Internet Engineering Task Force (IETF) S. Kent
Request for Comments: 8211 BBN Technologies
Category: Informational D. Ma
ISSN: 2070-1721 ZDNS
September 2017
Internet Engineering Task Force (IETF) S. Kent
Request for Comments: 8211 BBN Technologies
Category: Informational D. Ma
ISSN: 2070-1721 ZDNS
September 2017
Adverse Actions by a Certification Authority (CA) or Repository Manager in the Resource Public Key Infrastructure (RPKI)
资源公钥基础结构（RPKI）中的证书颁发机构（CA）或存储库管理员的不利操作
Abstract
摘要
This document analyzes actions by or against a Certification Authority (CA) or an independent repository manager in the RPKI that can adversely affect the Internet Number Resources (INRs) associated with that CA or its subordinate CAs. The analysis is done from the perspective of an affected INR holder. The analysis is based on examination of the data items in the RPKI repository, as controlled by a CA (or an independent repository manager) and fetched by Relying Parties (RPs). The analysis does not purport to be comprehensive; it does represent an orderly way to analyze a number of ways that errors by or attacks against a CA or repository manager can affect the RPKI and routing decisions based on RPKI data.
本文档分析了RPKI中的证书颁发机构（CA）或独立存储库管理器采取的或针对这些机构采取的行动，这些行动可能会对与该CA或其下属CA关联的Internet号码资源（INR）产生不利影响。分析是从受影响的印度卢比持有人的角度进行的。该分析基于对RPKI存储库中数据项的检查，由CA（或独立存储库管理器）控制，并由依赖方（RPs）获取。分析并不全面；它确实代表了一种有序的方式来分析CA或存储库管理器的错误或攻击可能影响基于RPKI数据的RPKI和路由决策的多种方式。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This document is a product of the Internet Engineering Task Force (IETF). It has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 7841.
本文件是互联网工程任务组（IETF）的产品。互联网工程指导小组（IESG）已批准将其出版。并非IESG批准的所有文件都适用于任何级别的互联网标准；见RFC 7841第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8211.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问https://www.rfc-editor.org/info/rfc8211.
Copyright Notice
版权公告
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2017 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(https://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Analysis of RPKI Repository Objects . . . . . . . . . . . . . 4
2.1. CA Certificates . . . . . . . . . . . . . . . . . . . . . 6
2.2. Manifest . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3. Certificate Revocation List . . . . . . . . . . . . . . . 12
2.4. ROA . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.5. Ghostbusters Record . . . . . . . . . . . . . . . . . . . 17
2.6. Router Certificates . . . . . . . . . . . . . . . . . . . 18
3. Analysis of Actions Relative to Scenarios . . . . . . . . . . 19
3.1. Scenario A . . . . . . . . . . . . . . . . . . . . . . . 21
3.2. Scenario B . . . . . . . . . . . . . . . . . . . . . . . 21
3.3. Scenario C . . . . . . . . . . . . . . . . . . . . . . . 21
3.4. Scenario D . . . . . . . . . . . . . . . . . . . . . . . 22
4. Security Considerations . . . . . . . . . . . . . . . . . . . 22
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 23
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 23
6.1. Normative References . . . . . . . . . . . . . . . . . . 23
6.2. Informative References . . . . . . . . . . . . . . . . . 25
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 26
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 26
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Analysis of RPKI Repository Objects . . . . . . . . . . . . . 4
2.1. CA Certificates . . . . . . . . . . . . . . . . . . . . . 6
2.2. Manifest . . . . . . . . . . . . . . . . . . . . . . . . 9
2.3. Certificate Revocation List . . . . . . . . . . . . . . . 12
2.4. ROA . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.5. Ghostbusters Record . . . . . . . . . . . . . . . . . . . 17
2.6. Router Certificates . . . . . . . . . . . . . . . . . . . 18
3. Analysis of Actions Relative to Scenarios . . . . . . . . . . 19
3.1. Scenario A . . . . . . . . . . . . . . . . . . . . . . . 21
3.2. Scenario B . . . . . . . . . . . . . . . . . . . . . . . 21
3.3. Scenario C . . . . . . . . . . . . . . . . . . . . . . . 21
3.4. Scenario D . . . . . . . . . . . . . . . . . . . . . . . 22
4. Security Considerations . . . . . . . . . . . . . . . . . . . 22
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 23
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 23
6.1. Normative References . . . . . . . . . . . . . . . . . . 23
6.2. Informative References . . . . . . . . . . . . . . . . . 25
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 26
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 26
In the context of this document, any change to the Resource Public Key Infrastructure (RPKI) [RFC6480] that diminishes the set of Internet Number Resources (INRs) associated with an INR holder, and that is contrary to the holder's wishes, is termed "adverse". This analysis is done from the perspective of an affected INR holder. An action that results in an adverse charge (as defined above) may be the result of an attack on a CA [RFC7132], an error by a CA, or an error by or an attack on a repository operator. Note that the CA that allocated the affected INRs may be acting in accordance with established policy; thus, the change may be contractually justified even though viewed as adverse by the INR holder. This document examines the implications of adverse actions within the RPKI with respect to INRs, irrespective of the cause of the actions.
在本文件中，对资源公钥基础设施（RPKI）[RFC6480]的任何变更，如果减少了与INR持有人相关的互联网号码资源集（INR），并且与持有人的意愿相反，则称为“不利”。该分析是从受影响的印度卢比持有人的角度进行的。导致不利指控（如上所述）的行为可能是对CA的攻击[RFC7132]、CA的错误、存储库操作员的错误或对存储库操作员的攻击的结果。注意，分配受影响INR的CA可能按照既定政策行事；因此，即使印度卢比持有人认为该变更不利，该变更也可能在合同上是合理的。本文件审查了RPKI中与INR有关的不利行动的影响，而不考虑行动的原因。
Additionally, when a Route Origin Authorization (ROA) or router certificate is created that "competes" with an existing ROA or router certificate (respectively), the creation of the new ROA or router certificate may be adverse. (A newer ROA competes with an older ROA if the newer ROA points to a different Autonomous System Number (ASN), contains the same or a more specific prefix, and is issued by a different CA. A newer router certificate competes with an older router certificate if the newer one contains the same ASN, contains a different public key, and is issued by a different CA.) Note that transferring resources or changing of upstream providers may yield competing ROAs and/or router certificates under some circumstances. Thus, not all instances of competition are adverse actions.
此外，当创建与现有ROA或路由器证书（分别）“竞争”的路由来源授权（ROA）或路由器证书时，新ROA或路由器证书的创建可能是不利的。（如果较新的ROA指向不同的自治系统编号（ASN），则较新的ROA与较旧的ROA竞争），包含相同或更具体的前缀，由不同的CA颁发。如果较新的路由器证书包含相同的ASN，包含不同的公钥，并且由不同的CA颁发，则较新的路由器证书与较旧的路由器证书竞争。）请注意，在某些情况下，传输资源或更改上游提供商可能会产生竞争ROA和/或路由器证书。因此，并非所有竞争都是不利行为。
As noted above, adverse changes to RPKI data may arise due to several types of causes. A CA may make a mistake in managing the RPKI objects it signs, or it may be subject to an attack. If an attack allows an adversary to use the private key of that CA to sign RPKI objects, then the effect is analogous to the CA making mistakes. There is also the possibility that a CA or repository operator may be subject to legal measures that compel them to make adverse changes to RPKI data. In many cases, such actions may be hard to distinguish from mistakes or attacks, other than with respect to the time required to remedy the adverse action. (Presumably, the CA will take remedial action when a mistake or an attack is detected, so the effects are similar in these cases. If a CA has been legally compelled to effect an adverse change, remediation will likely not be swift.)
如上所述，RPKI数据的不利变化可能由多种原因引起。CA可能在管理其签名的RPKI对象时出错，或者可能受到攻击。如果攻击允许对手使用该CA的私钥对RPKI对象进行签名，则其效果类似于CA犯错误。CA或存储库运营商也有可能受到法律措施的约束，迫使他们对RPKI数据进行不利更改。在许多情况下，除了补救不利行动所需的时间外，此类行动可能很难与错误或攻击区分开来。（据推测，CA将在检测到错误或攻击时采取补救措施，因此在这些情况下效果相似。如果CA已被法律强制实施不利变更，补救可能不会迅速。）
This document analyzes the various types of actions by a CA (or an independent repository operator) that can adversely affect the INRs associated with that CA, as well as the INRs of subordinate CAs. The analysis is based on examination of the data items in the RPKI
本文档分析了CA（或独立存储库运营商）可能对与该CA相关的INR以及下级CA的INR产生不利影响的各种类型的操作。分析基于对RPKI中数据项的检查
repository, as controlled by a CA (or an independent repository operator) and fetched by RPs.
存储库，由CA（或独立的存储库操作员）控制，由RPs获取。
This section enumerates the RPKI repository system objects and examines how changes to them affect Route Origin Authorizations (ROAs) and router certificate validation. Identifiers are assigned to errors for reference by later sections of this document. Note that not all adverse actions may be encompassed by this taxonomy.
本节列举RPKI存储库系统对象，并检查对它们的更改如何影响路由来源授权（ROA）和路由器证书验证。标识符分配给错误，以供本文件后面章节参考。请注意，并非所有不良反应都包含在该分类法中。
The RPKI repository [RFC6481] contains a number of (digitally signed) objects that are fetched and processed by RPs. Until the deployment of BGPsec [RFC8205], the principal goal of the RPKI is to enable an RP to validate ROAs [RFC6482]. A ROA binds address space to an ASN. A ROA can be used to verify BGP announcements with respect to route origin [RFC6483]. The most important objects in the RPKI for origin validation are ROAs; all of the other RPKI objects exist to enable the validation of ROAs in a fashion consistent with the INR allocation system. Thus, errors that result in changes to a ROA, or to RPKI objects needed to validate a ROA, can cause RPs to reach different (from what was intended) conclusions about the validity of the bindings expressed in a ROA.
RPKI存储库[RFC6481]包含许多由RPs获取和处理的（数字签名）对象。在部署BGPsec[RFC8205]之前，RPKI的主要目标是使RP能够验证ROA[RFC6482]。ROA将地址空间绑定到ASN。ROA可用于验证有关路由来源的BGP公告[RFC6483]。RPKI中用于原产地验证的最重要对象是ROA；所有其他RPKI对象的存在都是为了以与INR分配系统一致的方式验证ROA。因此，导致更改ROA或验证ROA所需的RPKI对象的错误可能会导致RPs对ROA中表示的绑定的有效性得出不同（与预期不同）的结论。
When BGPsec is deployed, router certificates [RFC8209] will be added to repository publication points. These are end entity (EE) certificates used to verify signatures applied to BGP update data and to enable path validation [RFC8205]. Router certificates are as important to path validation as ROAs are to origin validation.
部署BGPsec时，路由器证书[RFC8209]将添加到存储库发布点。这些是终端实体（EE）证书，用于验证应用于BGP更新数据的签名并启用路径验证[RFC8205]。路由器证书对于路径验证和ROA对于源验证一样重要。
The objects contained in the RPKI repository are of two types: conventional PKI objects (certificates and Certificate Revocation Lists (CRLs)) and RPKI-specific signed objects. The latter make use of a common encapsulation format [RFC6488] based on the Cryptographic Message Syntax (CMS) [RFC5652]. A syntax error in this common format will cause an RP to reject the object, e.g., a ROA or manifest, as invalid.
RPKI存储库中包含的对象有两种类型：常规PKI对象（证书和证书吊销列表（CRL））和特定于RPKI的签名对象。后者使用基于加密消息语法（CMS）[RFC5652]的通用封装格式[RFC6488]。此通用格式中的语法错误将导致RP将对象（例如ROA或清单）视为无效而拒绝。
Adverse actions take several forms:
不利行动有几种形式：
* Deletion (D) is defined as removing an object from a publication point, without the permission of the INR holder.
* 删除（D）定义为未经INR持有人许可，从发布点删除对象。
* Suppression (S) is defined as not deleting an object, or not publishing an object, as intended by an INR holder. This action also includes retaining a prior version of an object in a publication point when a newer version is available for publication.
* 抑制被定义为不删除对象，或不发布INR持有人预期的对象。此操作还包括在较新版本可供发布时，在发布点保留对象的先前版本。
* Corruption (C) is defined as modification of a signed object in a fashion not requiring access to the private key used to sign the object. Thus, a corrupted object will not carry a valid signature. Implicitly, the corrupted object replaces the legitimate version.
* 损坏（C）定义为以不需要访问用于对对象进行签名的私钥的方式修改签名对象。因此，损坏的对象将不会携带有效的签名。默认情况下，损坏的对象将替换合法版本。
* Modification (M) is defined as publishing a syntactically valid, verifiable version of an object that differs from the (existing) version authorized by the INR holder. Implicitly, the legitimate version of the affected object is deleted and replaced by the modified object.
* 修改（M）定义为发布与INR持有人授权的（现有）版本不同的对象的语法有效、可验证版本。隐式地，受影响对象的合法版本被删除并替换为修改后的对象。
* Revocation (R) is defined as revoking a certificate (EE or CA) by placing its Serial Number on the appropriate CRL, without authorization of the INR holder.
* 撤销（R）定义为在未经INR持有人授权的情况下，将证书（EE或CA）的序列号置于相应的CRL上，从而撤销证书。
* Injection (I) is defined as introducing an instance of a signed object into a publication point (without authorization of the INR holder). It assumes that the signature on the object will be viewed as valid by RPs.
* 注入（I）定义为将已签名对象的实例引入发布点（未经INR持有人授权）。它假定对象上的签名将被RPs视为有效。
The first three of these actions (deletion, suppression, and corruption) can be effected by any entity that manages the publication point of the affected INR holder. Also, an entity with the ability to act as a man-in-the-middle between an RP and a repository can effect these actions with respect to the RP in question.
这些行动中的前三项（删除、禁止和腐败）可由管理受影响INR持有人发布点的任何实体实施。此外，一个能够在RP和存储库之间充当中间人的实体可以对相关RP执行这些操作。
The latter three actions (modification, revocation, and injection) nominally require access to the private key of the INR holder.
后三种行为（修改、撤销和注入）名义上要求访问INR持有人的私钥。
All six of these actions also can be effected by a parent CA. A parent CA could reissue the INR holder's CA certificate, but with a different public key, matching a private key to which the parent CA has access. The CA could generate new signed objects using the private key associated with the reissued certificate and publish these objects at a location of its choosing.
所有这六项操作也可以由父CA执行。父CA可以重新颁发INR持有人的CA证书，但使用不同的公钥，匹配父CA有权访问的私钥。CA可以使用与重新颁发的证书关联的私钥生成新的签名对象，并在其选择的位置发布这些对象。
Most of these actions may be performed independently or in combination with one another. For example, a ROA may be revoked and deleted or revoked and replaced with a modified ROA. Where appropriate, the analysis of adverse actions will distinguish between individual actions, or combinations thereof, that yield different outcomes for RPs. Recall that the focus of the analysis is the impact on ROAs and router certificates, with respect to RP processing.
这些动作中的大多数可以独立执行，也可以相互结合执行。例如，可撤销和删除ROA，或撤销和替换为修改后的ROA。在适当的情况下，对不良反应的分析将区分产生不同RPs结果的单个反应或其组合。回想一下，分析的重点是RP处理对ROA和路由器证书的影响。
The following sections examine how the actions enumerated above affect objects in the RPKI repository system. Each action is addressed in order (deletion, suppression, corruption, modification, revocation, and injection) for each object, making it easy to see how each action has been considered with regard to each object. (For the Ghostbusters Record [RFC6493], we condensed the discussion of the actions because the impact is the same in each case.)
以下各节将研究上面列举的操作如何影响RPKI存储库系统中的对象。每个操作都是按每个对象的顺序（删除、抑制、损坏、修改、撤销和注入）处理的，因此很容易看到每个操作是如何考虑每个对象的。（对于《捉鬼敢死队》记录[RFC6493]，我们浓缩了对行动的讨论，因为每种情况下的影响都是相同的。）
Every INR holder is represented by one or more CA certificates. An INR holder has multiple CA certificates if it holds resources acquired from different sources. Also, every INR holder has more than one CA certificate during key rollover [RFC6489] and algorithm rollover [RFC6916].
每个INR持有人由一个或多个CA证书代表。如果INR持有人持有从不同来源获得的资源，则其拥有多个CA证书。此外，在密钥翻转[RFC6489]和算法翻转[RFC6916]期间，每个INR持有者都有多个CA证书。
If a publication point is not a "leaf" in the RPKI hierarchy, then the publication point will contain one or more CA certificates, each representing a subordinate CA. Each subordinate CA certificate contains a Subject Information Access (SIA) pointer to the publication point where the signed objects associated with that CA can be found [RFC6487].
如果发布点不是RPKI层次结构中的“叶”，则该发布点将包含一个或多个CA证书，每个CA证书代表一个下级CA。每个下级CA证书包含一个主题信息访问（SIA）指针，指向可在其中找到与该CA关联的已签名对象的发布点[RFC6487]。
A CA certificate is a complex data structure; thus, errors in that structure may have different implications for RPs depending on the specific data that is in error.
CA证书是一个复杂的数据结构；因此，根据出错的特定数据，该结构中的错误可能对RPs有不同的影响。
Adverse actions against a CA certificate can cause the following errors:
针对CA证书的不利操作可能会导致以下错误：
A-1.1 Deletion
A-1.1删除
A-1.1.1 Deletion of a CA certificate would cause an RP to not be able to locate signed objects generated by that CA, except those that have been cached by the RP. Thus, an RP would be unaware of changed or new (issued after the cached data) INR bindings asserted in subordinate ROAs, and the RP would be unable to validate new or changed router certificates. If the missed objects were intended to replace ROAs or router certificates prior to expiration, then when those objects expire, RPs may cease to view them as valid. As a result, valid routes may be viewed as NotFound or Invalid.
A-1.1.1删除CA证书将导致RP无法定位由该CA生成的签名对象，RP缓存的对象除外。因此，RP将不知道次级ROA中断言的已更改或新（在缓存数据之后发布）INR绑定，RP将无法验证新的或更改的路由器证书。如果丢失的对象打算在到期之前替换ROA或路由器证书，那么当这些对象到期时，RPs可能会停止将其视为有效。因此，有效路由可能被视为未找到或无效。
A-1.2 Suppression
A-1.2抑制
A-1.2.1 If publication of a CA certificate is suppressed, the impact depends on what changes appeared in the suppressed certificate. If the SIA value changed, the effect would be the same as in A-1.1 or A-1.4.3. If the [RFC3779] extensions in the suppressed certificate changed, the impact would be the same as in A-1.4.1. If the Authority Information Access (AIA) extension changed in the suppressed certificate, the impact would be the same as in A-1.4.4. Suppression of a renewed/ re-issued certificate may cause an old certificate to expire and thus be rejected by RPs.
A-1.2.1如果CA证书的发布被抑制，则影响取决于抑制的证书中出现的更改。如果SIA值发生变化，其影响将与A-1.1或A-1.4.3中的相同。如果被抑制证书中的[RFC3779]扩展发生更改，影响将与A-1.4.1中的相同。如果受抑制证书中的授权信息访问（AIA）扩展发生变化，其影响将与A-1.4.4中的相同。取消更新/重新颁发的证书可能会导致旧证书过期，从而被RPs拒绝。
A-1.3 Corruption
A-1.3腐败
A-1.3.1 Corruption of a CA certificate will cause it to be rejected by RPs. In turn, this may cause subordinate signed objects to become invalid. An RP that has cached the subtree under the affected CA certificate may continue to view it as valid, until objects expire. But changed or new objects might not be retrieved, depending on details of the design of the RP software. Thus, this action may be equivalent to suppressing changes to the affected subtree.
A-1.3.1 CA证书损坏将导致RPs拒绝该证书。反过来，这可能会导致从属签名对象变得无效。在受影响的CA证书下缓存了子树的RP可能会继续将其视为有效，直到对象过期。但根据RP软件设计的细节，可能无法检索更改的或新的对象。因此，此操作可能相当于抑制对受影响子树的更改。
A-1.4 Modification
A-1.4修改
A-1.4.1 If a CA certificate is modified but still conforms to the RPKI certificate profile [RFC7935], it will be accepted by RPs. If an [RFC3779] extension in this certificate is changed to exclude INRs that were previously present, then subordinate signed objects will become invalid if they rely on the excised INRs. If these objects are CA certificates, their subordinate signed objects will be treated as invalid. If the objects are ROAs, the binding expressed by the affected ROAs will be ignored by RPs. If the objects are router certificates, BGPsec_PATH attributes [RFC8205] verifiable under these certificates will be considered invalid.
A-1.4.1如果CA证书已修改，但仍符合RPKI证书配置文件[RFC7935]，则RPs将接受该证书。如果此证书中的[RFC3779]扩展被更改为排除以前存在的INR，则从属签名对象如果依赖于切除的INR，则将变得无效。如果这些对象是CA证书，则其从属签名对象将被视为无效。如果对象是ROA，受影响的ROA表示的绑定将被RPs忽略。如果对象是路由器证书，则这些证书下可验证的BGPsec_路径属性[RFC8205]将被视为无效。
A-1.4.2 If the SIA extension of a CA certificate is modified to refer to another publication point, this will cause an RP to look at another location for subordinate objects. This could cause RPs to not acquire the objects that the INR holder intended to be retrieved -- manifests, ROAs, router certificates, Ghostbuster Records, or any subordinate CA certificates associated with that CA. If the objects at this new location contain invalid signatures or appear to be corrupted, they may be rejected. In this case, cached versions of the objects may be viewed as valid by an RP, until they expire. If the objects at the new location have valid signatures and pass path validation checks, they will replace the cached objects, effectively replacing the INR holder's objects.
A-1.4.2如果CA证书的SIA扩展被修改为引用另一个发布点，这将导致RP查看从属对象的另一个位置。这可能会导致RPs无法获取INR持有者打算检索的对象——清单、ROA、路由器证书、Ghostbuster记录或与该CA关联的任何从属CA证书。如果此新位置的对象包含无效签名或似乎已损坏，则可能会拒绝这些对象。在这种情况下，对象的缓存版本可能会被RP视为有效，直到过期。如果新位置的对象具有有效签名并通过路径验证检查，它们将替换缓存的对象，从而有效地替换INR持有者的对象。
A-1.4.3 If the AIA extension in a CA certificate is modified, it would point to a different CA certificate, not the parent CA certificate. This extension is used only for path discovery, not path validation. Path discovery in the RPKI is usually performed on a top-down basis, starting with trust anchors (TAs) and recursively descending the RPKI hierarchy. Thus, there may be no impact on the ability of clients to acquire and validate certificates if the AIA is modified.
A-1.4.3如果修改CA证书中的AIA扩展，它将指向不同的CA证书，而不是父CA证书。此扩展仅用于路径发现，而不用于路径验证。RPKI中的路径发现通常是在自顶向下的基础上执行的，从信任锚（TA）开始，然后递归地降低RPKI层次结构。因此，如果修改AIA，可能不会影响客户获取和验证证书的能力。
A-1.4.4 If the Subject Public Key Info (and Subject Key Identifier extension) in a CA certificate is modified to contain a public key corresponding to a private key held by the parent, the parent could sign objects as children of the affected CA certificate. With this capability, the parent could replace the INR holder, issuing new signed objects that would be accepted by RPs (as long as they do not violate the path validation criteria). This would enable the parent to effect modification, revocation, and injection actions against all of the objects under the affected CA certificate, including subordinate CA certificates. (Note that key rollover also yields a new CA certificate. However, the new certificate will coexist with the old one for a while, which may help distinguish this legitimate activity from an adverse action.)
A-1.4.4如果CA证书中的主体公钥信息（和主体密钥标识符扩展）被修改为包含与父级持有的私钥相对应的公钥，则父级可以将对象作为受影响CA证书的子级进行签名。通过此功能，父级可以替换INR持有者，发布RPs可以接受的新签名对象（只要它们不违反路径验证标准）。这将使父级能够对受影响CA证书下的所有对象（包括从属CA证书）执行修改、撤销和注入操作。（请注意，密钥翻转也会产生一个新的CA证书。但是，新证书将与旧证书共存一段时间，这可能有助于区分此合法活动与不利操作。）
A-1.5 Revocation
A-1.5撤销
A-1.5.1 If a CA certificate is revoked, an RP will treat as invalid all subordinate signed objects, both immediate and transitive. The effects are essentially the same as described in A-3.4.2.
A-1.5.1如果CA证书被吊销，RP将把所有下级签名对象（即时和可传递）视为无效。这些影响基本上与A-3.4.2所述相同。
A-1.6 Injection
A-1.6注射
A-1.6.1 If a CA certificate is injected, the impact will depend on the data contained in the injected certificate. Changes will generally be equivalent to modification actions as described in A-1.4.
A-1.6.1如果注入CA证书，影响将取决于注入证书中包含的数据。变更通常相当于A-1.4中所述的修改行动。
Each repository publication point contains a manifest [RFC6486]. The RPKI incorporates manifests to enable RPs to detect suppression and/ or substitution of (more recent) publication point objects, as the result of a mistake or attack. A manifest enumerates (by filename) all of the other signed objects at the publication point. The manifest also contains a hash of each enumerated file to enable an RP to determine if the named file content matches what the INR holder identified in the manifest.
每个存储库发布点都包含一个清单[RFC6486]。RPKI包含清单，使RPs能够检测错误或攻击导致的（最近的）发布点对象的抑制和/或替换。清单（按文件名）枚举发布点的所有其他已签名对象。清单还包含每个枚举文件的散列，以使RP能够确定命名文件内容是否与清单中标识的INR持有者匹配。
A manifest is an RPKI signed object, so it is validated as per [RFC6488]. If a manifest is modified in a way that causes any of these checks to fail, the manifest will be considered invalid. Suppression of a manifest itself (indicated by a stale manifest) can also cause an RP to not detect suppression of other signed objects at the publication point. (Note that if a manifest's EE certificate expires at the time that the manifest is scheduled to be replaced, a delay in publication will cause the manifest to become invalid, not merely stale. This very serious outcome should be avoided, e.g., by making the manifest EE certificate's notAfter value the same as that of the CA certificate under which it was issued). If a signed object at a publication point can be validated (using the rules applicable for that object type), then an RP may accept that object, even if there is no matching entry for it on the manifest. However, it appears that most RP software ignores publication point data that fails to match manifest entries (at the time this document was written).
清单是RPKI签名的对象，因此按照[RFC6488]进行验证。如果清单的修改方式导致任何这些检查失败，则清单将被视为无效。抑制清单本身（由过期清单指示）也会导致RP在发布点检测不到对其他已签名对象的抑制。（请注意，如果舱单的EE证书在计划更换舱单时过期，则延迟发布将导致舱单无效，而不仅仅是过时。应避免这一非常严重的后果，例如，通过使舱单EE证书的notAfter值与CA证书的notAfter值相同它已印发）。如果可以验证发布点上的已签名对象（使用适用于该对象类型的规则），则RP可以接受该对象，即使清单上没有与之匹配的条目。但是，大多数RP软件似乎忽略了与清单条目不匹配的发布点数据（在编写本文档时）。
Corruption, suppression, modification, or deletion of a manifest might not affect RP processing of other publication point objects, as specified in [RFC6486]. However, as noted above, many RP
清单的损坏、抑制、修改或删除可能不会影响[RFC6486]中指定的其他发布点对象的RP处理。然而，如上所述，许多RP
implementations ignore objects that are present at a publication point but not listed in a valid manifest. Thus, the following actions against a manifest can impact RP processing:
实现忽略存在于发布点但未在有效清单中列出的对象。因此，针对清单的以下操作可能会影响RP处理：
A-2.1 Deletion
A-2.1删除
A-2.1.1 A manifest may be deleted from the indicated publication point. In this circumstance, an RP may elect to use the previous manifest (if available) and may ignore any new/changed objects at the publication point. The implications of this action are equivalent to suppression of publication of the objects that are not recognized by RPs because the new objects are not present in the old manifest. For example, a new ROA could be ignored (A-1.2). A newly issued CA certificate might be ignored (A-1.1). A subordinate CA certificate that was revoked might still be viewed as valid by RPs (A-4.1). A new or changed router certificate might be ignored (A-6.2) as would a revised Ghostbusters Record (A-4.1).
A-2.1.1可以从指定的发布点删除清单。在这种情况下，RP可以选择使用以前的清单（如果可用），并且可以在发布点忽略任何新的/更改的对象。此操作的含义相当于禁止发布RPs无法识别的对象，因为旧清单中不存在新对象。例如，可以忽略新的ROA（a-1.2）。可能会忽略新颁发的CA证书（A-1.1）。RPs（A-4.1）可能仍会将被吊销的从属CA证书视为有效。新的或更改的路由器证书可能会被忽略（A-6.2），修改后的Ghostbusters记录（A-4.1）也会被忽略。
A-2.2 Suppression
A-2.2抑制
A-2.2.1 Publication of a newer manifest may be suppressed. Suppression of a newer manifest probably will cause an RP to rely on a cached manifest (if available). The older manifest would not enumerate newly added objects; thus, those objects might be ignored by an RP, which is equivalent to deletion of those objects (A-1.1, A-3.1, A-4.1, A-5.1, and A-6.1).
A-2.2.1可能会禁止发布较新的清单。抑制较新的清单可能会导致RP依赖缓存的清单（如果可用）。旧的清单不会枚举新添加的对象；因此，RP可能会忽略这些对象，这相当于删除这些对象（A-1.1、A-3.1、A-4.1、A-5.1和A-6.1）。
A-2.3 Corruption
A-2.3腐败
A-2.3.1 A manifest may be corrupted. A corrupted manifest will be rejected by RPs. This may cause RPs to rely on a previous manifest, with the same impact as A-2.2. If an RP does not revert to using a cached manifest, the impact of this action is very severe, i.e., all publication point objects will probably be viewed as invalid, including subordinate tree objects. This is equivalent to revoking or deleting an entire subtree (see A-4.4.2).
A-2.3.1清单可能已损坏。损坏的清单将被RPs拒绝。这可能会导致RPs依赖以前的清单，其影响与a-2.2相同。如果RP没有恢复到使用缓存清单，此操作的影响将非常严重，即所有发布点对象（包括从属树对象）都可能被视为无效。这相当于撤销或删除整个子树（见A-4.4.2）。
A-2.4 Modification
A-2.4修改
A-2.4.1 A manifest may be modified to remove one or more objects. Because the modified manifest is viewed as valid by RPs, any objects that were removed may be ignored by RPs. This is equivalent to deleting these objects from the repository. The impact of this action will vary, depending on which objects are (effectively) removed. However, the impact is equivalent to deletion of the object in question, (A-1.1, A-3.1, A-4.1, A-5.1, and A-6.1).
A-2.4.1可以修改清单以删除一个或多个对象。因为修改后的清单被RPs视为有效，所以RPs可能会忽略任何已删除的对象。这相当于从存储库中删除这些对象。此操作的影响会有所不同，具体取决于（有效）移除的对象。但是，影响相当于删除了相关对象（A-1.1、A-3.1、A-4.1、A-5.1和A-6.1）。
A-2.4.2 A manifest may be modified to add one or more objects. If an added object has a valid signature (and is not expired), it will be accepted by RPs and processed accordingly. If the added object was previously deleted by the INR holder, this action is equivalent to suppressing deletion of that object. If the object is newly created or modified, it is equivalent to a modification or injection action for the type of object in question and is thus discussed in the relevant section for those actions for the object type.
A-2.4.2可以修改清单以添加一个或多个对象。如果添加的对象具有有效签名（且未过期），则RPs将接受该对象并相应地进行处理。如果INR持有人先前删除了添加的对象，则此操作相当于禁止删除该对象。如果对象是新创建或修改的，则它相当于所讨论对象类型的修改或注入操作，因此在相关章节中讨论了对象类型的这些操作。
A-2.4.3 A manifest may be modified to list an incorrect hash for one or more objects. An object with an incorrect hash may be ignored by an RP. Thus, the effect may be equivalent to corrupting the object in question, although the error reported by RP software would differ from that reported for a corrupted object. (The manifest specifications do not require an RP to ignore an object that has a valid signature and that is not revoked or expired, but for which the hash doesn't match the object. However, an RP may elect to do so.)
A-2.4.3可以修改清单，以列出一个或多个对象的不正确哈希。RP可能会忽略散列不正确的对象。因此，尽管RP软件报告的错误与损坏对象报告的错误不同，但其影响可能相当于损坏相关对象。（清单规范不要求RP忽略具有有效签名且未被撤销或过期，但哈希与对象不匹配的对象。但是，RP可以选择这样做。）
A-2.5 Revocation
A-2.5撤销
A-2.5.1 A manifest may be revoked (by including its EE certificate on the CRL for the publication point). A revoked manifest will be ignored by an RP, which probably would revert to an older (cached) manifest. The implications for RPs are equivalent to A-2.1 with regard to new/changed objects.
A-2.5.1可以撤销清单（通过在发布点的CRL上包含其EE证书）。RP将忽略已撤销的清单，这可能会还原为较旧的（缓存的）清单。关于新的/更改的对象，RPs的含义相当于A-2.1。
A-2.6 Injection
A-2.6注射
A-2.6.1 A manifest representing different objects may be injected into a publication point. The effects are the same as for a modified manifest (see above). The impact will depend on the type of the affected object(s) and is thus discussed in the relevant section(s) for each object type.
A-2.6.1代表不同对象的清单可注入发布点。效果与修改的清单相同（见上文）。影响将取决于受影响对象的类型，因此将在每个对象类型的相关章节中讨论。
Each publication point contains a CRL that enumerates revoked (not yet expired) certificates issued by the CA associated with the publication point [RFC6481].
每个发布点都包含一个CRL，该CRL枚举由与发布点关联的CA颁发的已吊销（尚未过期）证书[RFC6481]。
Adverse actions against a CRL can cause the following errors:
针对CRL的不利措施可能导致以下错误：
A-3.1 Deletion
A-3.1删除
A-3.1.1 If a CRL is deleted, RPs will continue to use an older, previously fetched Certificate Revocation List. As a result, they will not be informed of any changes in revocation status of subordinate CA or router certificates or the EE certificates of signed objects, e.g., ROAs. This action is equivalent to corruption of a CRL, since a corrupted CRL will not be accepted by an RP.
A-3.1.1如果删除CRL，RPs将继续使用以前获取的旧证书吊销列表。因此，他们不会被告知从属CA或路由器证书或已签名对象（例如ROA）的EE证书的吊销状态的任何更改。此操作相当于CRL损坏，因为RP不会接受损坏的CRL。
A-3.1.2 Deletion of a CRL could cause an RP to continue to accept a ROA that no longer expresses the intent of an INR holder. As a result, an announcement for the affected prefixes would be viewed as Valid, instead of NotFound or Invalid. In this case, the effect is analogous to A-5.2.
A-3.1.2删除CRL可能导致RP继续接受不再表达INR持有人意图的ROA。因此，受影响前缀的公告将被视为有效，而不是NotFound或Invalid。在这种情况下，效果类似于A-5.2。
A-3.1.3 If a router certificate were revoked and the CRL were deleted, RPs would not be aware of the revocation. They might continue to accept the old, revoked router certificate. If the certificate had been revoked due to a compromise of the router's private key, RPs would be vulnerable to accepting routes signed by an unauthorized entity.
A-3.1.3如果路由器证书被撤销且CRL被删除，RPs将不会意识到撤销。他们可能会继续接受旧的、已吊销的路由器证书。如果证书由于路由器私钥泄露而被撤销，RPs将容易接受未经授权实体签署的路由。
A-3.1.4 If a subordinate CA certificate were revoked on the deleted CRL, the revocation would not take effect. This could interfere with a transfer of address space from the subordinate CA, adversely affecting routing to the new holder of the space.
A-3.1.4如果在已删除的CRL上撤销下级CA证书，则撤销将不生效。这可能会干扰从从属CA传输地址空间，从而对空间的新持有者的路由产生不利影响。
A-3.2 Suppression
A-3.2抑制
A-3.2.1 If publication of the most recent CRL is suppressed, an RP will not be informed of the most recent revocation status of a subordinate CA or router certificates or the EE certificates of signed objects. If an EE certificate has been revoked and the associated signed object is still present in the publication point, an RP might mistakenly treat that object as valid. (This would happen if the object is still in the manifest or if the RP is configured to process valid objects that are not on the manifest.) This type of action is of special concern if the affected object is a ROA, a router certificate, or a subordinate CA certificate. The effects here are equivalent to CRL deletion (A-3.1), but suppression of a new CRL may not even be reported as an error, i.e., if the suppressed CRL were issued before the NextUpdate time (of the previous CRL).
A-3.2.1如果禁止发布最新的CRL，RP将不会被告知下级CA或路由器证书或签名对象的EE证书的最新吊销状态。如果EE证书已被吊销，并且发布点中仍然存在关联的签名对象，RP可能会错误地将该对象视为有效对象。（如果对象仍在清单中，或者如果RP配置为处理不在清单中的有效对象，则会发生这种情况。）如果受影响的对象是ROA、路由器证书或从属CA证书，则此类操作尤其值得关注。此处的效果相当于CRL删除（A-3.1），但新CRL的抑制甚至可能不会被报告为错误，即，如果抑制的CRL在下一个日期之前发出（之前的CRL）。
A-3.3 Corruption
A-3.3腐败
A-3.3.1 If a CRL is corrupted, an RP will reject it. If a prior CRL has not yet exceeded its NextUpdate time, an RP will continue to use the prior CRL. Even if the prior CRL has passed the NextUpdate time, an RP may choose to continue to rely on the prior CRL. The effects are essentially equivalent to suppression or deletion of a CRL (A-3.1 and A-3.2).
A-3.3.1如果CRL损坏，RP将拒绝该CRL。如果先前的CRL尚未超过其下一个最新时间，RP将继续使用先前的CRL。即使先前的CRL已超过下一个最新时间，RP也可以选择继续依赖先前的CRL。这些影响基本上等同于抑制或删除CRL（a-3.1和a-3.2）。
A-3.4 Modification
A-3.4修改
A-3.4.1 If a CRL is modified to erroneously list a signed object's EE certificate as revoked, the corresponding object will be treated as invalid by RPs, even if it is present in a publication point. If this object is a ROA, the (legitimate) binding expressed by the ROA will be ignored by an RP (see A-5.5). If a CRL is modified to erroneously list a router certificate as revoked, a path signature associated with that certificate will be treated as Not Valid by RPs (see A-6.5).
A-3.4.1如果修改CRL以错误地将已签名对象的EE证书列为已撤销，则RPs将视相应对象为无效对象，即使该对象存在于发布点中。如果该对象是ROA，则RP将忽略ROA表示的（合法）绑定（见a-5.5）。如果CRL被修改为错误地将路由器证书列为已撤销，则RPs会将与该证书相关联的路径签名视为无效（见a-6.5）。
A-3.4.2 If a CRL is modified to erroneously list a CA certificate as revoked, that CA and all subordinate signed objects will be treated as invalid by RPs. Depending on the location of the affected CA in the hierarchy, these effects could be very substantial, causing routes that should be Valid to be treated as NotFound.
A-3.4.2如果修改CRL以错误地将CA证书列为已撤销证书，则该CA和所有从属签名对象将被RPs视为无效。根据受影响CA在层次结构中的位置，这些影响可能非常严重，导致本应有效的路由被视为NotFound。
A-3.4.3 If a CRL is modified to omit a revoked EE, router, or CA certificate, RPs will likely continue to accept the revoked, signed object as valid. This contravenes the intent of the INR holder. If an RP continues to accept a revoked ROA, it may make routing decisions on now-invalid data. This could cause valid routes to be de-preferenced and invalid routes to continue to be accepted.
A-3.4.3如果修改CRL以省略已撤销的EE、路由器或CA证书，RPs可能会继续接受已撤销的签名对象作为有效对象。这违反了INR持有人的意图。如果RP继续接受撤销的ROA，它可能会对现在无效的数据做出路由决定。这可能导致取消优先选择有效路由，继续接受无效路由。
A-3.5 Revocation
A-3.5撤销
A-3.5.1 A CRL cannot be revoked per se, but it will fail validation if the CA certificate under which it was issued is revoked. See A-1.5 for a discussion of that action.
A-3.5.1 CRL本身无法撤销，但如果根据其颁发的CA证书被撤销，则验证将失败。有关该行动的讨论，请参见A-1.5。
A-3.6 Injection
A-3.6注射
A-3.6.1 Insertion of a bogus CRL can have the same effects as listed above for a modified CRL, depending on how the inserted CRL differs from the correct CRL.
A-3.6.1根据插入的CRL与正确的CRL之间的差异，插入假CRL可能具有与上述修改的CRL相同的效果。
In addition to the generic RPKI object syntax checks, ROA validation requires that the signature on the ROA can be validated using the public key from the EE certificate embedded in the ROA [RFC6482]. It also requires that the EE certificate be validated consistently with the procedures described in [RFC6482] and [RFC6487]. Adverse actions against a ROA can cause the following errors:
除了通用RPKI对象语法检查外，ROA验证要求可以使用嵌入ROA中的EE证书中的公钥验证ROA上的签名[RFC6482]。它还要求EE证书按照[RFC6482]和[RFC6487]中所述的程序进行验证。针对居留权的不利行动可能导致以下错误：
A-4.1 Deletion
A-4.1删除
A-4.1.1 A ROA may be deleted from the indicated publication point. The result is to void the binding between the prefix(es) and the Autonomous System (AS) number in the ROA. An RP that previously viewed this binding as authentic will now not have any evidence about its validity. For origin validation, this means that a legitimate route will be treated as NotFound (if there are no other ROAs for the same prefix) or Invalid (if there is another ROA for the same prefix, but with a different AS number).
A-4.1.1可从指定发布点删除ROA。结果是使前缀（es）和ROA中的自治系统（AS）号之间的绑定无效。以前认为该约束为真实的RP现在将没有任何关于其有效性的证据。对于源验证，这意味着合法路由将被视为未找到（如果同一前缀没有其他ROA）或无效（如果同一前缀有其他ROA，但as编号不同）。
A-4.2 Suppression
A-4.2抑制
A-4.2.1 Publication of a newer ROA may be suppressed. If the INR holder intended to change the binding between the prefix(es) and the AS number in the ROA, this change will not be effected. As a result, RPs may continue to believe an old prefix/ ASN binding that is no longer what the INR holder intended.
A-4.2.1可能会禁止发布较新的ROA。如果INR持有人打算更改ROA中前缀和AS编号之间的绑定，则该更改不会生效。因此，RPs可能会继续相信旧的前缀/ASN绑定不再是INR持有人想要的。
A-4.2.2 If an INR holder intends to issue and publish two (or more) new ROAs for the same address space, one (or more) of the new ROAs may be suppressed while the other is published. In this case, RPs will de-preference the suppressed prefix/ASN binding. Suppression of the new ROA might cause traffic to flow to an ASN other than the one(s) intended by the INR holder.
A-4.2.2如果INR持有人打算为同一地址空间发布和发布两个（或多个）新的ROA，则一个（或多个）新的ROA可能被抑制，而另一个则被发布。在这种情况下，RPs将取消受抑制的前缀/ASN绑定。抑制新的ROA可能会导致流量流向INR持有人计划之外的ASN。
A-4.2.3 If an INR holder intends to delete all ROAs for the same address space, some of them may be retained while the others are deleted. Preventing the deletion of some ROAs can cause traffic to continue to be delivered to the ASNs that were advertised by these ROAs. Deletion of all ROAs is consistent with a transfer of address space to a different INR holder in a phased fashion. Thus, this sort of attack could interfere with the successful transfer of the affected address space (until such time as the prefixes are removed from the previous INR holder's CA certificate).
A-4.2.3如果INR持有人打算删除同一地址空间的所有ROA，则其中一些ROA可能会被保留，而其他ROA则会被删除。阻止删除某些ROA可能会导致流量继续传送到这些ROA所宣传的ASN。删除所有ROA与地址空间以分阶段的方式转移到不同的INR持有者是一致的。因此，这种攻击可能会干扰受影响地址空间的成功传输（直到前缀从以前的INR持有者的CA证书中移除为止）。
A-4.3 Corruption
A-4.3腐败
A-4.3.1 A ROA may be corrupted. A corrupted ROA will be ignored by an RP, so the effect is essentially the same as for A-4.1 and A-4.5. A possible difference is that an RP may be alerted to the fact that the ROA was corrupted, which might attract attention to the attack.
A-4.3.1 ROA可能已损坏。RP将忽略损坏的ROA，因此其效果与A-4.1和A-4.5基本相同。一个可能的区别是RP可能会被提醒ROA已损坏，这可能会引起对攻击的注意。
A-4.4 Modification
A-4.4修改
A-4.4.1 A ROA may be modified so that the Autonomous System Number (ASN) or one or more of the address blocks in a ROA is different from the values the INR holder intended for this ROA. (This action assumes that the modified ROA's ASN and address ranges are authorized for use by the INR holder.) This attack will cause RPs to de-preference the legitimate prefix/ASN binding intended by the INR holder.
A-4.4.1可修改ROA，以使ROA中的自主系统编号（ASN）或一个或多个地址块与INR持有人拟用于该ROA的值不同。（此操作假定修改后的ROA的ASN和地址范围已授权INR持有人使用。）此攻击将导致RPs取消INR持有人预期的合法前缀/ASN绑定。
A-4.5 Revocation
A-4.5撤销
A-4.5.1 A ROA may be revoked (by placing its EE certificate on the CRL for the publication point). This has the same effect as A-4.1.
A-4.5.1可撤销居留权（通过将其EE证书放在发布点的CRL上）。这与A-4.1的效果相同。
A-4.6 Injection
A-4.6注射
A-4.6.1 A ROA expressing different bindings than those published by the INR holder may be injected into a publication point. This action could authorize an additional ASN to advertise the specified prefix, allowing that ASN to originate routes for the prefix, thus enabling route origin spoofing. In this case, the injected ROA is considered to be in competition with any existing authorized ROAs for the specified prefix.
A-4.6.1表达不同于INR持有人发布的绑定的ROA可注入发布点。此操作可授权其他ASN播发指定前缀，从而允许该ASN为前缀发起路由，从而启用路由起源欺骗。在这种情况下，注入的ROA被视为与指定前缀的任何现有授权ROA竞争。
A-4.6.2 An injected ROA might express a different prefix for an ASN already authorized to originate a route, e.g., a longer prefix, which could enable that ASN to override other advertisements using shorter prefixes. If there are other ROAs that authorize different ASNs to advertise routes to the injected ROA's prefix, then the injected ROA is in competition with these ROAs.
A-4.6.2注入的ROA可能为已授权发起路由的ASN表示不同的前缀，例如，更长的前缀，这可以使该ASN使用更短的前缀覆盖其他广告。如果有其他ROA授权不同的ASN向注入的ROA前缀发布路由，则注入的ROA与这些ROA竞争。
The Ghostbusters Record [RFC6493] is a signed object that may be included at a publication point, at the discretion of the INR holder or publication point operator. The record is validated according to [RFC6488]. Additionally, the syntax of the record is verified based on the vCard profile from Section 5 of [RFC6493]. Errors in this record do not affect RP processing. However, if an RP encounters a problem with objects at a publication point, the RP may use information from the record to contact the publication point operator.
Ghostbusters记录[RFC6493]是一个签名对象，可由INR持有人或发布点操作员自行决定在发布点包含该对象。根据[RFC6488]对记录进行验证。此外，根据[RFC6493]第5节中的vCard配置文件验证记录的语法。此记录中的错误不会影响RP处理。但是，如果RP在发布点遇到对象问题，RP可以使用记录中的信息联系发布点操作员。
Adverse actions against a Ghostbusters Record can cause the following error:
针对Ghostbusters记录的不利操作可能会导致以下错误：
A-5.1 Deletion, suppression, corruption, or revocation of a Ghostbusters Record could prevent an RP from contacting the appropriate entity when a problem is detected by the RP. Modification or injection of a Ghostbusters Record could cause an RP to contact the wrong entity, thus delaying remediation of a detected anomaly. All of these actions are viewed as equivalent from an RP processing perspective; they do not alter RP validation of ROAs or router certificates. However, these actions can interfere with remediation of a problem when detected by an RP.
A-5.1当RP检测到问题时，删除、抑制、损坏或撤销Ghostbusters记录可能会阻止RP联系相应实体。修改或注入Ghostbusters记录可能会导致RP联系错误实体，从而延迟对检测到的异常进行补救。从RP处理的角度来看，所有这些动作都是等效的；它们不会改变ROA或路由器证书的RP验证。但是，当RP检测到问题时，这些操作可能会干扰问题的修复。
Router certificates are used by RPs to verify signatures on BGPsec_PATH attributes carried in UPDATE messages.
RPs使用路由器证书来验证更新消息中携带的BGPsec_路径属性上的签名。
Each AS is free to determine the granularity at which router certificates are managed [RFC8209]. Each participating AS is represented by one or more router certificates. During key or algorithm rollover, multiple router certificates will be present in a publication point, even if the AS is normally represented by just one such certificate.
每个AS可自由确定路由器证书管理的粒度[RFC8209]。每个参与AS由一个或多个路由器证书表示。在密钥或算法滚动期间，发布点中将存在多个路由器证书，即使AS通常仅由一个此类证书表示。
Adverse actions against router certificates can cause the following errors:
针对路由器证书的不利操作可能会导致以下错误：
A-6.1 Deletion
A-6.1删除
A-6.1.1 Deletion of a router certificate would cause an RP to be unable to verify signatures applied to BGPsec_PATH attributes on behalf of the AS in question. In turn, this would cause the route to be treated with lower preference than competing routes that have valid BGPsec_PATH attribute signatures. (However, if another router certificate for the affected AS is valid and contains the same AS number and public key, and it is in use by that AS, there would be no effect on routing. This scenario will arise if a router certificate is renewed, i.e., issued with a new validity interval.)
A-6.1.1删除路由器证书将导致RP无法代表所述AS验证应用于BGPsec_路径属性的签名。反过来，与具有有效BGPsec_路径属性签名的竞争路由相比，这将导致以更低的优先级处理路由。（但是，如果受影响AS的另一个路由器证书有效，并且包含相同的AS号和公钥，并且该证书正由该AS使用，则不会对路由产生影响。如果路由器证书被更新，即使用新的有效期间隔颁发，则会出现这种情况。）
A-6.2 Suppression
A-6.2抑制
A-6.2.1 Suppression of a router certificate could have the same impact as deletion of a certificate of this type, i.e., if no router certificate was available, BGPsec attributes that should be verified using the certificate would fail validation. If an older certificate existed and has not expired, it would be used by RPs. If the older certificate contained a different ASN, the impact would be the same as in A-6.4.
A-6.2.1禁止路由器证书可能与删除此类证书具有相同的影响，即，如果没有可用的路由器证书，则应使用证书验证的BGPsec属性将无法验证。如果存在较旧的证书且未过期，则RPs将使用该证书。如果旧证书包含不同的ASN，则影响与a-6.4中的相同。
A-6.3 Corruption
A-6.3腐败
A-6.3.1 Corruption of a router certificate will result in the certificate being rejected by RPs. Absent a valid router certificate, BGPsec_PATH attributes associated with that certificate will be unverifiable. In turn, this would cause the route to be treated with lower preference than competing routes that have valid BGPsec_PATH attribute signatures.
A-6.3.1路由器证书损坏将导致RPs拒绝该证书。如果没有有效的路由器证书，则与该证书关联的BGPsec_路径属性将无法验证。反过来，与具有有效BGPsec_路径属性签名的竞争路由相比，这将导致以更低的优先级处理路由。
A-6.4 Modification
A-6.4修改
A-6.4.1 If a router certificate is modified to represent a different ASN, but it still passes syntax checks, then this action could cause signatures on BGPsec_PATH attributes to be associated with the wrong AS. This could cause signed routes to be inconsistent with the intent of the INR holder, e.g., traffic might be routed via a different AS than intended.
A-6.4.1如果修改路由器证书以表示不同的ASN，但它仍然通过语法检查，则此操作可能会导致BGPsec_路径属性上的签名与错误的AS关联。这可能导致签署的路线与INR持有人的意图不一致，例如，交通可能通过与预期不同的路线进行路由。
A-6.5 Revocation
A-6.5撤销
A-6.5.1 If a router certificate were revoked, BGPsec_PATH attributes verifiable using that certificate would no longer be considered valid. The impact would be the same as for a deleted certificate, as described in A-6.1.
A-6.5.1如果路由器证书被吊销，则使用该证书可验证的BGPsec_路径属性将不再被视为有效。其影响与删除的证书相同，如a-6.1所述。
A-6.6 Injection
A-6.6注射
A-6.6.1 Insertion of a router certificate could authorize additional routers to sign BGPsec traffic for the targeted ASN, and thus undermine fundamental BGPsec security guarantees. If there are existing, authorized router certificates for the same ASN, then the injected router certificate is in competition with these existing certificates.
A-6.6.1插入路由器证书可能会授权其他路由器签署目标ASN的BGPsec流量，从而破坏基本的BGPsec安全保障。如果同一ASN存在现有的授权路由器证书，则注入的路由器证书将与这些现有证书竞争。
This section examines the types of problems that can arise in four scenarios described below. We consider mistakes, (successful) attacks against a CA or a publication point, and situations in which a CA or publication point manager is compelled to take action by a law enforcement authority.
本节将分析以下四种情况下可能出现的问题类型。我们考虑对CA或发布点的错误（成功）攻击，以及CA或发布点管理器被迫由执法机构采取行动的情况。
We explore the following four scenarios:
我们将探讨以下四种情况：
A. An INR holder operates its own CA and manages its own repository publication point.
A.INR持有人运营自己的CA，并管理自己的存储库发布点。
B. An INR holder operates its own CA, but outsources management of its repository publication point to its parent or another entity.
B.INR持有人经营自己的CA，但将其存储库发布点的管理外包给其母公司或其他实体。
C. An INR holder outsources management of its CA to its parent, but manages its own repository publication point.
C.INR持有人将其CA的管理外包给其母公司，但管理其自己的存储库发布点。
D. An INR holder outsources management of its CA and its publication point to its parent.
D.INR持有人将其CA及其发布点的管理外包给其母公司。
Note that these scenarios focus on the affected INR holder as the party directly affected by an adverse action. The most serious cases arise when the INR holder appears as a high-tier CA in the RPKI hierarchy; in such situations, subordinate INR holders may be affected as a result of an action. A mistake by or an attack against a "leaf" has more limited impact because all of the affected INRs belong to the INR holder itself.
请注意，这些情景侧重于受影响的印度卢比持有人，即直接受不利行动影响的一方。当INR持有人在RPKI层级中作为高级CA出现时，会出现最严重的情况；在这种情况下，下级INR持有人可能会因行动而受到影响。由于所有受影响的印度卢比都属于印度卢比持有人本身，因此对“leaf”的错误或攻击的影响更为有限。
In Scenario A, actions by the INR holder can adversely affect all of its resources and, transitively, resources of any subordinate CAs. (If the CA is a "leaf" in the RPKI, then it has no subordinate CAs and the damage is limited to its own INRs.)
在情景A中，INR持有人的行动可能会对其所有资源以及任何下级CA的资源产生不利影响。（如果CA是RPKI中的“叶子”，则其没有从属CA，且损害仅限于其自身的INR。）
In Scenario B, actions by the (outsourced) repository operator can also adversely affect the resources of the INR holder and those of any subordinates CAs. (If the CA is a "leaf" in the RPKI, then it has no subordinate CAs and the damage is limited, as in Scenario A.) The range of adverse effects here includes those in Scenario A and adds a new potential source of adverse actions, i.e., the outsourced repository operator.
在方案B中，（外包）存储库运营商的行动也会对INR持有人和任何下属CAs的资源产生不利影响。（如果CA是RPKI中的一个“叶子”，则它没有从属CA，损害是有限的，如场景a中所示。）此处的不良影响范围包括场景a中的不良影响，并增加了一个新的潜在不良行动来源，即外包存储库运营商。
In Scenario C, all signed objects associated with the INR holder are generated by the parent CA but are self-hosted. (We expect this scenario to be rare, because an INR holder that elects to outsource CA operation seems unlikely to manage its own repository publication point.) Because that CA has the private key used to sign them, it can generate alternative signed objects -- ones not authorized by the INR holder. However, erroneous objects created by the parent CA will not be published by the INR holder IF the holder checks them first. Because the parent CA is acting on behalf of the INR holder, mistakes by or attacks against that entity are equivalent to ones effected by the INR holder in Scenario A.
在场景C中，与INR持有者关联的所有签名对象都由父CA生成，但都是自托管的。（我们预计这种情况很少见，因为选择外包CA操作的INR持有者似乎不太可能管理自己的存储库发布点。）因为CA拥有用于对其签名的私钥，所以它可以生成替代签名对象——未经INR持有者授权的对象。但是，如果INR持有者首先检查父CA创建的错误对象，则不会发布这些对象。由于母公司CA代表INR持有人行事，因此该实体的错误或攻击等同于场景A中INR持有人的错误或攻击。
The INR holder is most vulnerable in Scenario D. Actions by the parent CA, acting on behalf of the INR holder, can adversely affect all signed objects associated with that INR holder, including any subordinate CA certificates. These actions will presumably translate directly into publication point changes because the parent CA is managing the publication point for the INR holder. The range of adverse effects here includes those in Scenarios A, B, and C.
INR持有人在场景D中最易受到攻击。代表INR持有人的父CA采取的行动可能会对与该INR持有人相关的所有签名对象产生不利影响，包括任何下级CA证书。这些操作可能会直接转化为发布点更改，因为父CA正在为INR持有人管理发布点。此处的不利影响范围包括情景A、B和C中的不利影响。
In this scenario, the INR holder acts as its own CA and it manages its own publication point. Actions by the INR holder can adversely affect all of its resources and, transitively, resources of any subordinate CAs. (If the CA is a "leaf" in the RPKI, then it has no subordinate CAs and the damage is limited to its own INRs.) Mistakes by the INR holder can cause any of the actions noted in Section 2. A successful attack against this CA can effect all of the modification, revocation, or injection actions noted in that section. (We assume that objects generated by the CA are automatically published). An attack against the publication point can effect all of the deletion, suppression, or corruption actions noted in that section.
在这种情况下，INR持有者充当自己的CA，并管理自己的发布点。INR持有人采取的行动可能会对其所有资源产生不利影响，并可能对任何下属CA的资源产生不利影响。（如果认证机构是RPKI中的“叶子”，则其没有从属认证机构，且损害仅限于其自身的INR。）INR持有人的错误可导致第2节所述的任何行为。对该CA的成功攻击可能会影响该部分中提到的所有修改、撤销或注入操作。（我们假设CA生成的对象是自动发布的）。对发布点的攻击可能会影响该部分中提到的所有删除、抑制或损坏操作。
In this scenario, the INR holder acts as its own CA but it delegates management of it own publication point to a third party. Mistakes by the INR holder can cause any of the modification, revocation, or injection actions described in Section 2. Actions by the repository operator can adversely affect the resources of the INR holder, and those of any subordinate CAs. (If the CA is a "leaf" in the RPKI, then it has no subordinate CAs and the damage is limited, as in Scenario A.) The range of adverse effects here includes those in Scenario A, and adds a new potential source of adverse actions, i.e., the third party repository operator. A successful attack against the CA can effect all of the modification, revocation, or injection actions noted in that section (assuming that objects generated by the CA are automatically published). Here, actions by the publication point manager (or attacks against that entity) can effect all of the deletion, suppression, or corruption actions noted in Section 2.
在这种情况下，INR持有人充当其自己的CA，但将其自己的发布点的管理委托给第三方。INR持有人的错误可能导致第2节所述的任何修改、撤销或注入行为。存储库运营商的行动可能会对INR持有人以及任何下属CA的资源产生不利影响。（如果CA是RPKI中的“叶子”，则它没有从属CA，损害是有限的，如场景a中所示。）此处的不利影响范围包括场景a中的不利影响，并添加了一个新的潜在不利行动来源，即第三方存储库运营商。对CA的成功攻击可以影响该部分中提到的所有修改、撤销或注入操作（假设CA生成的对象自动发布）。在这里，发布点管理器的操作（或对该实体的攻击）可以影响第2节中提到的所有删除、抑制或损坏操作。
In this scenario, the INR holder outsources management of its CA to its parent, but manages its own repository publication point. All signed objects associated with the INR holder are generated by the parent CA but are self-hosted. (We expect this scenario to be rare, because an INR holder that elects to outsource CA operation seems unlikely to manage its own repository publication point.) Because
在这种情况下，INR持有者将其CA的管理外包给其父代，但管理自己的存储库发布点。与INR持有者关联的所有签名对象都由父CA生成，但都是自托管的。（我们预计这种情况很少见，因为选择外包CA运营的INR持有人似乎不太可能管理自己的存储库发布点。）因为
that CA has the private key used to sign them, it can generate alternative signed objects -- ones not authorized by the INR holder. However, erroneous objects created by the parent CA will not be published by the INR holder IF the holder checks them first. Because the parent CA is acting on behalf of the INR holder, mistakes by or attacks against that entity are equivalent to ones effected by the INR holder in Scenario A. Mistakes by the INR holder, acted upon by the parent CA, can cause any of the actions noted in Section 2. Actions unilaterally undertaken by the parent CA also can have the same effect, unless the INR holder checks the signed objects before publishing them. A successful attack against the parent CA can effect all of the modification, revocation, or injection actions noted in Section 2, unless the INR holder checks the signed objects before publishing them. An attack against the INR holder (in its role as repository operator) can effect all of the deletion, suppression, or corruption actions noted in Section 2 (because the INR holder is managing its publication point), unless the INR holder checks the signed objects before publishing them. (An attack against the INR holder implies that the path it uses to direct the parent CA to issue and publish objects has been compromised.)
CA拥有用于签名的私钥，它可以生成替代的签名对象——未经INR持有者授权的对象。但是，如果INR持有者首先检查父CA创建的错误对象，则不会发布这些对象。由于母公司CA代表INR持有人行事，因此该实体所犯的错误或针对该实体的攻击等同于情景A中INR持有人所犯的错误。由母公司CA采取行动的INR持有人所犯的错误可导致第2节所述的任何行为。母CA单方面采取的行动也可能具有相同的效果，除非INR持有人在发布签名对象之前检查签名对象。成功攻击父CA可能会影响第2节中提到的所有修改、撤销或注入操作，除非INR持有人在发布签名对象之前检查签名对象。对INR持有者（作为存储库操作员）的攻击可能会影响第2节中提到的所有删除、抑制或损坏操作（因为INR持有者正在管理其发布点），除非INR持有者在发布之前检查签名对象。（对INR持有者的攻击意味着它用于指示父CA发布和发布对象的路径已被破坏。）
In this scenario, an INR holder outsources management of both its CA and its publication point to its parent. The INR holder is most vulnerable in this scenario. Actions by the parent CA, acting on behalf of the INR holder, can adversely affect all signed objects associated with that INR holder, including any subordinate CA certificates. These actions will presumably translate directly into publication point changes, because the parent CA is managing the publication point for the INR holder. The range of adverse effects here includes those in Scenarios A, B, and C. Mistakes by the INR holder, acted upon by the parent CA, can cause any of the actions noted in Section 2. Actions unilaterally undertaken by the parent CA also can have the same effect. A successful attack against the parent CA can effect all of the modification, revocation, or injection actions noted in Section 2. An attack against the parent CA can also effect all of the deletion, suppression, or corruption actions noted in Section 2 (because the parent CA is managing the INR holder's publication point).
在这种情况下，INR持有人将其CA及其发布点的管理外包给其母公司。在这种情况下，印度卢比持有人最容易受到伤害。父CA代表INR持有人采取的行动可能会对与该INR持有人相关的所有签名对象产生不利影响，包括任何下级CA证书。这些操作可能会直接转化为发布点更改，因为父CA正在为INR持有人管理发布点。此处的不利影响范围包括情景A、B和C中的不利影响。由母公司CA采取行动的INR持有人的错误可导致第2节所述的任何行动。母CA单方面采取的行动也可能产生同样的效果。成功攻击父CA会影响第2节中提到的所有修改、撤销或注入操作。对父CA的攻击还可能影响第2节中提到的所有删除、抑制或损坏操作（因为父CA正在管理INR持有人的发布点）。
This informational document describes a threat model for the RPKI, focusing on mistakes by or attacks against CAs and independent repository managers. It is intended to provide a basis for the design of future RPKI security mechanisms that seek to address the concerns associated with such actions.
本信息性文档描述了RPKI的威胁模型，重点关注CAs和独立存储库管理器的错误或攻击。其目的是为未来RPKI安全机制的设计提供基础，以解决与此类行动相关的问题。
The analysis in this document identifies a number of circumstances in which attacks or errors can have significant impacts on routing. One ought not interpret this as a condemnation of the RPKI. It is only an attempt to document the implications of a wide range of attacks and errors in the context of the RPKI. The primary alternative mechanism for disseminating routing information is Internet Routing Registry (IRR) technology [RFC2650] [RFC2725], which uses the Routing Policy Specification Language (RPSL) [RFC2622]. IRR technology exhibits its own set of security problems, which are discussed in [RFC7682].
本文档中的分析确定了一些攻击或错误可能对路由产生重大影响的情况。人们不应将此解释为对RPKI的谴责。这只是试图在RPKI的上下文中记录各种攻击和错误的含义。传播路由信息的主要替代机制是Internet路由注册（IRR）技术[RFC2650][RFC2725]，它使用路由策略规范语言（RPSL）[RFC2622]。IRR技术展示了其自身的一系列安全问题，这些问题在[RFC7682]中进行了讨论。
This document does not require any IANA actions.
本文件不要求IANA采取任何行动。
[RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP Addresses and AS Identifiers", RFC 3779, DOI 10.17487/RFC3779, June 2004, <https://www.rfc-editor.org/info/rfc3779>.
[RFC3779]Lynn，C.，Kent，S.，和K.Seo，“IP地址和AS标识符的X.509扩展”，RFC 3779，DOI 10.17487/RFC3779，2004年6月<https://www.rfc-editor.org/info/rfc3779>.
[RFC6480] Lepinski, M. and S. Kent, "An Infrastructure to Support Secure Internet Routing", RFC 6480, DOI 10.17487/RFC6480, February 2012, <https://www.rfc-editor.org/info/rfc6480>.
[RFC6480]Lepinski，M.和S.Kent，“支持安全互联网路由的基础设施”，RFC 6480，DOI 10.17487/RFC6480，2012年2月<https://www.rfc-editor.org/info/rfc6480>.
[RFC6481] Huston, G., Loomans, R., and G. Michaelson, "A Profile for Resource Certificate Repository Structure", RFC 6481, DOI 10.17487/RFC6481, February 2012, <https://www.rfc-editor.org/info/rfc6481>.
[RFC6481]Huston，G.，Loomans，R.，和G.Michaelson，“资源证书存储库结构的配置文件”，RFC 6481，DOI 10.17487/RFC6481，2012年2月<https://www.rfc-editor.org/info/rfc6481>.
[RFC6482] Lepinski, M., Kent, S., and D. Kong, "A Profile for Route Origin Authorizations (ROAs)", RFC 6482, DOI 10.17487/RFC6482, February 2012, <https://www.rfc-editor.org/info/rfc6482>.
[RFC6482]Lepinski，M.，Kent，S.，和D.Kong，“路线原产地授权（ROA）的概要”，RFC 6482，DOI 10.17487/RFC6482，2012年2月<https://www.rfc-editor.org/info/rfc6482>.
[RFC6483] Huston, G. and G. Michaelson, "Validation of Route Origination Using the Resource Certificate Public Key Infrastructure (PKI) and Route Origin Authorizations (ROAs)", RFC 6483, DOI 10.17487/RFC6483, February 2012, <https://www.rfc-editor.org/info/rfc6483>.
[RFC6483]Huston，G.和G.Michaelson，“使用资源证书公钥基础设施（PKI）和路由起源授权（ROA）验证路由起源”，RFC 6483，DOI 10.17487/RFC6483，2012年2月<https://www.rfc-editor.org/info/rfc6483>.
[RFC6486] Austein, R., Huston, G., Kent, S., and M. Lepinski, "Manifests for the Resource Public Key Infrastructure (RPKI)", RFC 6486, DOI 10.17487/RFC6486, February 2012, <https://www.rfc-editor.org/info/rfc6486>.
[RFC6486]Austein，R.，Huston，G.，Kent，S.，和M.Lepinski，“资源公钥基础设施（RPKI）清单”，RFC 6486，DOI 10.17487/RFC6486，2012年2月<https://www.rfc-editor.org/info/rfc6486>.
[RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, DOI 10.17487/RFC6487, February 2012, <https://www.rfc-editor.org/info/rfc6487>.
[RFC6487]Huston，G.，Michaelson，G.，和R.Loomans，“X.509 PKIX资源证书的配置文件”，RFC 6487，DOI 10.17487/RFC6487，2012年2月<https://www.rfc-editor.org/info/rfc6487>.
[RFC6488] Lepinski, M., Chi, A., and S. Kent, "Signed Object Template for the Resource Public Key Infrastructure (RPKI)", RFC 6488, DOI 10.17487/RFC6488, February 2012, <https://www.rfc-editor.org/info/rfc6488>.
[RFC6488]Lepinski，M.，Chi，A.，和S.Kent，“资源公钥基础设施（RPKI）的签名对象模板”，RFC 6488，DOI 10.17487/RFC6488，2012年2月<https://www.rfc-editor.org/info/rfc6488>.
[RFC6489] Huston, G., Michaelson, G., and S. Kent, "Certification Authority (CA) Key Rollover in the Resource Public Key Infrastructure (RPKI)", BCP 174, RFC 6489, DOI 10.17487/RFC6489, February 2012, <https://www.rfc-editor.org/info/rfc6489>.
[RFC6489]Huston，G.，Michaelson，G.，和S.Kent，“资源公钥基础设施（RPKI）中的证书颁发机构（CA）密钥滚动”，BCP 174，RFC 6489，DOI 10.17487/RFC6489，2012年2月<https://www.rfc-editor.org/info/rfc6489>.
[RFC6493] Bush, R., "The Resource Public Key Infrastructure (RPKI) Ghostbusters Record", RFC 6493, DOI 10.17487/RFC6493, February 2012, <https://www.rfc-editor.org/info/rfc6493>.
[RFC6493]布什，R.，“资源公钥基础设施（RPKI）捉鬼记录”，RFC 6493，DOI 10.17487/RFC6493，2012年2月<https://www.rfc-editor.org/info/rfc6493>.
[RFC6916] Gagliano, R., Kent, S., and S. Turner, "Algorithm Agility Procedure for the Resource Public Key Infrastructure (RPKI)", BCP 182, RFC 6916, DOI 10.17487/RFC6916, April 2013, <https://www.rfc-editor.org/info/rfc6916>.
[RFC6916]Gagliano，R.，Kent，S.和S.Turner，“资源公钥基础设施（RPKI）的算法敏捷程序”，BCP 182，RFC 6916，DOI 10.17487/RFC6916，2013年4月<https://www.rfc-editor.org/info/rfc6916>.
[RFC7935] Huston, G. and G. Michaelson, Ed., "The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure", RFC 7935, DOI 10.17487/RFC7935, August 2016, <https://www.rfc-editor.org/info/rfc7935>.
[RFC7935]Huston，G.和G.Michaelson，编辑，“用于资源公钥基础设施的算法和密钥大小的配置文件”，RFC 7935，DOI 10.17487/RFC7935，2016年8月<https://www.rfc-editor.org/info/rfc7935>.
[RFC8205] Lepinski, M., Ed. and K. Sriram, Ed., "BGPsec Protocol Specification", RFC 8205, DOI 10.17487/RFC8205, September 2017, <https://www.rfc-editor.org/info/rfc8205>.
[RFC8205]Lepinski，M.，Ed.和K.Sriram，Ed.，“BGPsec协议规范”，RFC 8205，DOI 10.17487/RFC8205，2017年9月<https://www.rfc-editor.org/info/rfc8205>.
[RFC8209] Reynolds, M., Turner, S., and S. Kent, "A Profile for BGPsec Router Certificates, Certificate Revocation Lists, and Certification Requests", RFC 8209, DOI 10.17487/RFC8209, September 2017, <https://www.rfc-editor.org/info/rfc8209>.
[RFC8209]Reynolds，M.，Turner，S.和S.Kent，“BGPsec路由器证书、证书撤销列表和证书请求的配置文件”，RFC 8209，DOI 10.17487/RFC8209，2017年9月<https://www.rfc-editor.org/info/rfc8209>.
[RFC2622] Alaettinoglu, C., Villamizar, C., Gerich, E., Kessens, D., Meyer, D., Bates, T., Karrenberg, D., and M. Terpstra, "Routing Policy Specification Language (RPSL)", RFC 2622, DOI 10.17487/RFC2622, June 1999, <https://www.rfc-editor.org/info/rfc2622>.
[RFC2622]Alaettinoglu，C.，Villamizar，C.，Gerich，E.，Kessens，D.，Meyer，D.，Bates，T.，Karrenberg，D.，和M.Terpstra，“路由策略规范语言（RPSL）”，RFC 2622，DOI 10.17487/RFC2622，1999年6月<https://www.rfc-editor.org/info/rfc2622>.
[RFC2650] Meyer, D., Schmitz, J., Orange, C., Prior, M., and C. Alaettinoglu, "Using RPSL in Practice", RFC 2650, DOI 10.17487/RFC2650, August 1999, <https://www.rfc-editor.org/info/rfc2650>.
[RFC2650]Meyer，D.，Schmitz，J.，Orange，C.，Prior，M.，和C.Alaettinoglu，“在实践中使用RPSL”，RFC 2650，DOI 10.17487/RFC2650，1999年8月<https://www.rfc-editor.org/info/rfc2650>.
[RFC2725] Villamizar, C., Alaettinoglu, C., Meyer, D., and S. Murphy, "Routing Policy System Security", RFC 2725, DOI 10.17487/RFC2725, December 1999, <https://www.rfc-editor.org/info/rfc2725>.
[RFC2725]Villamizar，C.，Alaettinoglu，C.，Meyer，D.，和S.Murphy，“路由策略系统安全”，RFC 2725，DOI 10.17487/RFC27252999年12月<https://www.rfc-editor.org/info/rfc2725>.
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", STD 70, RFC 5652, DOI 10.17487/RFC5652, September 2009, <https://www.rfc-editor.org/info/rfc5652>.
[RFC5652]Housley，R.，“加密消息语法（CMS）”，STD 70，RFC 5652，DOI 10.17487/RFC5652，2009年9月<https://www.rfc-editor.org/info/rfc5652>.
[RFC7132] Kent, S. and A. Chi, "Threat Model for BGP Path Security", RFC 7132, DOI 10.17487/RFC7132, February 2014, <https://www.rfc-editor.org/info/rfc7132>.
[RFC7132]Kent，S.和A.Chi，“BGP路径安全的威胁模型”，RFC 7132，DOI 10.17487/RFC7132，2014年2月<https://www.rfc-editor.org/info/rfc7132>.
[RFC7682] McPherson, D., Amante, S., Osterweil, E., Blunk, L., and D. Mitchell, "Considerations for Internet Routing Registries (IRRs) and Routing Policy Configuration", RFC 7682, DOI 10.17487/RFC7682, December 2015, <https://www.rfc-editor.org/info/rfc7682>.
[RFC7682]McPherson，D.，Amante，S.，Osterweil，E.，Blunk，L.，和D.Mitchell，“互联网路由注册表（IRR）和路由策略配置的注意事项”，RFC 7682，DOI 10.17487/RFC7682，2015年12月<https://www.rfc-editor.org/info/rfc7682>.
Acknowledgements
致谢
The authors thank Richard Hansen and David Mandelberg for their extensive review, feedback, and editorial assistance. Thanks also go to Daiming Li for her editorial assistance.
作者感谢Richard Hansen和David Mandelberg的广泛评论、反馈和编辑帮助。还要感谢李代明的编辑协助。
Authors' Addresses
作者地址
Stephen Kent BBN Technologies 10 Moulton St Cambridge, MA 02138-1119 United States of America
Stephen Kent BBN Technologies美国马萨诸塞州剑桥莫尔顿街10号，邮编02138-1119
Email: kent@alum.mit.edu
Email: kent@alum.mit.edu
Di Ma ZDNS 4 South 4th St. Zhongguancun Haidian, Beijing 100190 China
中国北京海淀中关村南四街4号地马ZDNS 100190
Email: madi@zdns.cn
Email: madi@zdns.cn