API Resources
Theme

Choose how MSRBot.io looks on this device.

Auto (match system) Light mode Dark mode

Preference is stored in this browser only.

IETF RFC 8360
[ACTIVE]

Resource Public Key Infrastructure (RPKI) Validation Reconsidered

Metadata

Publisher
IETF
Doc Type
Standard
Pages
29
Abstract
This document specifies an alternative to the certificate validation procedure specified in RFC 6487 that reduces aspects of operational fragility in the management of certificates in the Resource Public Key Infrastructure (RPKI), while retaining essential security features. The procedure specified in RFC 6487 requires that Resource Certificates are rejected entirely if they are found to overclaim any resources not contained on the issuing certificate, whereas the validation process defined here allows an issuing Certification Authority (CA) to chose to communicate that such Resource Certificates should be accepted for the intersection of their resources and the issuing certificate. It should be noted that the validation process defined here considers validation under a single trust anchor (TA) only. In particular, concerns regarding overclaims where multiple configured TAs claim overlapping resources are considered out of scope for this document. This choice is signaled by a set of alternative Object Identifiers (OIDs) per "X.509 Extensions for IP Addresses and AS Identifiers" (RFC 3779) and "Certificate Policy (CP) for the Resource Public Key Infrastructure (RPKI)" (RFC 6484). It should be noted that in case these OIDs are not used for any certificate under a trust anchor, the validation procedure defined here has the same outcome as the procedure defined in RFC 6487. Furthermore, this document provides an alternative to Route Origin Authorization (ROA) (RFC 6482) and BGPsec Router Certificate (BGPsec PKI Profiles -- publication requested) validation.
Publication Date
2018-04-01
Status Note
Proposed Standard
DOI
10.17487/RFC8360
Link
https://doi.org/10.17487/RFC8360
Author(s)
Geoff Huston
George Michaelson
Carlos Martinez-Cagnazzo
Tim Bruijnzeels
Andy Newton
Daniel Shaw
Latest version of IETF RFC 8360

Document Versions — IETF RFC 8360

  • ▶ IETF RFC 8360 (2018-04-01)
    THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

Bibliographic Reference(s)

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC8360.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree
Reference this Doc

Plain text (ISO 690 compliant)

Preview:
IETF RFC 8360, Resource Public Key Infrastructure (RPKI) Validation Reconsidered. Available at https://doi.org/10.17487/RFC8360
Snippet:
IETF RFC 8360, Resource Public Key Infrastructure (RPKI) Validation Reconsidered. Available at https://doi.org/10.17487/RFC8360

HTML (ISO 690 compliant)

Preview:
IETF RFC 8360, Resource Public Key Infrastructure (RPKI) Validation Reconsidered. Available at https://doi.org/10.17487/RFC8360
Snippet:
<span class="citation"><cite>IETF RFC 8360</cite>, Resource Public Key Infrastructure (RPKI) Validation Reconsidered. Available at <a href="https://doi.org/10.17487/RFC8360" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8360</a></span>

SMPTE Icon SMPTE's HTML Pub

Preview:
IETF RFC 8360, Resource Public Key Infrastructure (RPKI) Validation Reconsidered
doi: 10.17487/RFC8360
url: https://doi.org/10.17487/RFC8360
Snippet:
<li>
<cite id="bib-rfc8360">IETF RFC 8360</cite>, Resource Public Key Infrastructure (RPKI) Validation Reconsidered
<span class="doi">10.17487/RFC8360</span>
</li>

Referenced By