You are here: Home > Participate > Policy Development > Policy Proposals > Initial Certification Policy in the RIPE NCC Service Region

Changes to Initial Certification Policy in the RIPE NCC Service Region

Legend (+) Added (-) Deleted
Changed Tag Added Tag Deleted
delete: <div class="bold"> delete: <h2> delete: <b> insert: <h3>

Summary of Proposal: delete: </b> delete: </h2> delete: </div> delete: <div> delete: <p> The RIPE NCC plans to deploy a certification service that can be used to secure uniqueness of resources. insert: </h3>

insert: <p>

This proposal lays out guidelines for how LIRs can receive Resource Public Key Infrastructure (RPKI) certificates over their Provider Aggregatable (PA) address space holdings IP Resources and how these certificates should be maintained.

delete: </div> delete: <div class="bold"> delete: <h2> delete: <b> insert: <h3>

Policy Text: delete: </b> delete: </h2> delete: </div> delete: <div> insert: </h3>

a. New delete: </b> delete: <br /> Following insert: <br />
insert: <br />
insert: </b>
insert: </p>

insert: <p>

The following guidelines are to apply only for to certification of Provider Aggregatable (PA) address space allocations that are Internet number resources held by the Local RIPE NCC members in good standing. insert: <br />
insert: <br />
The RIPE NCC will issue certificates for Internet Registries (LIRs) within the RIPE NCC service region. delete: </p> delete: <p> number resources upon request to the registered holder of those resources. insert: <br />
insert: <br />
Initially, the following Internet number resources distributed by the RIPE NCC will be eligible for certification: insert: </p>

insert: <ul>
    insert: <li>
  • IPv4 resources with the status "ALLOCATED PA" and "ALLOCATED UNSPECIFIED" insert: </li>
  • insert: <li>
  • IPv6 resources with the status "ALLOCATED-BY-RIR" insert: </li>
  • insert: </ul>
insert: <p>

insert: <br />
The RIPE NCC issues will issue certificates upon request for Provider Aggregatable (PA) address space allocations. delete: </p> delete: <p> The requester must be a RIPE NCC member RIPE NCC supplied IP Resources to the LIR holding Provider Aggregatable (PA) address space allocations. delete: <br /> delete: <br /> When the RIPE NCC receives a certification request, they may ask for further details to ensure that the requester is the legitimate that is the registered holder of the resource. delete: </p> delete: <p> those resources. insert: <br />
The certificate will be issued via a secure channel that the RIPE NCC maintains for its members (at the time of this proposal this is the LIR Portal) channel. insert: <br />
insert: <br />
Certificates will be issued with a validity period of up to 18 months. delete: </p> delete: <p> Renewal months or other maintenance of certificates will be available to LIRs with valid RIPE NCC membership or other appropriate contractual relationship. Certificates will be revoked when allocations are returned or withdrawn. as otherwise stated in the RIPE NCC Certificate Practice Statement [1]. insert: <br />
insert: <br />
In the event of revocation due to security breach or similar, new certificates will be issued with a validity period equal to the remaining validity of the revoked certificate. Maintenance and renewal of certificates will be tied to contractual relationship insert: </p>

insert: <p>

Certificates will at all times reflect the registration status of the LIR with the RIPE NCC. In cases of continuing non-payment, cessation of contract and/or closing of the LIR, existing certificates may be revoked by the RIPE NCC. Notification and a grace period will be provided before the RIPE NCC revokes or ceases renewal of any certificates. delete: </p> delete: </div> delete: <h2> delete: <b> resource. insert: </p>

insert: <h3>

References insert: </h3>

insert: <p>

[1] RIPE NCC RPKI (Resource Public Key Infrastructure) Certification Practice Statement, insert: <a class="internal-link" href="resolveuid/0abf5eab-ee86-4cb2-94c7-54f7fa896ede" target="_self" title="" data-val="0abf5eab-ee86-4cb2-94c7-54f7fa896ede" data-linktype="internal"> insert: <span> www.ripe.net/certification/cps.html insert: </span> insert: </a> insert: </p>

insert: <p>

Rationale: delete: </b> delete: </h2> delete: <div> insert: </p>

a. Arguments Supporting the Proposal

The RIPE Certification Task Force (CA-TF) was formed at RIPE 53 to advise, review and to provide feedback about a certification system. More details about the CA-TF can be found at: delete: <br /> insert: </p>

insert: <p>

insert: <a class="external-link" href="http://www.ripe.net/ripe/tf/certification/index.html"> http://www.ripe.net/ripe/tf/certification/index.html insert: </a>

Since RIPE 53, the CA-TF has been looking at the system from several angles such as benefits and usefulness of it as well as operational, business and policy implications that it may bring. As these issues were narrowed down for discussion, CA-TF has reported to the community at regular intervals.

This proposal is a product of the work done by the CA-TF. The task force has studied possible policy implications and decided that a short initial policy will be useful that will be a guideline for a certification system for the RIPE community to discuss.

At this stage, a policy only for LIRs holding PA address space is proposed. The CA-TF believes that the system should cover PA these resources initially, as this is the simplest case for the system. Once a policy for PA resources for held by LIRs has been discussed and the community has agreed on guidelines, then the CA-TF will consider more complicated scenarios, such as PI address space and ERX and legacy address space. This phased development is also inline with the technical implementation of the system, as certificates for PA allocations will be LIR resource holders are the first real cases for the certification system when it launches. system. Certification of other resources will be implemented later on.

It is proposed that the validity of certificates is tied to membership the registration status of an LIR. This is inline with the other services that the RIPE NCC provides to its members. In order to minimise any operational impact caused the resource. Rules and processes for deregistration of resources by the revocation or non-renewal of certificates, RIPE NCC are being clarified by a grace period will be incorporated into RIPE NCC procedures. delete: </p> delete: </div> delete: <div> new document from RIPE NCC “Closure of LIR and Deregistration of Internet number resource” presented at RIPE 61 Services WG: insert: </p>

insert: <p>

insert: <span> insert: <a href="./resolveuid/8b37dba1dbfadd870d8a9245b613c1a1" data-val="8b37dba1dbfadd870d8a9245b613c1a1" data-linktype="internal"> https://www.ripe.net/ripe/docs/ripe-517 insert: </a> insert: </span> insert: </p>

b. Arguments Opposing the Proposal

None.

delete: </div> insert: <h3>

insert: <b> Impact Analysis: insert: </b> insert: </h3>

insert: <p>

Note: In order to provide additional information related to the proposal, details of an impact analysis carried out by the RIPE NCC are documented below. The projections presented in this analysis are based on existing data and should be viewed only as an indication of the possible impact that the policy might have if the proposal is accepted and implemented. insert: </p>

insert: <h3>

insert: <b> A. RIPE NCC's Understanding of the Proposed Policy insert: </b> insert: </h3>

insert: <p>

This proposal directs the RIPE NCC to issue to its members, upon request, a certificate for their IP Address allocations as registered in the RIPE Registry. insert: </p>

insert: <p>

  insert: </p>

insert: <p>

This proposal only applies to the following types of resources: insert: </p>

insert: <ul>
    insert: <li>
  • IPv4 ALLOCATED PA insert: </li>
  • insert: <li>
  • IPv4 ALLOCATED UNSPECIFIED insert: </li>
  • insert: <li>
  • IPv6 ALLOCATED-BY-RIR insert: </li>
  • insert: </ul>
insert: <p>

Excluded are other types or resources, such as AS numbers, ANYCAST, IPv4 ALLOCATED PI, IPv6 ASSIGNED, IPv6 ASSIGNED PI and EARLY-REGISTRATION blocks. insert: </p>

insert: <p>

If resources are returned to or reclaimed by the RIPE NCC, any certificates issued for them will be revoked when the relevant objects are deleted from the RIPE Registry. insert: </p>

insert: <h3>

insert: <b> B. Impact of Policy on Registry and Addressing System insert: </b> insert: </h3>

insert: <p>

insert: <b> Address/Internet Number Resource Consumption: insert: </b> insert: </p>

insert: <p>

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented. insert: </p>

insert: <p>

insert: <b> Fragmentation/Aggregation: insert: </b> insert: </p>

insert: <p>

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented insert: </p>

insert: <h3>

insert: <b> C. Impact of Policy on RIPE NCC Operations/Services insert: </b> insert: </h3>

insert: <p>

insert: <b> Registration Services: insert: </b> insert: </p>

insert: <p>

The internal procedures for implementing this policy have not been finalised yet. It is therefore not possible to assess the precise impact that this will have on the Registration Services Operations. As certification is not mandatory for RIPE NCC members, it is not possible to accurately predict the workload increase for the RIPE NCC. insert: </p>

insert: <p>

insert: <b> Billing/Finance Department: insert: </b> insert: </p>

insert: <p>

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented. insert: </p>

insert: <p>

insert: <b> RIPE Database: insert: </b> insert: </p>

insert: <p>

After analysing the data that is currently available, the RIPE NCC does not anticipate that any significant impact will be caused if this proposal is implemented. insert: <b> insert: </b> insert: </p>

insert: <h3>

insert: <b> D. insert: </b> insert: <b> Legal Impact of Policy insert: </b> insert: </h3>

insert: <p>

After analysing the data that is currently available, the RIPE NCC does not anticipate that the implementation of this proposed policy will cause any significant legal implications. insert: <br />
insert: <br />
However for clarification purposes the following points should be emphasised: insert: <br />
insert: <br />
insert: <b> 1. Legal framework considerations insert: </b> insert: </p>

insert: <p>

The legal framework around this service is in line with existing policies and procedures regarding registration. Please note that the details of the service are outlined in: insert: </p>

insert: <ul>
    insert: <li>
  • the RIPE NCC Certification Service Terms and Conditions that refer to the relationship between the RIPE NCC and LIRs that make use of the certification service through the LIR insert: <br />
    insert: <a class="external-link" href="http://www.ripe.net/certification/legal/tc-service.html"> http://www.ripe.net/certification/legal/tc-service.html insert: </a> insert: </li>
  • insert: <li>
  • the RIPE NCC Certification Repository Terms and Conditions that refer to the relationship between the RIPE NCC and anyone who makes use of the Repository (the relying parties) insert: <br />
    insert: <a class="external-link" href="http://www.ripe.net/certification/legal/tc-repository.html"> http://www.ripe.net/certification/legal/tc-repository.html insert: </a> insert: </li>
  • insert: </ul>
insert: <p>

  insert: </p>

insert: <p>

insert: <b> 2. Law Enforcement Agencies’ intervention insert: </b> insert: </p>

insert: <p>

According to the existing legal framework the possibilities for LEAs to order revocation of certificates are extremely limited. Given that certificates reflect the registration status of the resources, for a certificate to be revoked the resources must be deregistered. The introduction of certificates as such does not have any additional impact on the level of possible LEA intervention. insert: </p>

insert: <h3>

insert: <b> Abstract insert: </b> insert: </h3>

insert: <p>

The following guidelines apply only to certification of Internet number resources held by RIPE NCC members in good standing. insert: </p>

insert: <h3>

insert: <b> Contents insert: </b> insert: </h3>

insert: <p>

1.0 Certification of Internet Number Resources insert: </p>

insert: <p>

2.0 References insert: </p>

insert: <p>

3.0 Attribution insert: </p>

insert: <h3>

insert: <b> 1.0 Certification of Internet Number Resources insert: </b> insert: </h3>

insert: <p>

The RIPE NCC will issue certificates for Internet number resources upon request to the registered holder of those resources. insert: <br />
insert: <br />
Initially, the following Internet number resources distributed by the RIPE NCC will be eligible for certification: insert: <br />
insert: <br />
insert: </p>

insert: <ul>
    insert: <li>
  • IPv4 resources with the status "ALLOCATED PA" and "ALLOCATED UNSPECIFIED" insert: </li>
  • insert: <li>
  • IPv6 resources with the status "ALLOCATED-BY-RIR" insert: </li>
  • insert: </ul>
insert: <p>

insert: <br />
The RIPE NCC will issue certificates upon request for RIPE NCC supplied IP Resources to the LIR that is the registered holder of those resources. insert: <br />
insert: <br />
The certificate will be issued via a secure channel. insert: <br />
insert: <br />
Certificates will be issued with a validity period of up to 18 months or as otherwise stated in the RIPE NCC Certificate Practice Statement [1]. insert: <br />
insert: <br />
In the event of revocation due to security breach or similar, new certificates will be issued with a validity period equal to the remaining validity of the revoked certificate. insert: <br />
insert: <br />
Certificates will at all times reflect the registration status of the resource. insert: </p>

insert: <h3>

insert: <b> 2.0 References insert: </b> insert: </h3>

insert: <p>

[1] RIPE NCC RPKI (Resource Public Key Infrastructure) Certification Practice Statement, insert: <a class="internal-link" href="resolveuid/0abf5eab-ee86-4cb2-94c7-54f7fa896ede" target="_self" title="" data-val="0abf5eab-ee86-4cb2-94c7-54f7fa896ede" data-linktype="internal"> insert: <span> www.ripe.net/certification/cps.html insert: </span> insert: </a> insert: </p>

insert: <h3>

insert: <b> 3.0 Attribution insert: </b> insert: </h3>

insert: <p>

This document is compiled from policies developed by the RIPE community. insert: </p>

insert: <p>

The following people actively contributed by making proposals through the RIPE Policy Development Process: insert: </p>

insert: <p>

Nigel Titley insert: </p>

Initial Certification Policy in the RIPE NCC Service Region
The RIPE NCC plans to deploy a certification service that can be used to secure uniqueness of resources. This proposal lays out guidelines for how LIRs can receive certificates over their Provider Aggregatable (PA) address space holdings and how these certificates should be maintained.
Initial Certification Policy for Provider Aggregatable Address Space Holders in the RIPE NCC Service Region
Get Involved

The Address Policy Working Group develops policies relating to the allocation and registration of Internet number resources (IPv4 and IPv6 addresses and ASNs) by the RIPE NCC and its members. Anyone with an interest in Internet numbering issues is welcome to observe, participate and contribute to the WG. To post a message to the list, send an email to address-policy-wg@ripe.net. Please note that only subscribers can post messages.

RIPE Forum

The RIPE Forum is an additional way to participate in RIPE community mailing list discussions using a web-based interface rather than an email client.

Check out the forum

Please contact if you need more information.

Stay up to date!

Follow @PDO_RIPE_NCC on Twitter.