Decentralized RPKI Repository Architecture
draft-li-sidrops-drr-architecture-01
| Document | Type |
Expired Internet-Draft
(individual)
Expired & archived
|
|
|---|---|---|---|
| Authors | Dan Li , Yingying Su , Li Chen | ||
| Last updated | 2026-07-20 (Latest revision 2026-01-06) | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | Expired | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:
Abstract
The Resource Public Key Infrastructure (RPKI) plays a crucial role in securing inter-domain routing. However, the current RPKI Repository system suffers from fundamental limitations in reliability, scalability, and consistency. In particular, single-point failures at repository publication points (PPs), the growing number of bidirectional connections between PPs and relying parties (RPs), and the lack of a globally consistent historical RPKI data view pose significant risks to the resilience, integrity, and authority of the global RPKI ecosystem. This document proposes the Decentralized RPKI Repository (dRR), a novel repository architecture that decouples RPKI object signing authority from RPKI object management authority (e.g., storage and distribution). dRR introduces a distributed group of certificate servers (CSs) and a layer of Monitors to achieve robust, scalable, and auditable RPKI data management. The architecture maintains full compatibility with the existing RPKI trust model rooted in the five RIR trust anchors, enabling incremental deployment without disrupting current relying parties (RPs) validation semantics. By doing so, dRR addresses longstanding repository challenges and enhances the overall efficiency and trustworthiness of RPKI-based routing security.
Authors
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)