Presentation given by Tim Bruijnzeels at IETF 85 in Atlanta, GA, USA on 8 November 2012

1. Validation of RPKI
objects using a local
cache
Thursday, November 8, 12

2. Problems with current
• Very tight coupling to rsync
– Need to process objects not on manifest
– Vulnerable to updates happening during fetch
• Prefix validate wants to know all ROAs
• Implementations use URI as identifiers for objects
– Multiple publication points complicated
– Same for alternative fetch mechanisms
Tim Bruijnzeels, IETF85 2
Thursday, November 8, 12

3. Decoupling object retrieval
• Use SIA, AIA and CRLDP only for object discovery
• Allows for other retrieval mechanisms
– rsync
– bittorrent
– http with / without deltas
– multiple publication points
– other..
Tim Bruijnzeels, IETF85 3
Thursday, November 8, 12

4. Validation using ‘just objects’
find by: find by:
Key Identifier hash
TA Cert MFT EE CRL there can be
SKI AKI AKI only one...
TAL latest? CA1 Cert MFT EE
signature ok? SKI AKI
all objects?
CA2 Cert MFT EE
SKI AKI
Tim Bruijnzeels, IETF85 4
Thursday, November 8, 12

5. Differences from current RFCs
• Strict interpretation of current repository standards
– Some clarification for CAs might be useful:
MUST 1 mft, 1 crl, all objects that need to be known
• Manifests authoritative source for walking the tree
– Ignores objects that the CA does not put on mft
– May be strict if objects are missing, e.g. go with last known
good state if available
• SIA, AIA and CRLDP only for discovery
Tim Bruijnzeels, IETF85 5
Thursday, November 8, 12