RPKI and Trust Anchor question

Tue Aug 6 01:58:40 UTC 2013

On Aug 5, 2013, at 2:26 PM, Marcel Plug <marcelplug at gmail.com> wrote:

> Hi Nanog,
> 
> Does anyone have any inside information what may be happening in the effort
> to have a single trust anchor for RPKI?  Is ICANN still working on this?
> If so is there any timeline or published info of any kind?
> 
> Most of the information i can find is about 2 years old.
> 
> Any links or info of any kind would be much appreciated.

Hello Marcel - 

  The IAB and the five RIRs have both indicated that it is desirable
  to have a single trust anchor for RPKI.  The IAB made a statement
  in 2010 here <http://www.ietf.org/mail-archive/web/ietf-announce/current/msg07028.html>
  and in August 2011, the RIRs asked to meet with ICANN to work towards
  "an ICANN-hosted global trust anchor for the RPKI system."
  <http://www.nro.net/news/nro-communication-to-icann-on-rpki-global-trust-anchor>
  ICANN has indicated that it is willing to host such a service, and has
  included support for it within ICANN budget each year.

  Since that time, there has been quite a bit of technical work going on
  between the RIR's and ICANN's technical teams, including work to document
  some of the technical issues that might result from having a global trust 
  anchor (if you are interested in those, you might want to follow the IETF
  sidr working group.)  I would say that slow and steady progress is being
  made towards the technical ability to have a single global trust anchor
  (including understanding some of the more interesting things that happen
  with key roll-overs, blocks transfers between RIRs, etc.); my present 
  estimate is that we'll have a solid understanding of technical steps and 
  consequences for deploying a RPKI global trust anchor by the end of 2013.
  There is discussion of preparing a ICANN/RIR testbed at that time to 
  demonstrate technical compatibility and functionality of the RPKI system 
  while making use of a Global Trust Anchor.

  In parallel, there is another set of issues being worked, and that is 
  engaging with the operator community in each region to understand their
  desire for having a global trust anchor.  It has been noted that relying
  on such a construct will effectively create a single point of "control"
  for Internet operational routing (to the extent that folks everywhere 
  begin actively validating routes using RPKI.)  There is a single point 
  of failure argument against a global trust anchor, as well as creation
  of a point of potential compromise, whether due to malfeasance or actual
  governmental interference.  Note that these types of concerns are very
  similar to those faced by DNSSEC, and in that case they were able to be
  managed in an acceptable manner.  The discussion of the merit of a single 
  trust anchor is still ongoing among operators globally, and will need to 
  reach convergence in order to proceed (in addition to the technical issues 
  outlined above.)

  So, Marcel, please allow me to turn the question around...  Do you 
  do you believe that there should be an RPKI Global Trust Anchor?  
  Are you concerned about the potential aggregation of control and
  risk that may result? (Feel free to answer me privately if you 
  would prefer.)  

  At the point in time when we understand the technical architecture
  being proposed and its implications, we will formally poll the ARIN
  and NANOG community on the question of whether there is support for
  having an RPKI Global Trust Anchor.  My best estimate is that this 
  will occur near the end of this year, but there's nothing wrong with
  having some discussion in the meantime if the mailing list is otherwise
  quiet.  :-)

I hope this provides some insight - thank you for asking about it,
as it has been too long since any status update on this project
(I will work on that as well for the very near future.)

Thanks!
/John

John Curran
President and CEO
ARIN