BGPSec Router Key Certificates supported in the RPKI API
Dear colleagues, In response to previous requests from community members, the RIPE NCC has implemented support for creating and managing BGPsec Router Key Certificates (RFC 8209) through the RPKI API. Documentation on how to use the API is available at: https://github.com/RIPE-NCC/rpki-core/blob/main/Documentation/BGPSec%20API.m... In a nutshell, BGPsec allows holders of AS numbers to authorise a key for their router which can then be used to sign BGP updates. This allows BGPsec-aware routers to validate that the BGP path is unaltered (on BGPsec-enabled sessions). Please note that BGPsec is complementary to ROAs/ROV and ASPA. BGPsec focuses specifically on preventing spoofing of the path. It does not check the route origins, as ROAs/ROV do, or detect route leaks, as ASPA does. While BGPsec support in (hardware) routers is currently lagging, and there are challenges regarding incremental deployment and performance, we hope that enabling the support for BGPsec Router Key Certificates through RPKI API will help drive its development forward. Kind regards, Tim Bruijnzeels Principal Engineer RPKI RIPE NCC
Congrats to Ben Cartwright-Cox for being the first to use this API to publish a BGPsec router key certificate! :-) https://console.rpki-client.org/rpki.ripe.net/repository/DEFAULT/18/0ea2fc-a... ___________ .-"```'. '._==_==_=_.' __ , / ` .-\: /-. ,'\\'\\ | . _ _| | (|:. BGP |) | |` _\ \(\ 6 6 '-|:. Sec |-' /.\==/.\# | _\ | \::. / \_// \_/,) |\ = `/ '::. .' | `- | | '.___.' ) ( \ =' / .'` \ |_ _.' '._ `.__.-\ '-__ / `- `"""""""` | ^ ` Kind regards, Job ps. I'd like to suggest to RIPE NCC (as implementation detail) to use some kind of hash as the filename of the certificate (e.g., hash of the SPKI). The publication BCP recommends to use *SHORT* and unique filenames for each issuance. https://www.ietf.org/archive/id/draft-ietf-sidrops-publication-server-bcp-11... "U7MsWuoesSCyjxNNrLIARIHOD7E-hqQU9YRU78t0_oxvZ8ha0_6qAKY-bgpsec-00033d08-00033d08.cer" currently is the second longest filename in the global RPKI :-) pps. ASCII art from Joan G. Stark, mangled by me.
participants (2)
-
Job Snijders -
Tim Bruijnzeels