BGPsec Algorithms, Key Formats, and Signature Formats
obsoleted by
- rfc-8608 — BGPsec Algorithms, Key Formats, and Signature Formats
updates
- rfc-7935 — The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure
Extracted elements (20)
BGPsec uses ECDSA P-256 rather than the RSA algorithm used in the rest of RPKI specifically to minimize the size of the protocol data exchanged between routers, since BGPsec signatures appear in every BGP UPDATE message propagated through the path.
Hash algorithms are not identified independently in BGPsec certificates or UPDATE messages; they are represented by a combined OID (ecdsa-with-SHA256) or a single algorithm suite identifier byte, reducing overhead and simplifying negotiation.
This document updates RFC 7935 to add support for a different algorithm (ECDSA P-256) for BGPsec certificate requests, a different Subject Public Key Info format for BGPsec certificates, and different signature formats — all needed specifically for BGPsec speakers, while non-BGPsec RPKI components continue to use the RFC 7935 algorithms.
BGPsec profiles should be updated to specify future key sizes and algorithm requirements when appropriate to maintain acceptable cryptographic security. The recommended transition procedures are specified in RFC 6916.
ECPoint MUST be used to encode the certificate's subjectPublicKey field as specified in Section 2.2 of RFC 5480.
In BGPsec UPDATE messages, the ECDSA with SHA-256 algorithm suite identifier value 0x1 is included in the Signature_Block List's Algorithm Suite Identifier field.
The ECDSA private keys used to compute signatures for certificate requests and BGPsec UPDATE messages MUST come from the P-256 curve. The public key pair MUST use the uncompressed form.
The ecdsa-with-SHA256 OID MUST appear in the PKCS #10 signatureAlgorithm field or in the CRMF POPOSigningKey algorithm field, depending on the certificate request format generated.
The hash algorithm used in BGPsec MUST be SHA-256. Hash algorithms are not identified independently but are combined with the digital signature algorithm via OID.
The id-ecPublicKey OID MUST be used in the algorithm field of subjectPublicKeyInfo, with associated parameters value secp256r1, as specified in RFC 5480.
The signature algorithm used in BGPsec MUST be ECDSA with curve P-256. This applies to BGPsec routers requesting certificates, generating BGPsec UPDATE messages, and verifying BGPsec UPDATE messages.
The structure for the certification request's and BGPsec UPDATE message's signature field MUST be as specified in Section 2.2.3 of RFC 3279.
BGPsec uses a different algorithm (ECDSA P-256) compared to the rest of the RPKI (which uses RSA), specifically to minimize the size of the protocol exchanged between routers. BGPsec certificates are differentiated from other RPKI certificates by the BGPsec Extended Key Usage defined in RFC 8209.
Private key format for BGPsec Router Certificates is determined by local policy; this document does not mandate a specific format.
The BGPsec Router Certificate subjectPublicKeyInfo contains two sub-fields: algorithm (AlgorithmIdentifier with id-ecPublicKey OID and secp256r1 parameters) and subjectPublicKey (ECPoint encoding of the uncompressed public key).
IANA created the 'BGPsec Algorithm Suite Registry' in the RPKI group. The one-octet identifier maps to a digest algorithm and signature algorithm pair. Value 0x1 is assigned to SHA-256/ECDSA P-256; 0x0 and 0xFF are reserved; 0x2-0xEF are unassigned. Future assignments require Standards Action.
The security considerations of RFC 3279, RFC 5480, RFC 6090, RFC 7935, and RFC 8209 apply to BGPsec certificates and certification requests. The security considerations of RFC 3279, RFC 6090, and RFC 8205 apply to BGPsec UPDATE messages. No new security considerations are introduced by this specification.
Each Signature Segment in a BGPsec Signature Block contains an SKI (Subject Key Identifier, 20 bytes), a two-octet Length field, and a DER-encoded ECDSA signature. In the examples, signatures are 72 bytes (DER-encoded ECDSA P-256).
The BGPsec Path Attribute Signature Block contains a one-octet Algorithm Suite Identifier field. Value 0x1 designates SHA-256 digest with ECDSA P-256 signature; 0x0 and 0xFF are reserved; 0x2-0xEF are unassigned.
The BGPsec Path Attribute uses type code 30 with flags 0x90 (Optional, Complete, Extended Length). The Secure Path segment is 6 bytes per AS, containing pCount (1 byte), Flags (1 byte), and AS number (4 bytes).