Router Keying for BGPsec
RFC 8635

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06

Internet Engineering Task Force (IETF)                           R. Bush
Request for Comments: 8635                              IIJ Lab & Arrcus
Category: Standards Track                                      S. Turner
ISSN: 2070-1721                                                    sn3rd
                                                                K. Patel
                                                            Arrcus, Inc.
                                                             August 2019

                        Router Keying for BGPsec

Abstract

   BGPsec-speaking routers are provisioned with private keys in order to
   sign BGPsec announcements.  The corresponding public keys are
   published in the Global Resource Public Key Infrastructure (RPKI),
   enabling verification of BGPsec messages.  This document describes
   two methods of generating the public-private key pairs: router-driven
   and operator-driven.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   https://www.rfc-editor.org/info/rfc8635.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Bush, et al.                 Standards Track                    [Page 1]
RFC 8635                Router Keying for BGPsec             August 2019

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Requirements Language . . . . . . . . . . . . . . . . . . . .   3
   3.  Management/Router Communication . . . . . . . . . . . . . . .   3
   4.  Exchange Certificates . . . . . . . . . . . . . . . . . . . .   4
   5.  Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . .   5
   6.  Generate PKCS#10  . . . . . . . . . . . . . . . . . . . . . .   5
     6.1.  Router-Driven Keys  . . . . . . . . . . . . . . . . . . .   5
     6.2.  Operator-Driven Keys  . . . . . . . . . . . . . . . . . .   6
       6.2.1.  Using PKCS#8 to Transfer Private Keys . . . . . . . .   6
   7.  Send PKCS#10 and Receive PKCS#7 . . . . . . . . . . . . . . .   7
   8.  Install Certificate . . . . . . . . . . . . . . . . . . . . .   7
   9.  Advanced Deployment Scenarios . . . . . . . . . . . . . . . .   8
   10. Key Management  . . . . . . . . . . . . . . . . . . . . . . .   9
     10.1.  Key Validity . . . . . . . . . . . . . . . . . . . . . .  10
     10.2.  Key Rollover . . . . . . . . . . . . . . . . . . . . . .  10
     10.3.  Key Revocation . . . . . . . . . . . . . . . . . . . . .  11
     10.4.  Router Replacement . . . . . . . . . . . . . . . . . . .  11
   11. Security Considerations . . . . . . . . . . . . . . . . . . .  12
   12. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  13
   13. References  . . . . . . . . . . . . . . . . . . . . . . . . .  13
     13.1.  Normative References . . . . . . . . . . . . . . . . . .  13
     13.2.  Informative References . . . . . . . . . . . . . . . . .  14
   Appendix A.  Management/Router Channel Security . . . . . . . . .  17
   Appendix B.  An Introduction to BGPsec Key Management . . . . . .  18
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  21

1.  Introduction

   BGPsec-speaking routers are provisioned with private keys, which
   allow them to digitally sign BGPsec announcements.  To verify the
   signature, the public key, in the form of a certificate [RFC8209], is
   published in the Resource Public Key Infrastructure (RPKI).  This
   document describes provisioning of BGPsec-speaking routers with the
   appropriate public-private key pairs.  There are two methods: router-
   driven and operator-driven.

   These two methods differ in where the keys are generated: on the
   router in the router-driven method, and elsewhere in the operator-
   driven method.

   The two methods also differ in who generates the private/public key
   pair: the operator generates the pair and sends it to the router in