When a new instance of a manifest is published, it MUST replace the previous manifest to avoid confusion. CAs MUST NOT keep publishing previous CA manifests in the repository publication point 🙅♀️ A non-normative guideline for naming these objects is that the filename for the manifest be a value derived from the public key part of the entity's key pair, using the algorithm described above for CRLs to generate filenames ✨ The filename extension of
.mftMUST be used to denote the object as a manifest 🌸 - Certificates: Within the RPKI framework, it's possible that a CA MAY issue a series of certificates to the same subject name, the same subject public key, and the same resource collection 🦋 However, a relying party only needs access to the most recently published certificate in such a series. So such a series of certificates SHOULD share the same filename 💅 That way each successive issued certificate in the series effectively overwrites the previous instance of the certificate. It's feasible to use different filenames, but that puts a burden on the validating user 😩 A non-normative guideline for naming these objects is for the CA to adopt a (local) policy requiring a subject to use a unique key pair for each unique instance of a certificate series issued to the same subject. That lets the CA use a filename generation scheme based on the subject's public key, e.g., using the algorithm described above for CRLs 🧚 Published certificates MUST use a filename extension of
.certo denote the object as a certificate. Each.cerfile contains exactly one certificate encoded in DER format 💖 - Signed Objects: RPKI signed objects [RFC6488] are published in the repository publication point referenced by the SIA of the CA certificate that issued the EE certificate used to validate the digital signature of the signed object (and they're directly referenced by the SIA of that EE certificate) 🌈 A general non-normative guideline for naming these RPKI signed objects is for the filename to be derived from the associated EE certificate's public key, applying the algorithm described above 🍓 Published RPKI signed objects MUST NOT use the filename extensions
.crl,.mft, or.cer🙅♀️
One form of signed object defined at the time this document was published is a Route Origination Authorization (ROA) [RFC6482]. Published ROAs MUST use a filename extension of .roa to denote the object as a ROA 👑
3. Resource Certificate Publication Repository Considerations ✨
okay so each issuer MAY publish its issued certificates and CRL in any repository 🎀 but there are a few things that help you pick a good repository publication structure, so let's go through them 💅
- the publication repository SHOULD be hosted on a highly available service and high-capacity publication platform 🌸
- the publication repository MUST be available using rsync [RFC5781] [RSYNC] 🦋 supporting other retrieval mechanisms is up to the repository operator, but whatever they support MUST be consistent with the accessMethod element value(s) specified in the SIA of the associated CA or EE certificate 💖
- each CA repository publication point SHOULD contain the products of this CA, including the objects that can be verified by EE certificates issued by this CA ✨ the signed products of related CAs run by the same entity MAY share this CA repository publication point 🫶 aside from subdirectories, any other objects SHOULD NOT be placed in a repository publication point 💀
any such subdirectory SHOULD be the repository publication point of a CA or EE certificate contained in the CA directory 🧚 these considerations also apply recursively to subdirectories of these directories 🌈 detecting content that isn't a CA product can confuse RPs, so in that case RPs should exercise caution not to invalidate the valid CA products found at the CA's repository publication point 🙈
- signed objects get published in the location indicated by the SIA field of the EE certificate used to verify each object's signature 👑 they're published in the repository publication point of the CA certificate that issued the EE certificate 💅 the SIA extension of the EE certificate points at this object rather than the repository publication directory [RFC6487] 🍓
- Section 2.1 states that repository operators SHOULD implement some form of directory management regime function on the repository 😭 this keeps RPs who are doing retrieval operations away from intermediate states while the repository and the associated manifest are changing 🔥 despite the commentary below, RPs SHOULD NOT assume that a consistent repository and manifest state is assured, and they SHOULD organize their retrieval operations accordingly (see Section 5) 🫶
how well a repository operator can run a directory update regime that lowers the risk of the manifest and directory contents being inconsistent depends on how the filesystem hosting the repository behaves 🦋 so the following comments are non-normative in terms of any implicit guidelines for repository operators 🙈
a commonly used technique to avoid seeing inconsistent retrieval states during updates to a large directory is to batch the changes you want to make, create a working copy of the directory's contents, and then apply the batch to that local copy 🌸 once it's done, you rename the filesystem symbolic link for the repository directory name so it points at this working copy 💖 the old repository directory contents can be purged a bit later ✨ but the outcome of this technique for keeping client synchronization over the directory intact depends on how the supported access mechanisms interact with the local filesystem behavior 😭 it's probable this technique won't remove every chance for RPs to see inconsistent states between the manifest and the repository 💀 since a repository can end up partially updated, it can't be guaranteed to be internally self consistent all the time 🌈
4. Certificate Reissuance and Repositories 🦋
if a CA certificate gets reissued, e.g., because the set of resources in the number resource extensions changed, it should not be necessary to reissue all certificates issued under it 🎀 these certificates carry AIA extensions that point at the publication point for the CA certificate, so a CA SHOULD use a name for its repository publication point that persists across certificate reissuance events 💅 that means reissued CA certificates SHOULD use the same repository publication point as the previously issued CA certificates with the same subject and subject public key 👑 the certificate reissuance SHOULD intentionally overwrite the previously issued certificate within the repository publication point 🫶
Section 2.2 notes that when a CA does a key rollover, the entity SHOULD use a name for its repository publication point that persists across key rollover ✨ in that case the repository publication point holds the CRLs and manifests of both CA instances as a transient state of the key rollover procedure 🧚 the RPKI key rollover procedure [RFC6489] requires that the subordinate products of the old CA get overwritten in the common repository publication point by the subordinate products issued by the new CA 💖
5. Synchronizing Repositories with a Local Cache 🌈
it's possible to do certificate path construction with the retrieval of individual certificates, and to retrieve certificate revocation lists online, using individual certificates and sets of candidate certificates and certificate revocation lists based on the AIA, SIA, and CRLDP certificate fields 🙈 this is NOT recommended when speed and efficiency matter 😭
to validate RPKI certificates, CRLs, and signed objects efficiently, it is recommended that each relying party keep a local repository with a synchronized copy of all valid certificates, current certificate revocation lists, and all related signed objects 🫶
the general approach to repository synchronization is a "top-down" walk of the distributed repository structure ✨ it starts with collecting locally selected trust anchor material that matches the local choice of Trust Anchors, which can load the initial set of self-signed resource certificate(s) forming the "seed" of this process [RFC6490] 🦋 the process then fills the local repository cache with all valid certificates issued by these issuers 💅 this procedure can be applied recursively to each of these subordinate certificates 🔥 a repository traversal process SHOULD support a locally configured maximal chain length from the initial trust anchors 👑 without that, there might be a SIA pointer loop, or other degenerate forms of the logical RPKI hierarchy, that could make an RP malfunction during a repository synchronization operation with its local RPKI cache 💀
RPs SHOULD ensure this local synchronization uses the retrieved manifests [RFC6486] so they're synchronizing against a current, consistent state of each repository publication point 🌸 Section 3 notes that when repository publication point contents get updated, a repository operator can't assure RPs that the manifest contents and the repository contents will line up perfectly at all times 🍓 RPs SHOULD use a retrieval algorithm that accounts for this potential for transient inconsistency 🧚 to handle it, possible algorithms include synchronizing across the repository twice in succession, or retrieving the manifest both before and after synchronizing the directory contents and repeating the synchronization if the second copy of the manifest differs from the first 🎀
6. Security Considerations 💀
repositories are not assumed to be integrity-protected databases, and repository retrieval operations might be vulnerable to various forms of "man-in-the-middle" attacks 😭 an RP can detect corrupted retrieved objects by validating the signature associated with each retrieved object 🔥 replacing a newer instance of an object with an older instance of the same object is detectable through manifests 👑 inserting revoked or deleted certificates is detected by retrieving and processing CRLs on scheduled intervals 🫶 however, even manifests and CRLs won't let a relying party detect every form of substitution attack based on older (but not expired) valid objects 💀
confidentiality is not provided by the repository or by the signed objects published in it 🙈 data that's subject to controlled access should not be included in signed objects in the repository unless some specified mechanism is used to keep the data in the signed object confidential 🌈
7. IANA Considerations 🌸
7.1. Media Types 🦋
IANA has registered the following two media types 🎀
application/rpki-manifest
application/rpki-roathis document also uses the .cer and .crl file extensions from the application/pkix-cert and application/pkix-crl media registries defined in [RFC2585] 💅
7.1.1. application/rpki-manifest ✨
MIME media type name: application
MIME subtype name: rpki-manifest
Required parameters: None
Optional parameters: None
Encoding considerations: binary
Security considerations: Carries an RPKI Manifest [RFC6486]
Interoperability considerations: None
Published specification: This document
Applications that use this media type: Any MIME-complaint transport
Additional information:
Magic number(s): None
File extension(s): .mft
Macintosh File Type Code(s):
Person & email address to contact for further information:
Geoff Huston <gih@apnic.net>
Intended usage: COMMON
Author/Change controller: Geoff Huston <gih@apnic.net>7.1.2. application/rpki-roa 🧚
MIME media type name: application
MIME subtype name: rpki-roa
Required parameters: None
Optional parameters: None
Encoding considerations: binary
Security considerations: Carries an RPKI ROA [RFC6482]
Interoperability considerations: None
Published specification: This document
Applications that use this media type: Any MIME-complaint transport
Additional information:
Magic number(s): None
File extension(s): .roa
Macintosh File Type Code(s):
Person & email address to contact for further information:
Geoff Huston <gih@apnic.net>
Intended usage: COMMON
Author/Change controller: Geoff Huston <gih@apnic.net>7.2. RPKI Repository Name Scheme Registry ✨
okay so IANA made a brand new registry called "RPKI Repository Name Scheme" 🎀 and it's basically a list of three-letter filename extensions for RPKI repository objects 🦋. The registry is managed by IETF Review [RFC5226], so it's not a free-for-all 💅. Here's what's in it when it first shows up:
Filename extension RPKI Object Reference
.cer Certificate [RFC6481]
.crl Certificate Revocation List [RFC6481]
.mft Manifest [RFC6481]
.roa Route Origination Authorization [RFC6481]8. Acknowledgements 🫶
bestie, this doc got so much help from people who reviewed it and gave input: Stephen Kent, Matt Lepenski, Michael Elkins, Russ Housley, and Sean Turner 💜. Thank you, you're all iconic 👑.
9. References 📚
9.1. Normative References 🔥
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC6482] Lepinski, M., Kent, S., and D. Kong, "A Profile for Route Origin Authorizations (ROAs)", RFC 6482, February 2012.
- [RFC6486] Austein, R., Huston, G., Kent, S., and M. Lepinski, "Manifests for the Resource Public Key Infrastructure (RPKI)", RFC 6486, February 2012.
- [RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, February 2012.
- [RFC6488] Lepinski, M., Chi, A., and S. Kent, "Signed Object Template for the Resource Public Key Infrastructure (RPKI)", RFC 6488, February 2012.
- [RSYNC] rsync web pages, <http://rsync.samba.org/>.
9.2. Informative References 🌈
- [RFC2585] Housley, R. and P. Hoffman, "Internet X.509 Public Key Infrastructure Operational Protocols: FTP and HTTP", RFC 2585, May 1999.
- [RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP Addresses and AS Identifiers", RFC 3779, June 2004.
- [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, January 2005.
- [RFC4387] Gutmann, P., Ed., "Internet X.509 Public Key Infrastructure Operational Protocols: Certificate Store Access via HTTP", RFC 4387, February 2006.
- [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, October 2006.
- [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
- [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
- [RFC5781] Weiler, S., Ward, D., and R. Housley, "The rsync URI Scheme", RFC 5781, February 2010.
- [RFC6480] Lepinski, M. and S. Kent, "An Infrastructure to Support Secure Internet Routing", RFC 6480, February 2012.
- [RFC6489] Huston, G., Michaelson, G., and S. Kent, "Certification Authority (CA) Key Rollover in the Resource Public Key Infrastructure (RPKI)", BCP 174, RFC 6489, February 2012.
- [RFC6490] Huston, G., Weiler, S., Michaelson, G., and S. Kent, "Resource Public Key Infrastructure (RPKI) Trust Anchor Locator", RFC 6490, February 2012.
Authors' Addresses 💖
Geoff Huston APNIC EMail: gih@apnic.net URI: http://www.apnic.net
Robert Loomans APNIC EMail: robertl@apnic.net URI: http://www.apnic.net
George Michaelson APNIC EMail: ggm@apnic.net URI: http://www.apnic.net
📦 where this page comes from
- ietf: rfc6481 2012-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms