RFC 6483
Validation of Route Origination Using the Resource Certificate Public Key Infrastructure (PKI) and Route Origin Authorizations (ROAs)
Validation of Route Origination Using the Resource Certificate PKI and ROAs 🎀
okay bestie, let's start with the paperwork ✨ This one is RFC 6483, and its full title is Validation of Route Origination Using the Resource Certificate Public Key Infrastructure (PKI) and Route Origin Authorizations (ROAs). It was written by G. Huston and G. Michaelson, both at APNIC, and it's marked as Informational, so it's published for information and isn't a Standards Track spec 💅 The date is February 2012 and the ISSN is 2070-1721. The title block doesn't list anything it obsoletes or updates 🌸
Abstract ✨
this doc defines what a Route Origin Authorization (ROA) means, in the context of using the Resource Public Key Infrastructure to check that routes sent over the Border Gateway Protocol really come from who they say they do 🦋
Status of This Memo 🧚
this one is not an Internet Standards Track spec. It's published for informational purposes 💜
it's an IETF product and it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 if you want the details 🙈
you can find the current status, any errata, and how to send feedback at http://www.rfc-editor.org/info/rfc6483 🔥
Copyright Notice 💖
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the publication date. Read those carefully, because they spell out your rights and restrictions 📜 Code Components extracted from this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License.
Table of Contents 🌈
1. Introduction ....................................................2
2. ROA Validation Outcomes for a Route .............................3
3. Applying Validation Outcomes to Route Selection .................5
4. Disavowal of Routing Origination ................................6
5. Route Validation Lifetime .......................................6
6. Security Considerations .........................................7
7. Acknowledgements ................................................7
8. References ......................................................8
8.1. Normative References .......................................8
8.2. Informative References .....................................81. Introduction ✨
okay so this doc defines what a Route Origin Authorization (ROA) means, specifically when you're using the Resource Public Key Infrastructure (RPKI) [RFC6480] to check that routes advertised in the Border Gateway Protocol (BGP) [RFC4271] are being originated legitimately 💅
the RPKI is built as a hierarchy of resource certificates that line up with the Internet Number Resource allocation structure 🌳 Resource certificates are X.509 certificates that follow the PKIX profile [RFC5280], plus the extensions for IP addresses and AS identifiers [RFC3779]. A resource certificate is basically an issuer's action that binds a list of IP address blocks and Autonomous System (AS) numbers to the subject of the certificate. The subject is identified by the unique link between their private key and the public key inside the resource certificate 🔑 The RPKI is structured so that each current resource certificate matches a current resource allocation or assignment. More on that in [RFC6480] 🎀
ROAs are digitally signed objects. They bind an address to an AS number, and the address holder is the one who signs them 🖊️ A ROA is how you verify that an IP address block holder has authorized a particular AS to originate routes in the inter-domain routing environment for that block. ROAs are described in [RFC6482] 🦋 They're also meant to fit the requirements for adding security to inter-domain routing, so it's giving intentional design 👑
this document describes how to interpret a ROA semantically. It focuses on how it applies to inter-domain routing when routes are being originated, and on the intended scope of the authority that the ROA conveys 🧚
2. ROA Validation Outcomes for a Route 🌸
a "route" is a unit of information that associates a set of destinations, described by an IP address prefix, with a set of path attributes to those destinations, as defined in Section 1.1 of [RFC4271] 🛤️
a route's "origin AS" is defined like this. If the final path segment of the AS_PATH is of type AS_SEQUENCE, the origin AS is the first element of that sequence. That's the AS in the rightmost position, relative to where the octets sit in the protocol message 🍓 If the AS_PATH contains a path segment of type AS_SET, which means the route is an aggregate, then the origin AS cannot be determined 🙈 When you validate a route in a routing environment, the address prefix value and the origin AS are the two things used in the ROA validation operation 💜
it's assumed that a relying party (RP) has a local cache of the complete set of valid ROAs when it validates a route. (Valid ROAs are the ones that are syntactically correct and signed with a signature that can be verified using the RPKI, as described in [RFC6482].) The RP needs to match a route to one or more valid candidate ROAs so it can work out a validation outcome. That outcome is then what it uses to decide the local actions to take on the route 🔥
this approach uses a generic model of "positive" attestation. The inference is that routes which can't be validated within the RPKI framework would normally be read by an RP as "invalid". BUT, and this is the twist, partial adoption is a real thing. Only a subset of validly advertised address prefixes have ROAs published in the RPKI, so the model needs a tweak 🫶 In the context of route validation, once an address prefix is described in a ROA, that ROA is assumed to cover every address prefix more specific than the one it describes. So any route for a more specific prefix than one described by a valid ROA, which doesn't have its own matching valid ROA, can be considered "invalid" ✨ Routes for prefixes that aren't fully described by any single ROA are different. Those are routes whose prefixes might be an aggregate of prefixes described in a valid ROA, or prefixes that don't intersect with any valid ROA at all. If a route like that isn't matched by any valid ROA, and doesn't have a more specific prefix described in any valid ROA, it can't be reliably called "invalid" in a partial deployment. Those routes get a validation outcome of "unknown" 🌈
an abstract attribute of a route, a "validity state" [BGP-PFX], can be determined as the outcome of this validation procedure. The validity state of a route, using a prefix and an origin AS as defined above, when a single ROA is used to work out that state, is summed up in the table below 🎀
Route matching non-matching
Prefix AS-> AS AS
V +---------+---------+
Non- | unknown | unknown |
Intersecting | | |
+---------+---------+
Covering | unknown | unknown |
Aggregate | | |
+---------+---------+
match ROA | valid | invalid |
prefix | | |
+---------+---------+
More | | |
Specific | invalid | invalid |
than ROA | | |
+---------+---------+
Route's Validity Stateso with a collection of valid ROAs, a route's validity state is "valid" if any ROA gives a "valid" outcome. It's "invalid" if one (or more) ROAs give an "invalid" outcome and no ROA gives a "valid" outcome. It's "unknown" (or, synonymously, "not found" [BGP-PFX]) when no valid ROA can produce either a "valid" or an "invalid" outcome 💅
the route validity state is worked out with this procedure 👑
- Select all valid ROAs that include a ROAIPAddress value that either matches, or is a covering aggregate of, the address prefix in the route. This selection forms the set of "candidate ROAs" 🦋
- If the set of candidate ROAs is empty, the procedure stops with an outcome of "unknown" (or, synonymously, "not found", as used in [BGP-PFX]) 🙈
- If the route's origin AS can be determined, and any of the set of candidate ROAs has an asID value that matches the origin AS in the route, and the route's address prefix matches a ROAIPAddress in the ROA, then the procedure halts with an outcome of "valid". Here "match" means either the route's address precisely matches the ROAIPAddress, or the ROAIPAddress includes a maxLength element, the route's address prefix is a more specific prefix of the ROAIPAddress, and the route's address prefix length value is less than or equal to the ROAIPAddress maxLength value 🍓
- Otherwise, the procedure halts with an outcome of "invalid" 💀
part 1 is all wrapped up at Section 2 🧚 part 2 picks up with Section 3 and everything after it, including the references 🫶
3. Applying Validation Outcomes to Route Selection ✨
okay so picture the BGP routing world 🌐. A route announcement for a prefix shows up from one peer, and it gets lined up against every other announcement for that same prefix from the other peers, [RFC4271] style. Then the route selection procedure picks the "best" one from that candidate pile 👑.
The validity state from Section 2 ("valid", "invalid", or "unknown") may be used when deciding local degree of preference. If it is, the local order of preference goes like this 💅:
"valid" is to be preferred over
"unknown", which is to be preferred over
"invalid".What to do with "unknown" routes is up to each network's local routing policy 🤷♀️. Because the public Internet is a messy patchwork where not everyone uses ROAs yet, it is advised that local policy should not treat an "unknown" outcome as enough reason to reject a route outright from consideration as a local best route. Be generous, bestie 🫶.
Whether "invalid" routes get cut from the route selection process is also a local policy call 🔥. There's a sneaky circular dependency to watch for here 😭. If the publication point for the ROA repository (or for any certificate tied to a prefix) sits at an address inside a prefix described by a ROA, then the RP can only reach that repository after its local routing domain has already accepted a route for that prefix. Also, RPKI objects can propagate on a different clock than routes do. A route might show up in an RP's routing system before its local RPKI repository cache has grabbed the matching ROA and marked it "valid" within the RPKI 🙈.
4. Disavowal of Routing Origination 🚫
A ROA is a positive attestation 💖. It says a prefix holder has authorized an AS to originate a route for that prefix into the inter-domain routing system. Here's the plot twist: a prefix holder can also basically say "nobody gets to originate this" 💀. They do that with a ROA whose subject AS is one that must not be used in any routing context. AS 0 is the one reserved by IANA for exactly this job, so it can be used to identify non-routed networks [IANA-AS] 🧚.
A ROA with a subject of AS 0 (the AS 0 ROA) is the prefix holder saying, "this prefix, and anything more specific than it, should not be used in a routing context" 🙅♀️.
Now the validation procedure from Section 2 hands out a "valid" outcome if any ROA matches the prefix and origin AS 🎯. That's true even if other valid ROAs would have produced "invalid" if they were used alone. So an AS 0 ROA ends up with lower relative preference than any ROA whose subject is a routable AS. This lets a prefix holder set up a default "invalid" for any route equal to or more specific than the prefix, while other ROAs issued at the same time still authorize valid origination for more specific prefixes. Iconic layering, honestly ✨.
By convention, an AS 0 ROA should have a maxLength value of 32 for IPv4 addresses and a maxlength value of 128 for IPv6 addresses 📏. Even so, route validation would come out the same with any valid maxLength value, or even if the maxLength element were left out of the ROA entirely.
Also by convention, an AS 0 ROA should be the only ROA issued for a given address prefix 🌸. Again, that's not a strict requirement. An AS 0 ROA can sit alongside ROAs with different subject AS values. In that situation, having or not having the AS 0 ROA doesn't change the route's validity state at all 🤷♀️.
5. Route Validation Lifetime ⏳
The "lifetime" of a validation outcome is the stretch of time when that original outcome can still be applied 🕰️. The implicit idea is that once the validation lifetime "expires", the route should be checked for validity again 🔄.
For a ROA, the validation lifetime is controlled by the Valid times in the end-entity (EE) certificate used to sign the ROA. It's also controlled by the valid times of the certificates in the certification path used to validate that EE certificate 📜. A ROA validation expires at the notAfter field of the signing EE certificate, or earlier if there's no certification path left that can validate the ROA 😱. And a ROA issuer can cut things off early by revoking the EE certificate that signed the ROA 🗡️.
6. Security Considerations 🛡️
ROA issuers need to know what they're signing up for 🚨. Issuing a ROA implicitly invalidates every route with a more specific prefix whose length is greater than maxLength, and every origin AS other than the AS listed in the collection of ROAs for that prefix. That's a lot of power, bestie 😭.
A conservative operational practice is to issue ROAs for all the more specific prefixes with distinct origination ASes before issuing ROAs for the larger encompassing address blocks 🧱. Doing it in that order helps avoid accidentally invalidating valid routes while ROAs are being generated 🫠.
ROA issuers should also know that if they make a ROA for one origin AS, and the address prefix holder authorizes multiple ASes to originate routes for that prefix, then a ROA is necessary for every one of those authorized ASes 🔐. No skipping ✨.
7. Acknowledgements 🫶
The authors want to give a huge shout-out to John Scudder and Stephen Kent for their helpful contributions to this document 💜. They also thank the many members of the SIDR working group who gave feedback when this material was presented in SIDR WG sessions 🌈. Tony Bates, Randy Bush, Tony Li, and Yakov Rekhter get credit too, since the validation outcomes here mirror the authentication outcomes and semantics of origin AS verification described in [NLRI-ORIG] 👑. And a bunch of validation concepts for a route's validity state from [BGP-PFX], edited by Pradosh Mohapatra, et al., have been used in this document 🦋.
8. References 📚
8.1. Normative References
[RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP
Addresses and AS Identifiers", RFC 3779, June 2004.
[RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A
Border Gateway Protocol 4 (BGP-4)", RFC 4271, January
2006.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation
List (CRL) Profile", RFC 5280, May 2008.
[RFC6480] Lepinski, M. and S. Kent, "An Infrastructure to Support
Secure Internet Routing", RFC 6480, February 2012.
[RFC6482] Lepinski, M., Kent, S., and D. Kong, "A Profile for Route
Origin Authorizations (ROAs)", RFC 6482, February 2012.8.2. Informative References
[BGP-PFX] Mohapatra, P., Ed., Scudder, J., Ed., Ward, D., Ed.,
Bush, R., Ed., and R. Austein, Ed., "BGP Prefix Origin
Validation", Work in Progress, October 2011.
[IANA-AS] IANA, "Autonomous System (AS) Numbers",
http://http://www.iana.org/assignments/as-numbers
[NLRI-ORIG] Bates, T., Bush, R., Li, T., and Y. Rekhter, "DNS-based
NLRI origin AS verification in BGP", Work in Progress,
January 1998.Authors' Addresses 🎀
Geoff Huston
APNIC
EMail: gih@apnic.net
George Michaelson
APNIC
EMail: ggm@apnic.net📦 where this page comes from
- ietf: rfc6483 2012-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms