[Sidrops] New I-D: Route Origin Authorization via Protected Delegation of Internet Number Resources

[Invykta <[e-mail]>]

Hi SIDROPS,

I've submitted a new individual Internet-Draft, "Route Origin Authorization via Protected Delegation of Internet Number Resources" (draft-gersch-sidrops-sovereign-roots-00):

    
https://www.ietf.org/archive/id/draft-gersch-sidrops-sovereign-roots-00.html 

https://datatracker.ietf.org/doc/draft-gersch-sidrops-sovereign-roots/


The central question posed is simple: after an Internet number resource has been delegated, should it be possible for the authorization system to express that the superior authority has actually relinquished authority over it?

RPKI provides cryptographic route-origin authorization, but its hierarchical authority model does not provide that property. A superior authority remains part of the authorization hierarchy after delegation. This draft explores a protected delegation boundary after which a superior authority no longer retains the technical capability to reclaim the delegated resource, suppress the holder's effective route-origin authorizations, or create competing allocation or route-origin authority within the protected range.

The proposal is not intended to replace RPKI. It uses a hierarchical resource registry with protected delegation boundaries enforced at state-transition time, derives conventional VRPs, and defines precedence rules for coexistence with RPKI. Routers continue to perform ordinary ROV and require no changes; the additional logic is confined to the authority and relying-party/aggregation side.

One consequence is that the mechanism can also provide route-origin authorization for resources that are not currently protected by RPKI, including legacy resources, but the proposal does not depend on such resources remaining outside RPKI.

I would particularly welcome feedback on:

* whether protected delegation is a useful authorization property in its own right;
* whether the proposed RPKI coexistence and protected-range precedence semantics are sound; and
* whether the trust, recovery, finality, and operational tradeoffs are stated clearly enough for experimentation.

This is an Experimental -00 intended to start technical discussion, not to propose a replacement for RPKI.

Thanks,

Joseph Gersch
Invykta LLC