Resource Public Key Infrastructure (RPKI) Objects Issued by IANA
Extracted elements (17)
SHOULD rather than MUST is used for AS 0 ROA issuance for reserved and unallocated resources because IANA must not be placed in a situation where normal internal operations (e.g., registry transitions) cause its behavior to contradict IETF standards by being unable to temporarily remove or withhold an object.
This document deliberately references real-world address blocks rather than example addresses (non-compliant with RFC 3849, RFC 5735, RFC 5771) because the practices described are directed to specific instances of real-world addresses.
This document does not address BGP routing policy, which is under the policy control of the organizations operating BGP systems. Local overrides of IANA-issued RPKI objects (e.g., to use reserved space locally) are handled via Local Trust Anchor Management as described in the TA-MGMT draft.
Before issuing a ROA, IANA MUST first establish an RPKI Certification Authority (CA) covering unallocated, reserved, and special use INRs, and that CA MUST contain RFC 3779 extensions for those number resources in its certificate.
IANA MUST issue a CRL under the CA certificate for the EE certificates it issues, and all objects issued by the CA must conform to the RPKI Certificate Policy (RFC 6484).
IANA MUST issue a Ghostbusters Record (RFC 6493) appropriate in content for the resources IANA maintains at its RPKI publication point.
IANA MUST issue an AS 0 ROA covering specific IPv4 multicast blocks (224.0.0/24, 224.1/16, 251 /16s from 224.5.0.0, 7 /8s from 225.0.0.0) and IPv6 Node-Local and Link-Local Scope Multicast Addresses.
IANA MUST maintain a publication point for the CA's use and MUST publish manifests (RFC 6486) with corresponding EE certificates for that publication point.
IANA MUST NOT issue any ROAs (AS 0 or otherwise) for any multicast addresses not covered by Section 8 unless directed by an IESG-approved Standards Track document with an appropriate IANA Considerations section.
IANA MUST notify all other INR registries that RPKI objects have been issued for the Internet Number Resources described in this document, to avoid issuance of duplicate objects that might confuse relying parties.
IANA SHOULD issue an AS 0 ROA for Special Purpose Registry Resources that are not intended to be globally routed, such as 2001:002::/48.
The IANA CA MUST issue single-use end-entity (EE) certificates for each ROA it generates, conforming to the Resource Certificate Profile (RFC 6487) and the additional constraints of RFC 6482.
An AS 0 ROA is a Route Origination Authorization containing a value of 0 in the ASID field, which constitutes an attestation by the holder that the described prefix (and any more specific prefix) should not be used in a routing context.
IANA's RPKI CA must cover unallocated, reserved, and special use INRs; it issues single-use EE certificates per ROA and maintains a publication point with manifests and a CRL — all conforming to the RPKI Certificate Policy (RFC 6484).
Appendix A enumerates IANA reserved IPv4 address blocks (e.g., 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 192.168.0.0/16, 224.0.0.0/4) with their governing RFCs and whether each is intended to be routed (TBR), governing which RPKI objects IANA may issue.
Appendix B enumerates IANA reserved IPv6 address blocks (e.g., 0000::/8 through FF00::/8, FC00::/7, 2001:0002::/48) with their governing RFCs and TBR status, governing RPKI object issuance for these prefixes.
This document does not alter the security profile of the RPKI from that already discussed in SIDR WG documents; the security considerations of the broader RPKI framework (RFC 6480 and related documents) apply.