Issue Date:
Revision:
Resource Public Key
Infrastructure (RPKI)
As part of bdNOG 2 Conference
11 November 2014
2014/11
2

Overview
• Routing “incidents”
• RPKI Technical Details
• RPKI and BGPsec
• Components and Implementation
• Deployment Status in the RIRs
• APNIC Resource Certification
2

Misdirection / Hijacking Incidents
• YouTube Incident
– Occurred 24 Feb 2008 (for about 2 hours)
– Pakistan Telecom announced YT block
• Google (AS15169) services downed
– Occurred 5 Nov 2012 (for 30 minutes)
– Moratel Indonesia (AS23947)
3
How frequent do these hijacking incidents happen?

How we address this…
• A network should only originate his own prefix
– How do we verify?
– How do we avoid false advertisement?
• A provider should filter prefixes they propagate from
customers
– Check the legitimacy of address (LoA)
– Transitive trust; BGP is a trust-based system
4

WHOIS DB – Legitimacy of Address
5

What is RPKI?
• Resource Public Key Infrastructure (RPKI)
• A robust security framework for verifying the association
between resource holder and their Internet resources
• Created to address the issues in RFC 4593 “Generic
Threats to Routing Protocols”
• Helps to secure Internet routing by validating routes
– Proof that prefix announcements are coming from the legitimate
holder of the resource
RFC 6480 – An Infrastructure to Support
Secure Internet Routing (Feb 2012)
6

Benefits of RPKI - Routing
• Prevents route hijacking
– A prefix originated by an AS without authorization
– Reason: malicious intent
• Prevents mis-origination
– A prefix that is mistakenly originated by an AS which does not own it
– Also route leakage
– Reason: configuration mistake / fat finger
7

BGP Security (BGPsec)
• Extension to BGP that provides improved security for BGP
routing
• Currently an IETF Internet draft
• Implemented via a new optional non-transitive BGP path
attribute that contains a digital signature
• Two things:
– BGP Prefix Origin Validation (using RPKI)
– BGP Path Validation
• Similar efforts in the early days – IDR working group, S-
BGP
8

“Right” to Resources
• ISP gets their resources from the RIR
• ISP notifies its upstream of the prefixes to be announced
• Upstream must check the WHOIS database if resource has
been delegated to customer ISP
We need to be able to authoritatively prove who owns an IP Prefix and
what AS(s) may announce it.
9

RPKI Infrastructure
• A system to manage the creation and storage of digital
certificates and the associated Route Origin Authorization
documents
• Main Components:
– Certificate Authority (CA)
– Relying Party (RP)
– Routers with RPKI support
10

Issuing Party
• Internet Registries (RIR, NIR, Large LIRs)
• Acts as a Certificate Authority and issues certificates for
customers
• Provides a web interface to issue ROAs for customer prefixes
• Publishes the ROA records
APNIC
RPKI
Engine
publication
MyAPNIC GUI
rpki.apnic.net
Repository
11

Route Origin Authorization (ROA)
• A digital object that contains a list of address prefixes and
one AS number
• It is an authority created by a prefix holder to authorize an
AS Number to originate one or more specific route
advertisements
• Publish an ROA using MyAPNIC
12

X.509 Certificate with 3779 Extension
• Resource certificates are based
on the X.509 v3 certificate format
(RFC 5280)
• Extended by RFC 3779 – binds a
list of resources (IP, ASN) to the
subject of the certificate
• SIA – Subject Information Access;
contains a URI that references
the directory
X.509 Certificate
RFC 3779
Extension
SIA
Owner's Public Key
13

Relying Party (RP)
IANA
Repo
APNIC
Repo
RIPE
Repo
LIR Repo LIR Repo
RP Cache
(gather) Validated
Cache
RPKI-Rtr Protocol
rpki.ripe.net
Software which gathers data from CAs
Also called RP cache or validator
14

RPKI Components
15
Trust
Anchor
RP
CACHE
Trust
Anchor
RPKI-Rtr Protocol
APNIC
RPKI
Engine
Trust
Anchor
publicationMyAPNIC GUI rpki.apnic.net
ca0.rpki.net
rpki.ripe.net

Router Origin Validation
• Router must support RPKI
• Checks an RP cache / validator
• Validation returns 3 states:
– Valid = when authorization is found for prefix X
– Invalid = when authorization is found for prefix X but not from ASN Y
– Unknown = when no authorization data is found
• Vendor support:
– Cisco IOS – solid in 15.2
– Cisco IOS/XR – shipped in 4.3.2
– Juniper – shipped in 12.2
– Alcatel Lucent – in development
16

RIR Statistics
17
Ref: http://rpki.surfnet.nl/perrir.html
Based on RIS Database dumps from RIPE-NCC

RPKI Monitor
18
Ref: NIST RPKI Monitor

APNIC RPKI Service
• Enhancement to the RIRs
– Offers verifiable proof of resource holdings
• Resource certification is an opt-in service
– Resource holders choose to request a certificate and profice their
public key to be certified
• APNIC has integrated the RPKI management service into
MyAPNIC for APNIC Member use
19

What you need to know
• You are encouraged to experiment, test, play and develop
• RPKI standards are still being developed, and the operating
environment for RPKI use is still fragile
• It’s ready for testing and prototyping, but is probably not
ready for production use just yet
• Please tell us what you find but don’t rely on it in your
network yet
20

What You Can Do Now?
• Create ROA records in MyAPNIC
• Build an RP cache
• Configure your router to use the cache (or a public one)
• Create BGP policies
Best to do it in a test environment for now! ☺
21

Build an RP Cache
• Download and install from rpki.net
– Instructions here: https://trac.rpki.net/wiki/doc/RPKI/Installation/
UbuntuPackages
22
The RP cache has a web interface

Configure Router to Use Cache
router bgp 651nn
…
bgp rpki server tcp 10.0.0.3 port 43779
refresh 60
bgp rpki server tcp 147.28.0.84 port 93920
refresh 60
…
23
RPKI Lab – Randy Bush

BGP Table
r0.sea#sh ip bgp
Network Next Hop Metric LocPrf Weight
Path
* i I198.180.150.0 144.232.9.61 100 0 1239 3927 i
*> I 199.238.113.9 0 2914 3927 i
* I 129.250.11.41 0 2914 3927 i
*> V198.180.152.0 199.238.113.9 0 2914 4128 i
* V 129.250.11.41 0 2914 4128 i
*> N198.180.155.0 199.238.113.9 0 2914 22773 i
* N 129.250.11.41 0 2914 22773 i
*> N198.180.160.0 199.238.113.9 0 2914 23308 13408
5752 i
* N 129.250.11.41 0 2914 23308 13408
5752 i
RPKI Lab – Randy Bush
24

More References
• Securing BGP
– The Internet Protocol Journal, Volume 14, No. 2
• An Infrastructure to Support Secure Internet Routing
– RFC6480
• A Reappraisal of Validation in the RPKI
– Labs.apnic.net/blabs
• An Introduction to Routing Security (and RPKI Tools)
• MyAPNIC Resource Certification Guide
25

Questions
26

THANK YOU
www.facebook.com/APNIC
www.twitter.com/apnic
www.youtube.com/apnicmultimedia
www.flickr.com/apnic
www.weibo.com/APNICrir
27