In this episode of PING, we talk with Job Snijders about secure Internet routing again, focusing on an approach to preserving the state of RPKI as a long-term historical record for research and analysis. Job was last on PING to discuss the ‘Erik’ protocol.
Job has maintained an archive of RPKI state for some time as a volunteer activity. However, a task that was quite manageable when Border Gateway Protocol (BGP) speakers producing Route Origin Authorization (ROA) objects numbered in the hundreds or low thousands has become significantly more expensive now that ROA producers represent a substantial proportion of the approximately 80,000 AS holders worldwide.
Because public key cryptography depends on regular re-signing and re-cataloguing, through another signed object known as the RPKI Manifest, even when there is no substantive change in the underlying information, the data exhibits a large amount of churn. As a result, even compressed representations of RPKI state incur substantial storage overheads because the data does not compress efficiently. Job eventually reached the limits of what could be sustained as a volunteer activity and began exploring a more compact and useful representation of the data. This work has since emerged in the IETF standards process as two related efforts: The Canonical Cache Representation (CCR) and the RPKI Spool data model, which builds on CCR to aggregate and materialize the state of RPKI objects.
Together with his fellow IETF draft authors Bart Bakker, Tim Bruijnzeels, Theo Buehler and Fedor Vompe, Job has defined a remarkably compact and highly compressible representation of RPKI-validated objects and their associated cryptographic payloads. These systems are built on well-established UNIX and Internet technologies, including the tar format for spooled data, ASN.1 for binary encoding, Merkle trees for maintaining compact hash state, and zstd for data compression. The result is a representation that significantly reduces storage requirements while remaining efficient to process and distribute.
It’s a nice approach to solving the scaling problem.
Read more about the archive and the standards on the web:
- RPKIviews.org (Job Snidjers archive of worldwide RPKI data)
- The RPKI Spool format (IETF draft)
- RPKI Canonical Cache Representation (IETF draft)
Subscribe and share your story
You can stream and subscribe to PING via the following channels:
If you’re interested in sharing your insights or research, please get in touch — we’re always looking for great stories from the community. Please let us know what you think of the podcast and the APNIC Blog so we can keep improving.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.