New! ARIN Publication Service for Delegated RPKI

By Brad Gorman – Senior Product Owner, Routing Security

ARIN recently released a publication service for delegated Resource Public Key Infrastructure (RPKI) for all RPKI users after a period of closed beta testing. This service is now available to all Delegated RPKI customers who choose to have ARIN run the repository and publication service for their certified resources.

What is RPKI?

Resource Public Key Infrastructure (RPKI) is an opt-in service that provides security for Internet routing. RPKI uses cryptographically verifiable statements to ensure that Internet number resources are certifiably linked to the stated holders of those resources. This enables resource holders to attest which Autonomous System Numbers (ASNs) should originate their prefixes (i.e., blocks of IP addresses). Network operators can compare Border Gateway Protocol (BGP) announcements from the global Internet routing table with RPKI validity data to make informed decisions to enhance their routing security.

What is Delegated RPKI?

Delegated RPKI is an infrastructure in which direct resource holders of a Regional Internet Registry (RIR) may request their own delegated resource certificates and host their own Certificate Authority (CA). Using their CA, Delegated RPKI participants may then sign Route Origin Authorizations (ROAs) and issue resource certificates for their customers. ARIN’s RPKI repository holds a certificate for each organization participating in its Delegated RPKI service. In turn, each Delegated RPKI participant’s repository holds a resource certificate for any downstream organization participating in Delegated RPKI through them. By following this chain, any resource certificate may be located and validated. Delegated RPKI widens the availability of RPKI by allowing organizations holding direct resources from ARIN and under agreement to serve as the CA for their customers. Organizations running Delegated RPKI are responsible for ensuring their resource certificates and ROAs are available to other entities. Publication of repositories can be done in-house or by using ARIN’s new publication service.

What is ARIN’s Publication Service for Delegated RPKI?

To make your RPKI object repository available to the public (particularly network operators), you will need to publish your repository on a publication server. ARIN’s publication service for delegated RPKI, sometimes referred to as hybrid RPKI, is a new product that allows organizations to use RPKI without requiring them to publish their own repositories in-house. ARIN’s publication service removes barriers to deploying RPKI by offering organizations assistance with making their resource certificates and ROAs available to other entities.

Krill is a free, open-source RPKI daemon written by NLnet Labs that features a CA and publication server and is recommended for organizations that want to use the ARIN Publication Service for Delegated RPKI. Find a complete guide to Running Krill under ARIN on the NLnet Labs blog.

Currently, member organizations with resources covered by a Registration Services Agreement (RSA or LRSA) that have obtained a resource certificate from ARIN can add objects for those specific resources into the repository.

How to use ARIN’s Publication Service

To ensure that your ROAs and certificate are published and available to other entities, and publish your RPKI repository using ARIN’s Publication Service for Delegated RPKI take the following steps:

1. In Krill, choose the Repository tab to get the Publisher Request XML it has generated. Copy the XML to the clipboard.

2. Log in to ARIN Online and:

   • Select Your Records > Organization Identifiers from the navigation menu and choose the organization.

   • Choose Actions and select Manage RPKI.

   • In the Navigation Menu, choose Publication Repository.

   • Paste the XML copied from Krill into the Publisher Request XML field and choose Submit.

   • ARIN will generate and display a Repository Response in XML format. Use Copy to copy the response into the clipboard.

3. Open the Krill software and choose the Repository tab. 

4. Paste the response you copied to clipboard into the appropriate section and choose Confirm.

After you have received a delegated resource certificate from ARIN, you (or organizations under you whose resources you are certifying) will use a Certificate Authority (CA) package such as Krill to create ROAs. ROAs are stored in the RPKI repository along with a CRL (Certificate Revocation List). A CRL is a list of resource certificates that have been revoked and should not be relied upon. A CRL is always issued by the CA which issues the corresponding certificates. The publication server will provide these objects to requesting entities.

Next, we recommend testing your RPKI service using ARIN’s Operational Test and Evaluation (OT&E) environment where we have an RPKI instance for those wishing to experiment with RPKI without affecting production data.

Where to find more information

Additional information about how to configure the Certificate Authority software to make use of this new product is available on the ARIN website and in our on-demand webinar: Delegated, Hybrid, and the API — Beyond Hosted RPKI. Or if you would like to speak with me about the benefits of using the ARIN Publication Service for Delegated RPKI, or anything else related to routing security, please find me at ARIN on the Road in Phoenix, Arizona on 29 March or at the ARIN 49 RPKI ROA-thon in Nashville, Tennessee on 24 April 2022.

Recent blogs categorized under: RPKI

• Are Differences in RIR RPKI Implementations Hindering RPKI Adoption?
• NRO RPKI Program Blog Series: Part 2
• ARIN RPKI Updates and Upcoming Enhancements
• Improving Regional Internet Registry Alignment in the RPKI Space