An RDAP Extension for RPKI Registration Data

Introduction The network operators are increasingly deploying the Resource Public Key Infrastructure (RPKI, ) to secure inter-domain routing () on the internet. RPKI enables Internet Number Resource (INR) holders to cryptographically assert about their registered IP addresses and autonomous system numbers to prevent route hijacks and leaks. To that end, RPKI defines the following cryptographic profiles:

Route Origin Authorization (ROA, ) where a Classless Inter-Domain Routing (CIDR, ) address block holder cryptographically asserts about the origin autonomous system (AS, ) for routing that CIDR address block.
Autonomous System Provider Authorization (ASPA, ) where an autonomous system number (ASN, ) holder cryptographically asserts about the provider AS for that ASN.
X.509 Resource Certificate () where the issuer grants the subject a right-of-use for the listed IP addresses and/or autonomous system numbers.

This document defines a new RDAP extension, "rpki1", for accessing the RPKI registration data within the Internet Number Registry System (INRS) for aforementioned RPKI profiles through RDAP. The Internet Number Registry System (INRS) is composed of Regional Internet Registries (RIRs), National Internet Registries (NIRs), and Local Internet Registries (LIRs). The motivation here is that such RDAP data could complement the existing RPKI diagnostic tools when troubleshooting a route hijack or leak, by conveniently providing access to registration information from a registry's database beside what is inherently available from an RPKI profile object. There is registration metadata that is often needed for troubleshooting that does not appear in, say, a ROA or a VRP (Verified ROA Payload); such as:

When did the initial version of a ROA get published?
Was a ROA created in conjunction with an Internet Routing Registry (IRR, ) route?
Which IRR route is related with a ROA?
Which IP network is associated with a ROA?

Furthermore, correlating registered RPKI data with registered IP networks and autonomous system numbers would also give access to the latter's contact information through RDAP entity objects, which should aid troubleshooting. In addition to troubleshooting, serving RPKI metadata over RDAP offers a convenience to network operators through a simple lookup mechanism. As is demonstrated in , constructing custom RDAP scripts is relatively easy and beneficial to network operators for the purposes of reporting. Though not RDAP-based, systems such as and have shown the utility of an approach that allows users to explore the RPKI hierarchy in a visual fashion, without interacting with the signed objects directly. For these purposes, this specification defines RDAP object classes, as well as lookup and search path segments, for the ROA, ASPA, and X.509 resource certificate registration data.

Requirements Language The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in when, and only when, they appear in all capitals, as shown here. Indentation and whitespace in examples are provided only to illustrate element relationships, and are not a REQUIRED feature of this protocol. "..." in examples is used as shorthand for elements defined outside of this document.

Common Data Members The RDAP object classes for RPKI (, , ) can contain one or more of the following common members:

"handle" -- a string representing the registry-unique identifier of an RPKI object registration
"name" -- a string representing the identifier assigned to an RPKI object registration by the registration holder
"notValidBefore" -- a string that contains the time and date in Zulu (Z) format with UTC offset of 00:00 (), representing the not-valid-before date of an X.509 resource certificate for an RPKI object ()
"notValidAfter" -- a string that contains the time and date in Zulu (Z) format with UTC offset of 00:00 (), representing the not-valid-after date of an X.509 resource certificate for an RPKI object ()
"publicationUri" -- a URI string pointing to the location of an RPKI object within an RPKI repository; the URI scheme is "rsync", per
"notificationUri" -- an HTTPS URI string pointing to the location of the RPKI Repository Delta Protocol (RRDP) update notification file for an RPKI repository ()
"entities" -- an array of entity objects (), including the organization (entity) registered as the authoritative source for an RPKI object
"rpkiType" -- a string literal representing various combinations of an RPKI repository and a Certification Authority (CA), with the following possible values:
- "hosted" -- both the repository and CA are operated by a registry for an organization with allocated resources
- "delegated" -- both the repository and CA are operated by an organization with resources allocated by a registry
- "hybrid" -- the repository is operated by a registry for an organization with allocated resources whereas the CA is operated by the organization itself

RRDP is intended as the long-term replacement for rsync in RPKI. For a CA that implements RRDP, the update notification file location is expected to be set in each X.509 resource certificate it issues (). Consequently, the "notificationUri" data should help inform about the RPKI repository and/or CA operated downstream from a registry by an organization with resources allocated by that registry.

Route Origin Authorization

Object Class The Route Origin Authorization (ROA) object class can contain the following members:

"objectClassName" -- the string "rpki1_roa"
"handle" -- see
"name" -- see
"roaIps" -- an array of objects representing CIDR address blocks within a ROA; such an object can contain the following members:
- "ip" -- a string representing an IPv4 or IPv6 CIDR address block with the "<CIDR prefix>/<CIDR length>" format ()
- "maxLength" -- a number representing the maximum prefix length of the CIDR address block that the origin AS is authorized to advertise; up to 32 for IPv4 and up to 128 for IPv6 ()
"originAutnum" -- an unsigned 32-bit integer representing the origin autonomous system number ()
"notValidBefore" -- see
"notValidAfter" -- see
"publicationUri" -- see
"notificationUri" -- see
"entities" -- see
"rpkiType" -- see
"events" -- see
"links" -- "self" link, and "related" links for IP network and IRR (when defined) objects ()
"remarks" -- see

Here is an elided example of a ROA object:

Lookup The resource type path segment for exact or closest match lookup of a ROA object is "rpki1/roa". The following lookup path segments are defined for a ROA object: Syntax: rpki1/roa/<handle> Syntax: rpki1/roa/<IP address> Syntax: rpki1/roa/<CIDR prefix>/<CIDR length> A lookup query for ROA information by handle is specified using this form: rpki1/roa/XXXX XXXX is a string representing the "handle" property of a ROA, as described in . The following URL would be used to find information for a ROA that exactly matches the "8a848ab0729f0f4f0173ba2013bc5eb3" handle: A lookup query for ROA information by IP address is specified using this form: rpki1/roa/YYYY YYYY is a string representing an IPv4 or IPv6 address. The following URL would be used to find information for a ROA that completely encompasses the "192.0.2.0" IP address: Similarly, for the "2001:db8::" IP address: A lookup query for ROA information by CIDR is specified using this form: rpki1/roa/YYYY/ZZZZ YYYY/ZZZZ is a string representing the "ip" property of a CIDR address block within a ROA, as described in . The following URL would be used to find information for the most-specific ROA matching the "192.0.2.0/25" CIDR: Similarly, for the "2001:db8::/64" CIDR: In the "links" array of a ROA object, the context URI ("value" member) of each link should be the lookup URL by its handle, and if that's not available, then the lookup URL by one of its IP addresses.

Search The resource type path segment for searching ROA objects is "rpki1/roas". The following search path segments are defined for ROA objects: Syntax: rpki1/roas?name=<name search pattern> Syntax: rpki1/roas?originAutnum=<autonomous system number> Searches for ROA information by name are specified using this form: rpki1/roas?name=XXXX XXXX is a search pattern per , representing the "name" property of a ROA, as described in . The following URL would be used to find information for ROA names matching the "ROA-*" pattern: Searches for ROA information by origin autonomous system number are specified using this form: rpki1/roas?originAutnum=BBBB BBBB is an autonomous system number representing the "originAutnum" property of a ROA, as described in . The following URL would be used to find information for ROAs with origin autonomous system number 65536:

Search Results The ROA search results are returned in the "rpki1_roaSearchResults" member, which is an array of ROA objects (). Here is an elided example of the search results when finding information for ROAs with origin autonomous system number 65536:

Reverse Search Per , if a server receives a reverse search query with a searchable resource type of "ips" (), a related resource type of "rpki1_roa", and a ROA property of "originAutnum" or "ip", then the reverse search will be performed on the IP network objects from its data store. and include registration of entries for IP network searches in the RDAP Reverse Search and RDAP Reverse Search Mapping IANA registries when the related resource type is "rpki1_roa".

Relationship with IP Network Object Class An IP network object can span multiple ROA objects, and vice-versa. Their relationship is affected by IP address transfers and splits in a registry. It would be useful to show all the ROA objects associated with an IP network object. To that end, this extension adds a new "rpki1_roas" member to the IP Network object class ():

"rpki1_roas" -- an array of ROA objects () associated with an IP network object; if the array is too large, the server MAY truncate it, per

Here is an elided example for an IP network object with ROAs:

Autonomous System Provider Authorization

Object Class The Autonomous System Provider Authorization (ASPA) object class can contain the following members:

"objectClassName" -- the string "rpki1_aspa"
"handle" -- see
"name" -- see
"autnum" -- an unsigned 32-bit integer representing an autonomous system number of the registration holder ()
"providerAutnums" -- an array of unsigned 32-bit integers, each representing the autonomous system number of an AS that is authorized as a provider ()
"notValidBefore" -- see
"notValidAfter" -- see
"publicationUri" -- see
"notificationUri" -- see
"entities" -- see
"rpkiType" -- see
"events" -- see
"links" -- "self" link, and "related" links for autonomous system number and IRR (when defined) objects ()
"remarks" -- see

Here is an elided example of an ASPA object:

Lookup The resource type path segment for exact match lookup of an ASPA object is "rpki1/aspa". The following lookup path segments are defined for an ASPA object: Syntax: rpki1/aspa/<handle> Syntax: rpki1/aspa/<autonomous system number> A lookup query for ASPA information by handle is specified using this form: rpki1/aspa/XXXX XXXX is a string representing the "handle" property of an ASPA, as described in . The following URL would be used to find information for an ASPA that exactly matches the "47ab80ed8693f25d0187d93a07db4484" handle: A lookup query for ASPA information by autonomous system number is specified using this form: rpki1/aspa/YYYY YYYY is an autonomous system number representing the "autnum" property of an ASPA, as described in . The following URL would be used to find information for an ASPA with autonomous system number 65536: In the "links" array of an ASPA object, the context URI ("value" member) of each link should be the lookup URL by its handle, and if that's not available, then the lookup URL by its autonomous system number.

Search The resource type path segment for searching ASPA objects is "rpki1/aspas". The following search path segments are defined for ASPA objects: Syntax: rpki1/aspas?name=<name search pattern> Syntax: rpki1/aspas?providerAutnum=<autonomous system number> Searches for ASPA information by name are specified using this form: rpki1/aspas?name=XXXX XXXX is a search pattern per , representing the "name" property of an ASPA, as described in . The following URL would be used to find information for ASPA names matching the "ASPA-*" pattern: Searches for ASPA information by provider autonomous system number are specified using this form: rpki1/aspas?providerAutnum=YYYY YYYY is an autonomous system number within the "providerAutnums" property of an ASPA, as described in . The following URL would be used to find information for ASPAs with provider autonomous system number 65542:

Search Results The ASPA search results are returned in the "rpki1_aspaSearchResults" member, which is an array of ASPA objects (). Here is an elided example of the search results when finding information for ASPAs with provider autonomous system number 65542:

Reverse Search Per , if a server receives a reverse search query with a searchable resource type of "autnums" (), a related resource type of "rpki1_aspa", and an ASPA property of "autnum" or "providerAutnum", then the reverse search will be performed on the autonomous system number objects from its data store. and include registration of entries for autonomous system number searches in the RDAP Reverse Search and RDAP Reverse Search Mapping IANA registries when the related resource type is "rpki1_aspa".

Relationship with Autonomous System Number Object Class An autonomous system number object for an ASN range can span multiple ASPA objects. However, an ASPA object can only be linked to a single autonomous system number object. It would be useful to show all the ASPA objects associated with an autonomous system number object. To that end, this extension adds a new "rpki1_aspas" member to the Autonomous System Number object class ():

"rpki1_aspas" -- an array of ASPA objects () for the autonomous system number range in the autonomous system number object; if the array is too large, the server MAY truncate it, per

Here is an elided example for an autonomous system number object with ASPAs:

X.509 Resource Certificate

Object Class The X.509 resource certificate object class can contain the following members:

"objectClassName" -- the string "rpki1_x509ResourceCert"
"handle" -- see
"serialNumber" -- a string representing the unique identifier for the certificate ()
"issuer" -- a string representing the CA that issued the certificate ()
"signatureAlgorithm" -- a string representing the algorithm used by the CA to sign the certificate ()
"subject" -- a string representing the identity of the subject the certificate is issued to ()
"subjectPublicKeyInfo" -- an object representing the subject's public key information (), with the following members:
- "publicKeyAlgorithm" -- a string representing the algorithm for the public key
- "publicKey" -- a string representation of the public key
"subjectKeyIdentifier" -- a string, typically Base64-encoded, representing the unique identifier for the public key ()
"ips" -- an array of strings, each representing an IPv4 or IPv6 CIDR address block with the "<CIDR prefix>/<CIDR length>" format ()
"autnums" -- an array of unsigned 32-bit integers, each representing an autonomous system number ()
"notValidBefore" -- see
"notValidAfter" -- see
"publicationUri" -- see
"notificationUri" -- see
"entities" -- see
"rpkiType" -- see
"events" -- see
"links" -- "self" link, and "related" links for IP network and/or autonomous system number objects ()
"remarks" -- see

The following types of certificates can be represented using this object class:

a CA certificate that a registry issues to an organization for its allocated IP addresses and/or autonomous system numbers, authorizing the organization CA to issue end-entity certificates
a BGPSec router certificate () where an ASN(s) holder cryptographically asserts that a router holding the corresponding private key is authorized to emit secure route advertisements on behalf of the AS(es) specified in the certificate

Here is an elided example of an X.509 resource certificate object for a CA certificate: Here is an elided example of an X.509 resource certificate object for a BGPSec router certificate:

Lookup The resource type path segment for exact match lookup of an X.509 resource certificate object is "rpki1/x509_resource_cert". The following lookup path segment is defined for an X.509 resource certificate object: Syntax: rpki1/x509_resource_cert/<handle> For example:

Search The resource type path segment for searching X.509 resource certificate objects is "rpki1/x509_resource_certs". The following search path segments are defined for X.509 resource certificate objects: Syntax: rpki1/x509_resource_certs?handle=<handle search pattern> Syntax: rpki1/x509_resource_certs?issuer=<issuer search pattern> Syntax: rpki1/x509_resource_certs?subject=<subject search pattern> Syntax: rpki1/x509_resource_certs?subjectKeyIdentifier=<subject key identifier> Syntax: rpki1/x509_resource_certs?ip=<IP address> Syntax: rpki1/x509_resource_certs?cidr=<CIDR> Syntax: rpki1/x509_resource_certs?autnum=<autonomous system number> Searches for X.509 resource certificate information by handle are specified using this form: rpki1/x509_resource_certs?handle=XXXX XXXX is a search pattern per , representing the "handle" property of an X.509 resource certificate object, as described in . The following URL would be used to find information for X.509 resource certificate objects with handle matching the "EFG*" pattern: Searches for X.509 resource certificate information by certificate issuer are specified using this form: rpki1/x509_resource_certs?issuer=YYYY YYYY is a search pattern per , representing the "issuer" property of an X.509 resource certificate object, as described in . The following URL would be used to find information for X.509 resource certificate objects with issuer matching the "CN=ISP-*" pattern: Searches for X.509 resource certificate information by certificate subject are specified using this form: rpki1/x509_resource_certs?subject=ZZZZ ZZZZ is a search pattern per , representing the "subject" property of an X.509 resource Certificate object, as described in . The following URL would be used to find information for X.509 resource certificate objects with subject matching the "CN=ISP-BGPSEC-ROUTE*" pattern: Searches for X.509 resource certificate information by subject key identifier are specified using this form: rpki1/x509_resource_certs?subjectKeyIdentifier=BBBB BBBB is a string representing the "subjectKeyIdentifier" property of an X.509 resource certificate object, as described in . The following URL would be used to find an X.509 resource certificate object with subject key identifier matching the "iOcGgxqXDa7mYv78fR+sGBKMtWJqItSLfaIYJDKYi8A=" string: Searches for X.509 resource certificate information by an IP address are specified using this form: rpki1/x509_resource_certs?ip=CCCC CCCC is a string representing an IPv4 or IPv6 address. The following URL would be used to find information for X.509 resource certificate objects with the "ips" member encompassing the "192.0.2.0" IP address: Similarly, for the "2001:db8::" IP address: Searches for X.509 resource certificate information by a CIDR are specified using this form: rpki1/x509_resource_certs?cidr=CCCC/DDDD CCCC/DDDD is a string representing an IPv4 or IPv6 CIDR, with CCCC as the CIDR prefix and DDDD as the CIDR length. The following URL would be used to find information for X.509 resource certificate objects with the "ips" member encompassing the "192.0.2.0/25" CIDR: Similarly, for the "2001:db8::/64" CIDR: Searches for X.509 resource certificate information by an autonomous system number are specified using this form: rpki1/x509_resource_certs?autnum=EEEE EEEE is an autonomous system number within the "autnums" property of an X.509 resource certificate object, as described in . The following URL would be used to find information for X.509 resource certificate objects with the "autnums" member including autonomous system number 65536:

Search Results The X.509 resource certificate search results are returned in the "rpki1_x509ResourceCertSearchResults" member, which is an array of X.509 resource certificate objects (). Here is an elided example of the search results when finding information for X.509 resource certificate objects with issuer matching the "CN=ISP-*" pattern:

Reverse Search Per , if a server receives a reverse search query with a searchable resource type of "ips" (), a related resource type of "rpki1_x509ResourceCert", and an X.509 Resource Certificate property of "handle", then the reverse search will be performed on the IP network objects from its data store. Similarly, if a server receives a reverse search query with a searchable resource type of "autnums", a related resource type of "rpki1_x509ResourceCert", and an X.509 Resource Certificate property of "handle", then the reverse search will be performed on the autonomous system number objects. and include registration of entries for IP network and autonomous system number searches in the RDAP Reverse Search and RDAP Reverse Search Mapping IANA registries when the related resource type is "rpki1_x509ResourceCert".

Relationship with Other Object Classes It would be useful to show all the X.509 resource certificates associated with an object of another RDAP class; in particular, with an IP network object, an autonomous system number object, or an entity (organization) object. To that end, this extension adds a new "rpki1_x509ResourceCerts" member to the IP Network (), Autonomous System Number (), and Entity () object classes:

"rpki1_x509ResourceCerts" -- an array of X.509 resource certificate objects () for the IP address range in an IP network object, the autonomous system number range in an autonomous system number object, or an entity (organization) object; if the array is too large, the server MAY truncate it, per

Here is an elided example for an entity (organization) object with X.509 resource certificates:

RDAP Conformance A server that supports the functionality specified in this document MUST include the "rpki1" string literal in the "rdapConformance" array of its responses.

Security Considerations The RDAP extension in this document MUST NOT be used to directly influence internet routing. Neither RDAP nor this extension define the necessary security properties or distribution mechanisms required to securely add, remove, or modify internet routes. This document does not introduce any new security considerations past those already discussed in the RDAP protocol specifications (, ).

IANA Considerations

RDAP Extensions Registry IANA is requested to register the following values in the RDAP Extensions Registry at :

Extension identifier: rpki1
Registry operator: Any
Published specification: This document.
Contact: IETF iesg@ietf.org
Intended usage: This extension is used for accessing the RPKI registration data through RDAP.

RDAP Reverse Search Registry IANA is requested to register the following entries in the RDAP Reverse Search Registry at : IP network search by the origin autonomous system number of a ROA:

Searchable Resource Type: ips
Related Resource Type: rpki1_roa
Property: originAutnum
Description: The server supports the IP network search by the origin autonomous system number of an associated RPKI ROA.
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

IP network search by a CIDR address block of a ROA:

Searchable Resource Type: ips
Related Resource Type: rpki1_roa
Property: ip
Description: The server supports the IP network search by a CIDR address block of an associated RPKI ROA.
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

Autonomous system number search by the autonomous system number of an ASPA:

Searchable Resource Type: autnums
Related Resource Type: rpki1_aspa
Property: autnum
Description: The server supports the autonomous system number search by the autonomous system number of an associated RPKI ASPA.
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

Autonomous system number search by a provider autonomous system number of an ASPA:

Searchable Resource Type: autnums
Related Resource Type: rpki1_aspa
Property: providerAutnum
Description: The server supports the autonomous system number search by a provider autonomous system number of an associated RPKI ASPA.
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

IP network search by the handle of an X.509 resource certificate:

Searchable Resource Type: ips
Related Resource Type: rpki1_x509ResourceCert
Property: handle
Description: The server supports the IP network search by the handle of an associated RPKI X.509 resource certificate.
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

Autonomous system number search by the handle of an X.509 resource certificate:

Searchable Resource Type: autnums
Related Resource Type: rpki1_x509ResourceCert
Property: handle
Description: The server supports the autonomous system number search by the handle of an associated RPKI X.509 resource certificate.
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

RDAP Reverse Search Mapping Registry IANA is requested to register the following entries in the RDAP Reverse Search Mapping Registry at : IP network search by the origin autonomous system number of a ROA:

Searchable Resource Type: ips
Related Resource Type: rpki1_roa
Property: originAutnum
Property Path: $.originAutnum
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

IP network search by a CIDR address block of a ROA:

Searchable Resource Type: ips
Related Resource Type: rpki1_roa
Property: ip
Property Path: $.roaIps[*].ip
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

Autonomous system number search by the autonomous system number of an ASPA:

Searchable Resource Type: autnums
Related Resource Type: rpki1_aspa
Property: autnum
Property Path: $.autnum
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

Autonomous system number search by a provider autonomous system number of an ASPA:

Searchable Resource Type: autnums
Related Resource Type: rpki1_aspa
Property: providerAutnum
Property Path: $.providerAutnums[*]
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

IP network search by the handle of an X.509 resource certificate:

Searchable Resource Type: ips
Related Resource Type: rpki1_x509ResourceCert
Property: handle
Property Path: $.handle
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

Autonomous system number search by the handle of an X.509 resource certificate:

Searchable Resource Type: autnums
Related Resource Type: rpki1_x509ResourceCert
Property: handle
Property Path: $.handle
Registrant Name: IETF
Registrant Contact Information: iesg@ietf.org
Reference: This document.

Acknowledgements Job Snijders, Ties de Kock, Mark Kosters, Tim Bruijnzeels, Bart Bakker, and Frank Hill provided valuable feedback for this document.