[Sidrops] Re: I-D Action: draft-ietf-sidrops-aspa-profile-21.txt

[Job Snijders <[e-mail]>]

Dear all,

This mostly is just a refresh of the draft which specifies the ASPA
object profile, with one minor change relevant to both CAs & RPs to
tighten the bolts on this profile.

In previous versions of this profile it was possible to superfluously
encode multiple (unrelated) ASIds in the ASPA's End Entity (EE)
certificate.

Going forward, encoding of multiple ASNs is disallowed. This simplifies
the model for both issuers & validators: an explicit one-to-one mapping
is used between the CustomerASID contained within the ASPA's eContent
payload and the ASID encoded in the RFC 3779 extensions of the ASPA's
EE certificate.

The existing ASPA deployment https://console.rpki-client.org/aspa.html
is fully compatible with this change. No code changes are required for
most (if not all) CA implementations. On the RP side of the house,
implementers could add an extra check to confirm the 3779 AS extension
of the EE contains only a single ASID.

Kind regards,

Job

On Fri, Jan 16, 2026 at 04:53:13AM -0800, [e-mail] wrote:
> Internet-Draft draft-ietf-sidrops-aspa-profile-21.txt is now available. It is
> a work item of the SIDR Operations (SIDROPS) WG of the IETF.
> 
>    Title:   A Profile for Autonomous System Provider Authorization
>    Authors: Alexander Azimov
>             Eugene Uskov
>             Randy Bush
>             Job Snijders
>             Russ Housley
>             Ben Maddison
>    Name:    draft-ietf-sidrops-aspa-profile-21.txt
>    Pages:   15
>    Dates:   2026-01-16
> 
> Abstract:
> 
>    This document defines a Cryptographic Message Syntax (CMS) protected
>    content type for Autonomous System Provider Authorization (ASPA)
>    objects for use with the Resource Public Key Infrastructure (RPKI).
>    An ASPA is a digitally signed object through which the issuer (the
>    holder of an Autonomous System identifier), can authorize one or more
>    other Autonomous Systems (ASes) as its upstream providers.  When
>    validated, an ASPA's eContent can be used for detection and
>    mitigation of route leaks.
> 
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-profile/
> 
> There is also an HTMLized version available at:
> https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-profile-21
> 
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-sidrops-aspa-profile-21
> 
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
> 
> 
> _______________________________________________
> Sidrops mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]