IETF SIDROPS

IETF SIDROPS
Name	SIDROPS
Title	IETF SIDROPS
Status	Standards Track
Started	2018
Area	Security, Routing, Authentication
Organizations	IETF, IAB, IRTF

IETF SIDROPS IETF SIDROPS is an Internet-Draft and standards-track effort in the Internet Engineering Task Force ecosystem that defines a set of mechanisms for secure distribution, validation, and revocation of routing authorization and delegation data; it arose from work in the SIDR Working Group, influenced by operational requirements articulated by RIPE NCC, ARIN, APNIC, LACNIC, and AfriNIC. The effort interacts with established frameworks such as Resource Public Key Infrastructure, Routing Public Key Infrastructure, Border Gateway Protocol, and cryptographic systems developed in contexts like IETF DNSOP and IETF TLS to reduce routing incidents exemplified by events like the 2018 YouTube Pakistan outage and the 2008 YouTube Pakistan outage.

Background and Purpose

The Background and Purpose section situates SIDROPS relative to precursors including RPKI, BGPsec, MANRS, and discussions from IETF SIDR Working Group meetings attended by representatives of Cisco Systems, Juniper Networks, Google, Cloudflare, and national registries such as NIC Chile and NIXI. It aims to provide operationally deployable practices that reconcile policy instruments from Internet Assigned Numbers Authority coordination, cryptographic attestations found in X.509 deployments, and operational telemetry models used by Equinix, Akamai Technologies, and Amazon Web Services. The charter references incidents like the 2006 YouTube Pakistan and analyses from NIST and CERT teams to motivate robust delegation, revocation, and operational validation.

Architecture and Components

The Architecture and Components section describes a modular system composed of a publication infrastructure, a validation logic, and a distribution plane interoperable with Route Origin Authorizations and Route Origin Validation mechanisms used by Internet Exchange Point operators such as LINX and DE-CIX. Components include a repository model inspired by RPKI CA/EE relationships, a signed manifest analogous to artifacts in IETF PKIX, and a lightweight transport aligning with practices in IETF TRILL and IETF NETCONF. The architecture maps to operational elements found in deployments by Verisign, Hurricane Electric, and content providers like Facebook while aligning with policy frameworks maintained by IANA and regional registries.

Protocols and Standards

Protocols and Standards covers message formats, cryptographic bindings, and distribution protocols that reference or reuse types from RFC 8200 family work, RFC 5280, and contemporary proposals from IETF SIDR and IETF RPKI. It specifies object encodings compatible with ASN.1 and transport options over protocols such as HTTP/2, gRPC, and BGP extensions, and it addresses interoperability with implementations in network operating systems from Arista Networks and software projects like OpenBSD, Quagga, and FRRouting. The standardization process engaged working groups across the IETF Security Area, IETF OPERATIONS Area, and liaisons with IETF RPKI Working Group and IETF Routing Area.

Implementation and Deployment

Implementation and Deployment outlines reference implementations developed by vendors including Cisco Systems, Juniper Networks, and open-source communities around OpenStack and Kubernetes that enable repository hosting, validator services, and client libraries used by network operators at Level 3 Communications, NTT Communications, and cloud providers such as Microsoft Azure. Deployment case studies involve interconnection points like AMS-IX and research networks such as GEANT and Internet2, illustrating procedures for key management, certificate issuance, and roll-out strategies aligned with guidance from IETF RFC 2119 and operational playbooks used by APNIC and ARIN.

Security Considerations

Security Considerations addresses threats including key compromise, replay attacks, and insider misconfiguration, drawing on threat models and mitigations similar to those in IETF BCP 38, IETF BCP 84, and research from SANS Institute and US-CERT. It prescribes cryptographic primitives consistent with recommendations from NIST SP 800-131A and transition plans influenced by IETF CFRG outputs, and it details auditability and forensic practices used by CERT/CC, ENISA, and national incident response teams. The section discusses revocation semantics comparable to CRL and OCSP mechanisms and operational resilience techniques practiced by NTT, Telefonica, and BT Group.

Adoption and Operational Experience

Adoption and Operational Experience summarizes real-world uptake by route filtering communities, internet service providers like Comcast, Verizon Communications, and research observatories such as RIPE Atlas, CAIDA, and RouteViews, documenting improvements in route origination accuracy and reductions in hijack incidents similar to analyses published by IETF SIDR contributors and independent studies from Carnegie Mellon University and University of California, San Diego. It reports operational challenges observed at exchanges including DE-CIX and data centers managed by Digital Realty, notably around key rollover, tooling integration with Juniper Junos and Cisco IOS XR, and coordination among registries like AfriNIC.

Related Work and Future Directions

Related Work and Future Directions situates SIDROPS among adjacent efforts such as BGPsec, RPKI Relying Party Protocols, and research projects at MIT CSAIL, ETH Zurich, and University of Cambridge; upcoming work targets enhanced automation, privacy-preserving attestations inspired by IETF HIP research, and integration with observability frameworks used by Prometheus and Grafana. Future directions anticipate liaison activity with standards bodies like IEEE, collaboration with cloud consortiums such as Cloud Native Computing Foundation, and incorporation of cryptographic agility recommended by IETF CFRG and IAB.

Category:Internet protocols