%% You should probably cite draft-ietf-sidrops-rpki-tree-validation instead of this I-D. @techreport{ietf-sidr-rpki-tree-validation-00, number = {draft-ietf-sidr-rpki-tree-validation-00}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-tree-validation/00/}, author = {Oleg Muravskiy and Tim Bruijnzeels}, title = {{RPKI Certificate Tree Validation by a Relying Party Tool}}, pagetotal = 11, year = 2016, month = mar, day = 21, abstract = {This document currently describes the approach to validate the content of the RPKI certificate tree, as used by the RIPE NCC RPKI Validator. This approach is independent of a particular object retrieval mechanism. This allows it to be used with repositories available over the rsync protocol, the RPKI Repository Delta Protocol, and repositories that use a mix of both. This algorithm does not rely on content of repository directories, but uses the Authority Key Identifier (AKI) field of a manifest and a certificate revocation list (CRL) objects to discover manifest and CRL objects issued by a particular Certificate Authority (CA). It further uses the hashes of manifest entries to discover other objects issued by the CA. If the working group finds that algorithm outlined here is useful for other implementations, we may either update future revisions of this document to be less specific to the RIPE NCC RPKI Validator implementation, or we may use this document as a starting point of a generic validation document and keep this as a detailed description of the actual RIPE NCC RPKI Validator implementation.}, }