The Use of maxLength in the Resource Public Key Infrastructure (RPKI)

Metadata

Publisher: IETF
Doc Type: Best Practice
Pages: 13
Abstract: This document recommends ways to reduce the forged-origin hijack attack surface by prudently limiting the set of IP prefixes that are included in a Route Origin Authorization (ROA). One recommendation is to avoid using the maxLength attribute in ROAs except in some specific cases. The recommendations complement and extend those in RFC 7115. This document also discusses the creation of ROAs for facilitating the use of Distributed Denial of Service (DDoS) mitigation services. Considerations related to ROAs and RPKI-based Route Origin Validation (RPKI-ROV) in the context of destination-based Remotely Triggered Discard Route (RTDR) (elsewhere referred to as "Remotely Triggered Black Hole") filtering are also highlighted.
Publication Date: 2022-10-01
Status Note: Best Current Practice
DOI: 10.17487/RFC9319
Link: https://doi.org/10.17487/RFC9319
Author(s): Yossi Gilad
Sharon Goldberg
Kotikalapudi Sriram
Job Snijders
Ben Maddison
Keyword(s): Secure Internet Routing, RPKI

Latest version of IETF RFC 9319

Document Versions — IETF RFC 9319

▶ IETF RFC 9319 (2022-10-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 1918 [Active*]
IETF RFC 2119 [Active*]
IETF RFC 4271 [Active*]
IETF RFC 6480 [Active*]
IETF RFC 6482 [Superseded*]
IETF RFC 6811 [Active*]
IETF RFC 7115 [Active*]
IETF RFC 8174 [Active*]

Bibliographic Reference(s)

10.1145-2896817 — LSG16 EXTERNAL
10.1145-3143361.3143363 — GSG17 EXTERNAL
Gilad, Y., Cohen, A., Herzberg, A., Schapira, M., and H. Shulman, "Are We There Yet? On RPKI's Deployment and Security", NDSS 2017, February 2017, <https://eprint.iacr.org/2016/1010.pdf>. EXTERNAL
IETF RFC 5737 [Active*]
IETF RFC 6907 [Active*]
RFC7999 — RFC7999 EXTERNAL
IETF RFC 8205 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9319.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9319, The Use of maxLength in the Resource Public Key Infrastructure (RPKI). Available at https://doi.org/10.17487/RFC9319

Snippet:

IETF RFC 9319, The Use of maxLength in the Resource Public Key Infrastructure (RPKI). Available at https://doi.org/10.17487/RFC9319

HTML (ISO 690 compliant)

Preview:

IETF RFC 9319, The Use of maxLength in the Resource Public Key Infrastructure (RPKI). Available at https://doi.org/10.17487/RFC9319

Snippet:

<span class="citation"><cite>IETF RFC 9319</cite>, The Use of maxLength in the Resource Public Key Infrastructure (RPKI). Available at <a href="https://doi.org/10.17487/RFC9319" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9319</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9319, The Use of maxLength in the Resource Public Key Infrastructure (RPKI)
doi: 10.17487/RFC9319
url: https://doi.org/10.17487/RFC9319

Snippet:

<li>
<cite id="bib-rfc9319">IETF RFC 9319</cite>, The Use of maxLength in the Resource Public Key Infrastructure (RPKI)
<span class="doi">10.17487/RFC9319</span>
</li>

Referenced By

IETF RFC 9582 [Active*]
IETF RFC 9774 [Active*]