RFC 6493
The Resource Public Key Infrastructure (RPKI) Ghostbusters Record
The Resource Public Key Infrastructure (RPKI) Ghostbusters Record 👻🎀
Okay bestie, here's the title block tea ☕✨. This is RFC 6493, published by the IETF (Internet Engineering Task Force) in February 2012. The author is R. Bush from Internet Initiative Japan. It's a Standards Track doc, so it's an official Internet Standards Track document, and its ISSN is 2070-1721 💜. Okay, now let's get into it 🫶.
Abstract 🌸
So in the RPKI, resource certificates are extremely private 🙈. They hide names and anything else that could help you contact the people responsible when something goes wrong, like an expiring certificate, maintenance, rollovers, or compromises 😭. This doc introduces the RPKI Ghostbusters Record, which holds human contact info that a Certification Authority (CA) certificate can verify (indirectly) 🧚. The data inside is a severely profiled vCard 💅.
Status of This Memo 📋
This is an Internet Standards Track document 🦋.
This doc is a product of the IETF. It represents the consensus of the IETF community 👑. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check Section 2 of RFC 5741 ✨.
For the current status of this document, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6493 🔗.
Copyright Notice ©️
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved 💖.
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this doc 📜. Code Components pulled from this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They're also provided without warranty, as described in the Simplified BSD License 🧾.
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Requirements Language . . . . . . . . . . . . . . . . . . . . . 3
3. Suggested Reading . . . . . . . . . . . . . . . . . . . . . . . 3
4. RPKI Ghostbusters Record Payload Example . . . . . . . . . . . 4
5. vCard Profile . . . . . . . . . . . . . . . . . . . . . . . . . 4
6. CMS Packaging . . . . . . . . . . . . . . . . . . . . . . . . . 5
7. Validation . . . . . . . . . . . . . . . . . . . . . . . . . . 5
8. Security Considerations . . . . . . . . . . . . . . . . . . . . 6
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 6
9.1. OID . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
9.2. File Extension . . . . . . . . . . . . . . . . . . . . . . 6
9.3. Media Type . . . . . . . . . . . . . . . . . . . . . . . . 7
10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 7
11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 7
11.1. Normative References . . . . . . . . . . . . . . . . . . . 7
11.2. Informative References . . . . . . . . . . . . . . . . . . 81. Introduction 🧚♀️
Okay so in day-to-day RPKI operations, you sometimes need to contact the party responsible for a resource-holding CA certificate, human to human 💬. That's the certificate's maintainer. It could be whoever holds the certificate's private key, or an admin person in the org, or a NOC, etc. 🫠. A big example is when the operator of a prefix described by a Route Origin Authorization (ROA) spots a problem, or a problem that's about to happen, with a certificate or a Certificate Revocation List (CRL) on the path between the ROA and a trust anchor 🚨. Like, a certificate on that path has expired, or is about to, or a CRL for a CA on the path is stale. That puts the routing quality of the address space described by the ROA in serious jeopardy 😱.
Here's the tricky part 🙃. The names in RPKI certificates aren't meaningful to humans (see [RFC6484]), so there's no way to use a certificate itself to find the maintainer of the troublesome certificate or CRL. So, "Who you gonna call?" 👻📞
This document specifies the RPKI Ghostbusters Record 💖. It's an object verified via an end-entity (EE) certificate, which is issued under a CA certificate. The maintainer of that CA certificate can be contacted using the payload info in the Ghostbusters Record.
The Ghostbusters Record follows the syntax defined in [RFC6488]. The payload of this signed object is a severely profiled vCard 💅.
Quick note: the Ghostbusters Record is not an identity certificate 🙅♀️. It's more of an attestation to the contact data, made by the maintainer of the CA certificate that issued the EE certificate. That EE certificate's private key is what signs the Ghostbusters Record ✍️.
This record is NOT meant to replace or act as resource registry whois data 🚫. It only gives info about an RPKI CA certificate maintainer, not a resource holder 🌈.
The Ghostbusters Record is optional. CA certificates in the RPKI can have zero or more associated Ghostbusters Records 🍓.
So, given a certificate, to find the closest Ghostbusters Record, you go up until you reach a CA certificate. That could be the object itself, obviously 🔍. That CA certificate will have Subject Information Access (SIA) pointing to the publication point, where all the subsidiary objects are published. The subsidiary objects run until you hit a down-chain CA certificate's signed objects 🗺️. The publication point will contain zero or more Ghostbusters Records 📦.
This spec has three main sections 🎀. Section 5 is the format of the contact payload, which is a severely profiled vCard. Section 6 covers how the payload is packaged, as a profile of the RPKI Signed Object Template specification [RFC6488]. Section 7 describes how to properly validate the signed Ghostbusters Record ✅.
2. Requirements Language 🔑
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖.
3. Suggested Reading 📚
This doc assumes you already understand the RPKI [RFC6480], the RPKI Repository Structure [RFC6481], Signed RPKI Objects [RFC6488], and vCards [RFC6350] 🤓.
4. RPKI Ghostbusters Record Payload Example 🍰
Here's an example of an RPKI Ghostbusters Record payload with every property filled in 💅:
BEGIN:VCARD
VERSION:4.0
FN:Human's Name
ORG:Organizational Entity
ADR;TYPE=WORK:;;42 Twisty Passage;Deep Cavern;WA;98666;U.S.A.
TEL;TYPE=VOICE,TEXT,WORK;VALUE=uri:tel:+1-666-555-1212
TEL;TYPE=FAX,WORK;VALUE=uri:tel:+1-666-555-1213
EMAIL:human@example.com
END:VCARD5. vCard Profile 🧁
The whole point of profiling the vCard is NOT to pack in as much info as possible 🙅♀️. It's about including as FEW properties as possible, while still giving the minimum data needed to contact the maintainer of the RPKI data that threatens the ROA[s] of concern 🚨. Minimalist era, fr fr 🤍.
The Ghostbusters vCard payload is a minimalist subset of the vCard, as described in [RFC6350] ✨.
- BEGIN: this is pro forma packaging that MUST be the first line in the vCard, and MUST have the value
BEGIN:VCARD, as described in [RFC6350] 🎬. - VERSION: this is also pro forma packaging. It MUST be the second line in the vCard, and MUST have the value
VERSION:4.0, as described in Section 3.7.9 of [RFC6350] 🔢. - FN: the name, as described in Section 6.2.1 of [RFC6350], of a contactable person or role who is responsible for the CA certificate 🧑💼.
- ORG: an organization, as described in Section 6.6.4 of [RFC6350] 🏢.
- ADR: a postal address, as described in Section 6.3 of [RFC6350] 📮.
- TEL: a voice and/or fax phone number, as described in Section 6.4.1 of [RFC6350] ☎️.
- EMAIL: an Email address, as described in Section 6.4.2 of [RFC6350] 📧.
- END: this is pro forma packaging too. It MUST be the last line in the vCard, and MUST have the value
END:VCARD, as described in [RFC6350] 🏁.
Per [RFC6350], the BEGIN, VERSION, FN, and END properties MUST be included in a record 💅. To be useful, at least one of ADR, TEL, and EMAIL MUST be included 📱. Other properties MUST NOT be included 🙅♀️. Literally just the essentials, bestie 🫶.
6. CMS Packaging 📦💌
The Ghostbusters Record is a CMS signed-data object, conforming to the "Signed Object Template for the Resource Public Key Infrastructure (RPKI)" in [RFC6488] 🪄.
The content-type of a Ghostbusters Record is defined as id-ct-rpkiGhostbusters, and has the numerical value 1.2.840.113549.1.9.16.1.35 🔢. This OID MUST appear both within the eContentType in the encapContentInfo object, and as the content-type signed attribute in the signerInfo object. See [RFC6488] 🔍.
eContent: the content of a Ghostbusters Record is described in Section 5 📝.
Similar to a ROA, a Ghostbusters Record is verified using an EE certificate issued by the resource-holding CA certificate whose maintainer is described in the vCard 🪪.
The EE certificate used to verify the Ghostbusters Record is the one that appears in the CMS data structure containing the payload defined above 🎁.
This EE certificate MUST describe its Internet Number Resources using the "inherit" attribute, rather than an explicit description of a resource set. See [RFC3779] 🌿.
7. Validation ✅
The validation procedure defined in Section 3 of [RFC6488] is applied to a Ghostbusters Record 🔬. After that procedure has been done, the Version number type within the payload gets checked, and the OCTET STRING containing the vCard data gets extracted 🧪. That data is then checked against the profile defined in Section 5 of this document 📋. ONLY if all of these checks pass is the Ghostbusters payload deemed valid and made available to the application that requested it 💯.
8. Security Considerations 🔐
⚠️ Okay, this part is SERIOUS. Though there's no on-the-wire protocol in this spec, there are attacks that could abuse the data described. The data needs to be public to be useful, so little can be done to avoid this exposure 😭.
- Phone Numbers: the vCards may contain real-world telephone numbers, which could be abused for telemarketing, abusive calls, etc. 📞💀
- Email Addresses: the vCards may contain Email addresses, which could be abused for spam 📨🙈.
Relying parties are hereby warned that the data in a Ghostbusters Record is self-asserted 🚩. That data has NOT been verified by the CA that issued the CA certificate to the entity that issued the EE certificate used to validate the Ghostbusters Record 🫠.
9. IANA Considerations 🧾
9.1. OID 🔢
IANA has registered the OID for the Ghostbusters Record in the registry created by [RFC6488], as follows 💜:
Name OID Specification
-----------------------------------------------------------
Ghostbusters 1.2.840.113549.1.9.16.1.35 [RFC6493]9.2. File Extension 📁
Realizing the deep issues raised by [RFC5513], IANA has added an item for the Ghostbusters Record file extension to the "RPKI Repository Name Scheme" created by [RFC6481], as follows 🌸:
Filename Extension RPKI Object Reference
-----------------------------------------------------------
.gbr Ghostbusters Record [RFC6493]9.3. Media Type ✨
okay so IANA registered a brand new media type called application/rpki-ghostbusters 🦋 bestie, this is so cute. Here's the full registration form, exactly as it's filed:
The IANA has registered the media type application/rpki-ghostbusters
as follows:
Type name: application
Subtype name: rpki-ghostbusters
Required parameters: None
Optional parameters: None
Encoding considerations: binary
Security considerations: Carries an RPKI Ghostbusters Record
[RFC6493].
Interoperability considerations: None
Published specification: This document.
Applications that use this media type: RPKI administrators.
Additional information:
Content: This media type is a signed object, as defined
in [RFC6488], which contains a payload
of a profiled vCard as defined above in this document.
Magic number(s): None
File extension(s): .gbr
Macintosh file type code(s):
Person & email address to contact for further information:
Randy Bush <randy@psg.com>
Intended usage: COMMON
Restrictions on usage: None
Author: Randy Bush <randy@psg.com>
Change controller: Randy Bush <randy@psg.com>The vibe is: it's a signed object (per [RFC6488]) that carries a profiled vCard payload from earlier in the doc 💅. Randy Bush is the author, the contact, AND the change controller, so he's basically the main character of this media type 👑.
10. Acknowledgments 🫶
The author gave a big shoutout to Russ Housley, the authors of [RFC6481], Stephen Kent, Sandy Murphy, Rob Austein, Michael Elkins, and Barry Leiba for their contributions. Thank you, legends 💖🌸
11. References 📚
11.1. Normative References 🔒
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP
Addresses and AS Identifiers", RFC 3779, June 2004.
[RFC6350] Perreault, S., "vCard Format Specification", RFC 6350,
August 2011.
[RFC6481] Huston, G., Loomans, R., and G. Michaelson, "A Profile for
Resource Certificate Repository Structure", RFC 6481,
February 2012.
[RFC6488] Lepinski, M., Chi, A., and S. Kent, "Signed Object
Template for the Resource Public Key Infrastructure
(RPKI)", RFC 6488, February 2012.11.2. Informative References 🧚
[RFC5513] Farrel, A., "IANA Considerations for Three Letter
Acronyms", RFC 5513, April 1 2009.
[RFC6480] Lepinski, M. and S. Kent, "An Infrastructure to Support
Secure Internet Routing", RFC 6480, February 2012.
[RFC6484] Kent, S., Kong, D., Seo, K., and R. Watro, "Certificate
Policy (CP) for the Resource Public Key Infrastructure
(RPKI)"", RFC 6484, February 2012.Author's Address 📮
Randy Bush
Internet Initiative Japan
5147 Crystal Springs
Bainbridge Island, Washington 98110
US
Phone: +1 206 780 0431 x1
EMail: randy@psg.comThat's the whole RFC, bestie! 🌈 Randy built a tiny, very focused media type for RPKI Ghostbusters records, and it's giving well-organised, no notes 💅✨
📦 where this page comes from
- ietf: rfc6493 2012-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms