Resource Public Key Infrastructure (RPKI) Validation Reconsidered
Extracted elements (24)
Operators MAY issue separate ROAs for each IP address prefix and separate BGPsec Router Certificates for each ASN so that loss of one resource from a certificate's VRS does not invalidate authorizations for other resources. This granularity is explicitly recommended as a mitigation strategy.
RFC 6487 validation rejects Resource Certificates entirely if they overclaim any resources not on the issuing certificate. This creates operational fragility: a single overclaim anywhere in the hierarchy invalidates the entire subtree below it, even for ROAs that do not use the disputed resources. RFC 8360 addresses this by limiting invalidation to only the overclaimed resources.
Separate OIDs (id-cp-ipAddr-asNumber-v2, id-pe-ipAddrBlocks-v2, id-pe-autonomousSysIds-v2) were introduced rather than modifying existing ones so that Relying Party tool behavior is deterministic — tools that do not implement the amended profile will reject certificates using the new OIDs rather than misinterpreting them.
The Verified Resource Set (VRS) concept keeps a per-certificate running intersection of INRs separate from the raw resource extension values. This allows a CA certificate to temporarily contain overclaimed resources without being outright rejected, while ensuring no subordinate attestation can be valid for those overclaimed resources.
Relying Party tools that do not implement the amended profile will reject certificates using the new OIDs. Therefore, RP tools MUST be updated before CAs begin issuing certificates with the new OIDs to avoid inadvertent route-origin validation failures.
ROAs and BGPsec Router Certificates remain valid only if all of their resources are encompassed by the VRS of all certificates along the path to the trust anchor, regardless of whether old or new OIDs are used — the amended algorithm does not relax security for end-entity objects.
There is no requirement for all CAs to migrate to the new OIDs simultaneously. Individual CA certificates may selectively use the new OIDs, as illustrated in Example 3 (Section 5.3), where only the certificate most at risk of overclaiming uses the new OIDs.
When no certificate in an RPKI tree uses the new OIDs, the amended validation algorithm produces identical outcomes to RFC 6487 validation. The two algorithms diverge only when a certificate bearing the new Certificate Policy OID is encountered.
Either the IP resources extension or the AS resources extension, or both, MUST be present in all RPKI certificates following the alternative profile and MUST be marked critical.
For BGPsec Router Certificates using the alternative Certificate Policy, the VRS-AS MUST encompass all AS numbers in the AS Resource Identifier Delegation extension; otherwise the router certificate is invalid.
For ROA validation under the alternative profile, each IP address prefix in the ROA must be contained within the VRS-IP set resulting from EE certificate path validation, not merely within the raw IP Address Delegation extension of the EE certificate.
id-pe-ipAddrBlocks-v2 MUST only be used in conjunction with the alternative Certificate Policy OID defined in Section 4.2.1. Similarly, id-pe-autonomousSysIds-v2 MUST only be used with that same policy OID.
In the amended AS resources profile, Routing Domain Identifier (RDI) values are NOT supported and MUST NOT be used.
The amended certificate policy extension (id-cp-ipAddr-asNumber-v2) MUST be present and MUST be marked critical in certificates following the alternative profile, and MUST include exactly one policy of that type.
Under amended path validation step 8, if a certificate uses the old RFC 6487 Certificate Policy (id-cp-ipAddr-asNumber) and its declared resources differ from its VRS, the certificate MUST be rejected. If it uses the new policy (id-cp-ipAddr-asNumber-v2), a warning SHOULD be issued for the overclaiming resources instead of rejection.
A new AS identifier delegation extension OID id-pe-autonomousSysIds-v2 (id-pe 29) is defined. Its ASN.1 syntax is identical to RFC 3779's ASIdentifiers but it MUST only be used together with the id-cp-ipAddr-asNumber-v2 certificate policy OID.
A new Certificate Policy OID id-cp-ipAddr-asNumber-v2 (pkix cp(14) 3) is defined as an alternative to the RFC 6484 OID (pkix cp(14) 2). Certificates bearing this OID follow the amended validation algorithm rather than RFC 6487 validation.
A new IP address delegation extension OID id-pe-ipAddrBlocks-v2 (id-pe 28) is defined. Its ASN.1 syntax is identical to RFC 3779's IPAddrBlocks but it MUST only be used together with the id-cp-ipAddr-asNumber-v2 certificate policy OID.
Two new path-validation state variables are introduced: VRS-IP (Verified Resource Set for IP addresses) and VRS-AS (Verified Resource Set for AS numbers). Both are initialized to the trust anchor's IP Address Delegation and AS Identifier Delegation values, respectively, and are updated at each step by intersecting with the child certificate's declared resources.
IANA added id-cp-ipAddr-asNumber-v2 (decimal 3) to the 'SMI Security for PKIX Certificate Policies' registry, id-pe-ipAddrBlocks-v2 (decimal 28) and id-pe-autonomousSysIds-v2 (decimal 29) to 'SMI Security for PKIX Certificate Extension', and id-mod-ip-addr-and-as-ident-v2 (90) and id-mod-ip-addr-and-as-ident-2v2 (91) to 'SMI Security for PKIX Module Identifier'.
The authors assert that the revised validation algorithm introduces no new security vulnerabilities because it cannot cause ROAs or router certificates to be accepted for resources not validly held by the issuer — the VRS mechanism ensures acceptance is always limited to the intersection of resources along the full certification path.
Amended path validation iterates over each certificate x in the chain. VRS-IP is set to the trust anchor's IP resources for x=1, and to the intersection of the certificate's IP resources with the prior VRS-IP for x>1; VRS-IP is set to NULL if the extension is absent. VRS-AS follows the same logic for AS identifiers. Overclaims trigger rejection (old OIDs) or a warning (new OIDs).
The id-pe-autonomousSysIds-v2 extension encodes an ASIdentifiers SEQUENCE with optional EXPLICIT-tagged asnum [0] and rdi [1] fields, each an ASIdentifierChoice of either NULL (inherit) or a SEQUENCE OF ASIdOrRange. ASId is an INTEGER; RDI values MUST NOT be used.
The id-pe-ipAddrBlocks-v2 extension encodes an IPAddrBlocks value — a SEQUENCE OF IPAddressFamily, each containing a 2-3 octet addressFamily (AFI + optional SAFI) and an IPAddressChoice (either NULL for inherit or a SEQUENCE OF IPAddressOrRange). The SAFI field MUST NOT be used in the public Internet context.