Mirjam Kühne 1 RIPE 34, September 1999 RIPE NCC Status RIPE NCC Staff presented by Mirjam Kühne.
RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE...
Transcript of RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE...
![Page 1: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/1.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
RIPE NCC Certification Software
Tim BruijnzeelsSenior Software Engineer RIPE NCC
![Page 2: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/2.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Resource Certificate
✓Public Key✓Resources✓Signature
➡ NO IDENTITY!
![Page 3: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/3.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Route Origin Authorisation
➡ NO IDENTITY!
✓AS Number✓IP Prefixes✓Signature
![Page 4: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/4.jpg)
PUBLIC KEY
RESOURCES
SIGNATURE
Certificate of Holdership
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
The Resource PKI
PUBLIC KEY
RESOURCES
SIGNATURE
Certificate of Holdership
ROA
ASN
PREFIXES
SIGNATURE
PUBLIC KEY
RESOURCES
SIGNATURE
Certificate of Holdership
Trust Anchor
(Offline NCC)
Online NCC Member
![Page 5: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/5.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
➡Simplify ROA management for members
➡Available for all members
➡Opt-in
➡PA only, for now...
![Page 6: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/6.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 7: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/7.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 8: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/8.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 9: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/9.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 10: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/10.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 11: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/11.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 12: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/12.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 13: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/13.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 14: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/14.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 15: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/15.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
Hosted Member CA
![Page 16: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/16.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
RPKI Validation: Distributed Repositories
IANA
RIPE NCC
ARIN
BIG LIR
APNIC
Validation Tool
(rcynic/bbn)
validatedcache
AFRINIC
LACNIC
![Page 17: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/17.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
validatedcache
RPKI RTR PROTOCOL
BGPDecisionProcess
RPKI Validation: RPKI-RTR protocol
![Page 18: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/18.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
validatedcache
RPKI RTR PROTOCOL
BGPDecisionProcess
route-map validity-0
match rpki-invalid
drop
route-map validity-1
match rpki-not-found
set localpref 50
// valid defaults to 100
RPKI Validation: RPKI-RTR protocol
![Page 19: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/19.jpg)
ROA
ASN
PREFIXES
SIGNATURE
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
RIPE NCCRIPE NCC Validator
ASN IP Prefix
3333 192.168/16
65500 10/8
ROA.CSV
top-down
bottom-up
export
RPKI Validation: RIPE NCC Validator
![Page 20: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/20.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
.../ripencc-rpki-validator $ find .
./bin
./bin/certification-validator
./jar
./jar/certification-validator-1.17-jar-with-dependencies.jar
./README.txt
RPKI Validation: RIPE NCC Validator
http://labs.ripe.net/Members/agowland/ripe-ncc-validator-for-resource-certification
ripencc-rpki-validator.zip
![Page 21: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/21.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
rsync rsync://certrepo.ripe.net/rta/CN=RTA,O=RIPE
%20NCC,C=NL.cer ./rta.cer
.../ripencc-rpki-validator $ bin/certification-validator \
--top-down -t ./rta.cer -o out --roa-export roas.csv
15:55:49,927 INFO rsync://certrepo.ripe.net/rta/CN=RTA,O=RIPE
%20NCC,C=NL.crl is VALID
15:55:49,932 INFO rsync://certrepo.ripe.net/rta/CN=RTA,O=RIPE
%20NCC,C=NL.mnf is VALID
......
RPKI Validation: RIPE NCC Validator
download TA
top-down validation
![Page 22: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/22.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
RPKI Validation: RIPE NCC Validator
URI ASN IP Prefix ...
rsync://.. AS3333 85.118.184.0/21
rsync://.. AS12657 2001:1578::/32
rsync://.. AS29317 212.102.160.0/19
....
roas.csv
![Page 23: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/23.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
.../ripencc-rpki-validator $ bin/certification-validator \
-t ./rta.cer -f bl.roa --print
16:47:56,381 INFO rsync://certrepo.ripe.net/rta/CN=RTA,O=RIPE
%20NCC,C=NL.cer is VALID
....
16:47:58,357 INFO file:/Users/tim/Desktop/Brisbane/ripencc-rpki-
validator/bl.roa is VALID
Signing time: 2010-08-19T09:28:53.000Z
ASN: AS3333
Prefixes:
85.118.184.0/21
RPKI Validation: RIPE NCC Validator
bottom-up validation
![Page 24: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/24.jpg)
http://www.ripe.net
RIPE Network Coordination Centre
Tim Bruijnzeels
RIPE NCC Validator
➡ Initially developed to test server implementation
➡Command line tool released to support ad-hoc validation and ROA exports right now
➡Can be extended if community wants:➡usability➡caching / distributed repositories➡RPKI-RTR
➡Open Source Release planned
![Page 25: RIPE NCC Certification Software - APNIC › 30 › pdf › ripencc-certification-software.pdf RIPE Network Coordination Centre Tim Bruijnzeels RIPE NCC Certification Software Tim Bruijnzeels](https://reader033.fdocuments.us/reader033/viewer/2022052801/5f167778fbe9cf5f980c99ef/html5/thumbnails/25.jpg)
RIPE Network Coordination Centre
http://www.ripe.netTim Bruijnzeels
Questions?