The content of a ROA identifies a single AS that has been authorized by the address space holder to originate routes and a list of one or more IP address prefixes that will be advertised.
If the address space holder needs to authorize multiple ASes to advertise the same set of address prefixes, the holder issues multiple ROAs, one per AS number.
A ROA is formally defined as:¶
RPKI-ROA-2022 { iso(1) member-body(2) us(840) rsadsi(113549)
pkcs(1) pkcs9(9) smime(16) mod(0) id-mod-rpkiROA-2022(TBD) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
IMPORTS
CONTENT-TYPE
FROM CryptographicMessageSyntax-2010 -- in [RFC6268]
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-9(9) smime(16) modules(0) id-mod-cms-2009(58) } ;
ct-routeOriginAttestation CONTENT-TYPE ::=
{ TYPE RouteOriginAttestation
IDENTIFIED BY id-ct-routeOriginAuthz }
id-ct-routeOriginAuthz OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-9(9) id-smime(16) id-ct(1) routeOriginAuthz(24) }
RouteOriginAttestation ::= SEQUENCE {
version [0] INTEGER DEFAULT 0,
asID ASID,
ipAddrBlocks SEQUENCE (SIZE(1..2)) OF ROAIPAddressFamily }
ASID ::= INTEGER (0..4294967295)
ROAIPAddressFamily ::= SEQUENCE {
-- Note: addressFamily can only be '0001'H (IPv4) or '0002'H (IPv6) --
addressFamily OCTET STRING (SIZE(2)),
addresses SEQUENCE (SIZE(1..MAX)) OF ROAIPAddress
}
ROAIPAddress ::= SEQUENCE {
address IPAddress,
-- Note: maxLength must be equal or larger than size of IPAddress, --
-- and equal or smaller to what the AFI context permits --
maxLength INTEGER (0..128) OPTIONAL
}
-- Note: if the ROAIPAddressFamily's addressFamily is IPv4, the --
-- IPAddress' size cannot exceed 32; conversely if addressFamily --
-- is IPv6, size can't exceed 128. --
IPAddress ::= BIT STRING (SIZE(0..128))
END
¶
The ipAddrBlocks field encodes the set of IP address prefixes to which the AS is authorized to originate routes.
Note that the syntax here is more restrictive than that used in the IP Address Delegation extension defined in RFC 3779.
That extension can represent arbitrary address ranges, whereas ROAs need to represent only prefixes.¶
Within the ROAIPAddressFamily structure, addressFamily contains the Address Family Identifier (AFI) of an IP address family.
This specification only supports IPv4 and IPv6.
Therefore, addressFamily MUST be either 0001 or 0002.
There MUST be only one instance of ROAIPAddressFamily per unique AFI.
The ROAIPAddressFamily structure MUST NOT appear more than twice.¶
Within a ROAIPAddress structure, the addresses field represents prefixes as a sequence of type IPAddress.
(See [RFC3779] for more details).
If present, the maxLength MUST be an integer greater than or equal to the length of the accompanying prefix, and less than or equal to the length (in bits) of an IP address in the address family (32 for IPv4 and 128 for IPv6).
When present, the maxLength specifies the maximum length of the IP address prefix that the AS is authorized to advertise.
(For example, if the IP address prefix is 203.0.113/24 and the maxLength is 26, the AS is authorized to advertise any more specific prefix with a maximum length of 26.
In this example, the AS would be authorized to advertise 203.0.113/24, 203.0.113.128/25, or 203.0.113.0/25, but not 203.0.113.0/27.)
When the maxLength is not present, the AS is only authorized to advertise the exact prefix specified in the ROA.¶
Note that a valid ROA may contain an IP address prefix (within a ROAIPAddress element) that is encompassed by another IP address prefix (within a separate ROAIPAddress element).
For example, a ROA may contain the prefix 203.0.113/24 with maxLength 26, as well as the prefix 203.0.113.0/28 with maxLength 28.
(Such a ROA would authorize the indicated AS to advertise any prefix beginning with 203.0.113 with a minimum length of 24 and a maximum length of 26, as well as the specific prefix 203.0.113.0/28.)
Additionally, a ROA MAY contain two ROAIPAddress elements, where the IP address prefix is identical in both cases.
However, this is NOT RECOMMENDED as, in such a case, the ROAIPAddress with the shorter maxLength grants no additional privileges to the indicated AS and thus can be omitted without changing the meaning of the ROA.¶