Initial Certification Policy in the RIPE NCC Service Region

Summary of Proposal:

The RIPE NCC plans to deploy a certification service that can be used to secure uniqueness of resources. This proposal lays out guidelines for how LIRs can receive certificates over their Provider Aggregatable (PA) address space holdings and how these certificates should be maintained.

Policy Text:

a. New
Following guidelines are to apply only for certification of Provider Aggregatable (PA) address space allocations that are held by the Local Internet Registries (LIRs) within the RIPE NCC service region.

The RIPE NCC will issue certificates upon request for RIPE NCC supplied Provider Aggregatable (PA) address space allocations to the LIR that is the registered holder of that space.

The certificate will be issued via a secure channel.

Certificates will be issued with a validity period of up to 18 months.

Certificates will at all times reflect the registration status of the resource in the Registry, as also reflected in the RIPE database.

In practice this means a certificate may be issued to the registered holder of the PA resource at any time that a record of that holding exists in the RIPE database. Withdrawal of the record of that holding from the RIPE database will automatically result in the certificate being revoked.

In the event of revocation due to security breach or similar, new certificates will be issued with a validity period equal to the remaining validity of the revoked certificate.

a. Arguments Supporting the Proposal

The RIPE Certification Task Force (CA-TF) was formed at RIPE 53 to advise, review and to provide feedback about a certification system. More details about the CA-TF can be found at:

http://www.ripe.net/ripe/tf/certification/index.html

Since RIPE 53, the CA-TF has been looking at the system from several angles such as benefits and usefulness of it as well as operational, business and policy implications that it may bring. As these issues were narrowed down for discussion, CA-TF has reported to the community at regular intervals.

This proposal is a product of the work done by the CA-TF. The task force has studied possible policy implications and decided that a short initial policy will be useful that will be a guideline for a certification system for the RIPE community to discuss.

At this stage, a policy only for LIRs holding PA address space is proposed. The CA-TF believes that the system should cover PA resources initially, as this is the simplest case for the system. Once a policy for PA resources for LIRs has been discussed and the community has agreed on guidelines, then the CA-TF will consider more complicated scenarios, such as PI address space and ERX and legacy address space. This phased development is also inline with the technical implementation of the system, as certificates for PA allocations will be the first real cases for the certification system when it launches. Certification of other resources will be implemented later on.

It is proposed that the validity of certificates is tied to the registration status of the resource in the registry as also reflected in the RIPE database. A full definition of registration status is awaited but for the purposes of this proposal it is defined as the existence of a record in the RIPE database showing the resource as being held by the certificate requestor.

b. Arguments Opposing the Proposal

None.

Note: In order to provide additional information related to the proposal, details of an impact analysis carried out by the RIPE NCC are documented below. The projections presented in this analysis are based on existing data and should be viewed only as an indication of the possible impact that the policy might have if the proposal is accepted and implemented.

A. RIPE NCC's Understanding of the Proposed Policy

This proposal directs the RIPE NCC to supply to its members, upon request, a certificate for their IPv4 PA Allocations.

This proposal only applies to IPv4 ALLOCATED PA blocks that were issued by the RIPE NCC and excludes early registration and legacy space, as well as blocks marked as ALLOCATED UNSPECIFIED or ALLOCATED PI.

Also excluded are other types or resources, such as IPv6 and AS numbers.

If resources are returned to or reclaimed by the RIPE NCC, any certificates issued for them will be revoked when the relevant objects are deleted from the RIPE DB.

B. Impact of Policy on Registry and Addressing System

Address/Internet Number Resource Consumption:

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented.

Fragmentation/Aggregation:

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented

C. Impact of Policy on RIPE NCC Operations/Services

Registration Services:

The internal procedures for implementing this policy have not been finalised yet. It is therefore not possible to assess the precise impact that this will have on the Registration Services Operations. As certification is not mandatory for RIPE NCC members, it is not possible to accurately predict the workload increase for the RIPE NCC.

Billing/Finance Department:

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented.

RIPE Database:

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented.

D. Legal Impact of Policy

1. Legal framework considerations

The proposed policy introduces a new RIPE NCC service. Accordingly, the RIPE NCC should develop and document the details of this service and relevant procedures. The RIPE NCC will consider creating a legal framework around this service including the review of the RIPE NCC Standard Terms and Conditions. However, since the certificates are an enhancement to the existing registration services this legal framework should be in line with existing policies and procedures regarding registration.

2. Law Enforcement Agencies intervention

According to the existing legal framework the possibilities for LEAs to order revocation of certificates are extremely limited. Given that certificates reflect the registration status of the resources, for a certificate to be revoked the resources must be deregistered. The introduction of certificates as such does not have any additional impact on the level of possible LEA intervention.