A Publication-Point-Based Incremental Validation Procedure for RPKI Relying Parties

Introduction RPKI RPs validate RPKI data by traversing the certificate tree from trust anchors to subordinate CAs and payload-carrying signed objects, such as ROAs and ASPA. This top-down validation model ensures that each object is evaluated in the context of its issuing CA, the applicable manifest, the applicable CRL, the applicable effective resource context, and the current validation time. However, repeating full top-down validation after every repository synchronization cycle can introduce significant validation overhead, even when only a small portion of the publication point has changed. This document specifies a publication-point-based incremental validation procedure. The procedure uses cached validation state associated with CA publication points, together with the current manifest and CRL, to determine which validation results can be safely reused and which checks must be re-executed. The RP still traverses the currently reachable RPKI tree from the trust anchors. The difference is that unchanged objects do not necessarily require repeated parsing, signature verification, and full object validation during every validation cycle. This document specifies an optional procedure for reducing redundant validation work inside an RP implementation. This document does not define a new RPKI object format, does not change RRDP or rsync behavior, and does not modify the validation semantics of RPKI certificates, manifests, CRLs, ROAs, ASPA objects, or other RPKI signed objects. The cache structures and identifiers described in this document are conceptual; implementations may use equivalent internal representations. The intended correctness property is that, for the same repository snapshot, trust anchor set, validation policy, and validation time, the incremental validation procedure produces the same validated payload output as a full top-down validation.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Cache State and Bootstrapping Incremental validation depends on validation state produced by a previous validation cycle. When no usable cache exists, the RP first obtains a complete local repository snapshot using its selected synchronization mechanism, and then performs full top-down validation from the trust anchors. During this initial validation, the RP validates the currently reachable CA publication points, including the manifest, CRL, and all objects referenced by each valid manifest. The validation results produced during this process are used to build the initial cache state. The cache can be represented as a mapping from a CA identifier to the validation state of the publication point associated with that CA: PublicationPointState } ]]> A cache entry is created only for a CA that has been validated successfully in a previous validation cycle and whose publication point has a valid manifest and a valid CRL. A CA_ID identifies the validated CA certificate object and the publication point associated with that CA. The representation is: A publication point cache entry contains the state needed to determine whether the publication point, or individual objects in that publication point, can be reused in a later validation cycle: ObjectValidationState } } ]]> For the publication point, ca_effective_resources records the effective IP address and AS number resources of the CA certificate under which the publication point was validated. For the manifest, thisUpdate and nextUpdate refer to the time fields in the manifest eContent. For the CRL, thisUpdate and nextUpdate refer to the CRL validity interval. The per-object validation state records the information needed to decide whether a previous validation result can be reused in a later validation cycle: The cert_serial, notBefore, and notAfter fields record the serial number and validity interval of the CA certificate or the EE certificate associated with the signed object. The effective_resources field is relevant only for valid subordinate CA certificates and records the subordinate CA's current effective resources. The derived_payload field is relevant only for valid payload-carrying signed objects. For example, derived_payload records the effective validated payload generated by ROA and ASPA objects. The failure_reason field is relevant only for objects that were invalid in the cached state. This field requires distinguishing at least failures caused by the validation time being earlier than the relevant notBefore time and failures caused by CRL revocation. Such objects can become valid in a later validation cycle if the current validation time has entered the relevant validity interval, or if the current CRL no longer revokes the relevant certificate serial number.

Incremental Validation Procedure After the RP has obtained an updated local repository snapshot, validation starts from the configured trust anchors and proceeds top-down. In this document, the recursive validation process is modeled as repeated execution of ValidatePP(CA) for each currently valid CA encountered during the traversal. For each accepted trust anchor or validated subordinate CA, the RP computes the corresponding CA_ID. If no usable cache entry exists for the CA_ID, the publication point is processed as a new CA publication point as described in . If a usable cache entry exists, the publication point is processed as an existing CA publication point as described in .

Trust Anchor Processing The RP starts validation from its configured trust anchors. Trust anchor processing follows the applicable TAL processing rules and the RP's local trust anchor configuration. After a trust anchor has been accepted in the current validation cycle, it is treated as a special self-signed root CA for the purpose of its publication point processing. The RP computes the corresponding CA_ID for the accepted trust anchor certificate. If a usable cache entry exists for this CA_ID, the trust anchor publication point is processed as an existing CA publication point as described in . Otherwise, it is processed as a new CA publication point as described in . If a trust anchor is not accepted in the current validation cycle, its subtree does not contribute to the current validated payload output.

New CA Publication Point A CA publication point is considered new when the CA_ID of the current CA does not match any usable entry in the validation cache. For a new CA publication point, the RP performs full validation for that publication point according to the applicable RPKI specifications, including resource certificate and CRL validation , signed object validation , manifest validation , and validation of supported payload-carrying object types such as ROAs and ASPA objects . In general, the RP may:

locate and validate the manifest and CRL associated with the current CA;
check that the objects referenced by the manifest are present in the current local repository snapshot and match the hashes recorded in the manifest;
fully validate the objects referenced by the manifest, generate validated payloads from valid payload-carrying objects, and recursively process valid subordinate CAs;
record the resulting publication point state, including ca_effective_resources and per-object state, in the validation cache for later validation cycles.

This subsection does not redefine the validation rules for RPKI objects. Certificate and CRL validation, manifest processing, signed object validation, and payload extraction follow the applicable RPKI specifications for the corresponding object types.

Existing CA Publication Point A CA publication point is considered existing when the CA_ID of the current CA matches a usable entry in the validation cache. A CA_ID cache hit indicates that the CA certificate object itself has not changed. It does not, by itself, indicate that the CA is reached under the same resource context, or that all cached validation results can be reused.

CA Effective Resource Context Checking The RP first compares the current effective resources (effective_resources) of the CA certificate, as computed when validating that CA certificate in its parent publication point, with the cached ca_effective_resources of the CA's own publication point cache. If the two values differ, the RP does not reuse the cached publication point state or cached object validation state for this CA publication point. The publication point is processed by full validation as described in under the current ca_effective_resources. If the two values are equal, the RP processes the current manifest and CRL as described in .

Manifest and CRL Processing The RP locates the current manifest and CRL associated with the CA in the current local repository snapshot and computes their object hashes. If either the manifest or the CRL is missing, the RP may fall back to the cached publication point state according to local policy. The RP then applies one of the following cases. Case 1: Manifest and CRL unchanged. If both the current manifest hash and the current CRL hash match the cached manifest hash and cached CRL hash, the RP checks the cached manifest thisUpdate and nextUpdate values and the cached CRL thisUpdate and nextUpdate values against the current validation time. If these checks succeed, the RP processes the publication point as described in . If either the cached manifest or the cached CRL is not valid at the current validation time, the publication point is considered invalid for the current validation cycle. Case 2: Manifest changed. If the current manifest hash differs from the cached manifest hash, the RP validates the current manifest and current CRL according to the applicable RPKI validation rules. The current CRL must be referenced by the current manifest and must match the hash recorded in the current manifest. If validation succeeds, the RP uses the object set defined by the current manifest and processes the publication point as described in . If the manifest or CRL validation fails, the RP may fall back to the cached publication point state according to local policy.

Publication-Point-Level Reuse Publication-point-level reuse is used when the CA_ID, ca_effective_resources, manifest hash, and CRL hash all match the cached state. In this case, the RP reuses the cached validation state for the publication point, subject only to checks that depend on the current validation time.

For each cached object that was valid in the cached state, the RP checks whether the relevant certificate or signed object is valid at the current validation time.
For each cached object that was invalid only because the validation time was earlier than the relevant notBefore time, the RP checks whether the relevant certificate or signed object is within its validity interval at the current validation time. If it is, the RP fully validates the object before treating it as valid in the current validation cycle.
If an object is valid in the current validation cycle and is a payload-carrying signed object, its derived_payload contributes to the current validated payload output.
If an object is valid in the current validation cycle and is a subordinate CA certificate, the RP recursively applies ValidatePP(child CA) using the subordinate CA's effective_resources.

Cached objects that are not valid in the current validation cycle do not contribute to the current validated payload output.

Object-Level Reuse Object-level reuse is used when the CA_ID and ca_effective_resources match the cached state, but the current manifest hash differs from the cached manifest hash. The current manifest defines the object set of the current publication point. Objects that are not referenced by the current manifest do not contribute to the current validated payload output.

For every object referenced by the current manifest, the RP checks that the corresponding raw object exists in the current local repository snapshot and that the object hash matches the hash recorded in the current manifest. If any referenced object is missing or has a mismatching hash, the RP may fall back to the cached publication point state according to local policy.
For each object referenced by the current manifest, the RP looks for cached object validation state using the object's filename and hash.
If matching cached object validation state exists and the object was valid in the cached state, the RP checks whether the relevant certificate or signed object is valid at the current validation time. If the current CRL hash differs from the cached CRL hash, the RP also checks whether the relevant certificate serial number is revoked by the current CRL. If these checks succeed, the cached object validation result is reused.
If matching cached object validation state exists and the object was invalid in the cached state, the RP uses the recorded failure_reason to decide whether the object needs to be validated again. The RP fully validates the object again only when one of the following conditions is met:
- the previous failure was caused by the validation time being earlier than the relevant notBefore time, and the relevant certificate or signed object is within its validity interval at the current validation time; or
- the previous failure was caused by CRL revocation, the current CRL hash differs from the cached CRL hash, and the current CRL no longer contains the relevant certificate serial number.
If neither condition is met, the object remains invalid in the current validation cycle.
If no matching cached object validation state exists, the RP fully validates the object according to the applicable RPKI validation rules.
For each object that is valid in the current validation cycle, the RP processes the object according to its type. If the object is a payload-carrying signed object, its derived payload contributes to the current validated payload output. If the object is a subordinate CA certificate, the RP recursively applies ValidatePP(child CA) using the subordinate CA's current effective_resources.

Objects that are not valid in the current validation cycle do not contribute to the current validated payload output.

Updating the Publication Point Cache After the existing CA publication point has been processed successfully for the current validation cycle, the RP updates the cache entry for the corresponding CA_ID. The updated cache entry records the current ca_effective_resources, current manifest state, current CRL state, and the validation state of the objects in the current publication point. The previous cache entry for the same CA_ID is replaced by the newly computed publication point state. Implementations may update the cache using any internal mechanism. To avoid using partially updated validation state in later cycles, an implementation can update the cache entry atomically after the publication point has been processed.

Failure Handling and Fallback If a new CA publication point cannot be validated, no previous publication point state exists for the corresponding CA_ID. In this case, the publication point is invalid for the current validation cycle, and no valid cache entry is created for that CA_ID. For an existing CA publication point, processing can fail if the current manifest is invalid, the current CRL is invalid, the current repository snapshot is inconsistent with the current manifest, or the publication point has to be fully validated but full validation does not succeed. In these cases, the RP may use the cached publication point state for the same CA_ID as a fallback according to local policy. This fallback represents the last successfully validated state for that CA publication point. Fallback to cached publication point state is a local policy behavior and is outside the equivalence guarantee of this procedure. When fallback is used, the RP still applies checks that depend on the current validation time, such as validity-time checks for the cached manifest, cached CRL, and cached objects. Objects that remain valid after these checks may contribute to the current validated payload output. An implementation should not replace a previous valid cache entry with partial or failed state. The cache entry for a CA_ID should be updated only after the publication point has been successfully processed in the current validation cycle.

Correctness Considerations The correctness of this procedure relies on the following properties:

Validation still proceeds top-down from the accepted trust anchors, so only currently reachable objects can contribute to the validated payload output.
The CA_ID binds cached state to a specific CA certificate object. If the CA certificate changes, the cache entry is not reused and the publication point is processed as new.
Publication-point-level reuse is used only when the CA_ID, ca_effective_resources, manifest hash, and CRL hash all match the cached state. Cached results are reused only after applying checks that depend on the current validation time.
If the CA_ID matches but the current ca_effective_resources differ from the cached ca_effective_resources, this procedure does not reuse cached publication point state or cached object validation results from that publication point.
During object-level reuse, the current manifest defines the object set of the publication point. A cached object validation result is reused only for an object that is referenced by the current manifest and has the same filename and hash as the cached object state.
A cache hit does not bypass checks that may change across validation cycles. The current validation time is applied before reuse. When object-level reuse is performed with a CRL that differs from the cached CRL, the relevant certificate serial number is checked against the current CRL before reuse.

Under these conditions, the incremental procedure preserves the validation result of a complete top-down validation over the same repository snapshot, trust anchor set, validation policy, and validation time.

Security Considerations This document does not change the syntax or validation semantics of any RPKI object. The main security consideration is that cached validation state MUST NOT be reused unless the cache reuse conditions specified in this document are satisfied. In particular, an RP MUST apply the current validation time, MUST apply the current CRL state when required by this procedure, and MUST confirm that the current effective resource context matches the cached state before reusing cached validation results. Implementations should protect the integrity of the validation cache. Corruption or unauthorized modification of cached validation state could cause an RP to reuse incorrect validation results. If cache state is missing, inconsistent, or cannot be trusted, the RP should perform full validation for the affected publication point. Fallback to cached publication point state is a local policy behavior and is outside the equivalence guarantee of this procedure.

IANA Considerations This document has no IANA requests.

Acknowledgements