Internet Draft Cengiz Alaettinoglu Expires March 1, 2000 USC/ISI draft-ietf-rps-iana-01.txt Curtis Villamizar Avici Systems Ramesh Govindan USC/ISI September 1, 1999 RPS IANA Issues Status of this Memo: This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Copyright (C) The Internet Society (1998). All Rights Reserved. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as 'work in progress.' The list of current Internet-Drafts can be accessed at The list of Internet-Draft Shadow Directories can be accessed at . The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. Abstract RPS Security [2] requires certain RPSL [1] objects in the IRR to be hierarchically delegated. The set of objects that are at the root of this hierarchy needs to be created and digitally signed by IANA. This paper Internet Draft RPS IANA Issues September 1, 1999 presents these seed objects and lists operations required from IANA. 1 Initial Seed A public key of IANA needs to be distributed with the software implementations of Distributed Routing Policy System [3]. An initial set of seed objects are needed to be signed with this key. They are: mntner: mnt-iana descr: iana's maintainer admin-c: . . . tech-c: . . . upd-to: . . . mnt-nfy: . . . auth: pgpkey-88BAC849 mnt-by: mnt-iana referral-by: mnt-iana source: IANA key-cert: PGPKEY-88BAC849 method: pgp owner: iana staff (est. Nov 98) fingerpr: F1 66 1C 77 5C AF 6D 7F CC 7D 4C DA DE 49 B1 35 certif: # this key is for illustration only + -----BEGIN PGP PUBLIC KEY BLOCK----- + Version: 2.6.2 + + mQCNAzZJ6DwAAAEEAK6tL4xNZidPDYhGBpTSdZJfceT+Bn+zX0AwUKogVJc5clE+ + FBkZKdNsb/YlUs4RZ9rZiqa/0BCWX9XvMvYFqLHaP+JXPpGJADk+4GFhJ9IEcrjm + d/pWuMTwbXlRtG951I29SsWxDwkqvUd34k1L+Be2BrxNyshAWBA/a8eIushJAAUR + tChpYW5hIHN0YWZmIChlc3QuIE5vdiA5OCkgPGlhbmFAaWFuYS5vcmc+ + =BpMg + -----END PGP PUBLIC KEY BLOCK----- mnt-by: mnt-iana source: IANA repository: IANA repository-cert: PGPKEY-88BAC849 query-address: http://www.iana.org response-auth-type: none submit-address: http://www.iana.org submit-auth-type: none expire: 0000 04:00:00 heartbeat-interval: 0000 01:00:00 admin-c: . . . tech-c: . . . mnt-by: mnt-iana Alaettinoglu et. al. Expires March 1, 2000 [Page 2] Internet Draft RPS IANA Issues September 1, 1999 source: IANA as-block: AS0 - AS65535 descr: as number space country: us admin-c: . . . tech-c: . . . status: UNALLOCATED source: IANA mnt-by: mnt-iana mnt-lower: mnt-iana inetnum: 0.0.0.0 - 255.255.255.255 netname: Internet descr: ip number space country: us admin-c: . . . tech-c: . . . status: UNALLOCATED source: IANA mnt-by: mnt-iana mnt-lower: mnt-iana Here, we assume that IANA runs its own repository. However this is not a requirement. Instead, it may publish its objects with one of the existing routing registries. This set of seed objects needs to be signed with the hard coded IANA key. Later, IANA objects can be signed with the key in the IANA key-cert object. 2 IANA Assignments Each time IANA makes an assignment, it needs to create inetnum and as-block objects as appropriate and digitally sign them using the key in its key-cert object. For example: as-block: AS0 - AS500 descr: arin's space country: us status: ALLOCATED source: iana delegated: arin mnt-by: mnt-iana inetnum: 128.0.0.0 - 128.255.255.255 netname: Internet portion Alaettinoglu et. al. Expires March 1, 2000 [Page 3] Internet Draft RPS IANA Issues September 1, 1999 descr: ip number space country: us status: ALLOCATED source: iana delegated: arin mnt-by: mnt-iana 3 Creating Routing Repositories To enable a new routing repository, a repository object, a maintainer object and a key-cert object need to be created and digitally signed by IANA. For example: mntner: mnt-ripe descr: RIPE's maintainer auth: mnt-by: mnt-ripe referral-by: mnt-iana admin-c: . . . tech-c: . . . upd-to: . . . mnt-nfy: . . . source: RIPE key-cert: pgpkey-979979 method: pgp owner: . . . fingerpr: . . . certif: # this key is for illustration only + -----BEGIN PGP PUBLIC KEY BLOCK----- + Version: PGP for Personal Privacy 5.0 + + . . . + -----END PGP PUBLIC KEY BLOCK----- mnt-by: mnt-ripe source: RIPE repository: RIPE query-address: whois://whois.ripe.net response-auth-type: PGPKEY-23F5CE35 # pointer to key-cert object response-auth-type: none remarks: you can request rsa signature on queries remarks: PGP required on submissions submit-address: mailto://auto-dbm@ripe.net submit-address: rps-query://whois.ripe.net:43 submit-auth-type: pgp-key, crypt-pw, mail-from remarks: these are the authentication types supported Alaettinoglu et. al. Expires March 1, 2000 [Page 4] Internet Draft RPS IANA Issues September 1, 1999 mnt-by: maint-ripe-db expire: 0000 04:00:00 heartbeat-interval: 0000 01:00:00 ... remarks: admin and technical contact, etc source: RIPE This very first transaction of a new repository is placed in the new repository, not in the IANA repository. 4 Security Considerations This document describes IANA procedures and initial RPSL seed objects. It does not define protocols or standards that need to be secured. 5 IANA Considerations This whole document is for detailed consideration by IANA. References [1] C. Alaettinoglu, T. Bates, E. Gerich, D. Karrenberg, D. Meyer, M. Terpstra, and C. Villamizar: Routing Policy Specification Language (RPSL), RFC 2622. [2] C. Villamizar, C. Alaettinouglu, D. Meyer, S. Murphy, and C. Orange. Routing policy system security. Internet Draft draft-ietf-rps-auth-04, Network Information Center, April 1999. [3] C. Villamizar, C. Alaettinouglu, R. Govindan, D. Meyer. Distributed Routing Policy System. Internet Draft draft-ietf-rps-dist-02, Network Information Center, February 1999. 6 Authors' Addresses Cengiz Alaettinoglu USC Information Sciences Institute email: cengiz@isi.edu Curtis Villamizar Alaettinoglu et. al. Expires March 1, 2000 [Page 5] Internet Draft RPS IANA Issues September 1, 1999 Avici Systems email: curtis@avici.com Ramesh Govindan USC Information Sciences Institute email: govindan@isi.edu Alaettinoglu et. al. Expires March 1, 2000 [Page 6]