IPv4 Run-Out, Trading, and the RPKI

Size: px

Start display at page:

Download "IPv4 Run-Out, Trading, and the RPKI"

Meghan Parker
5 years ago
Views:

IPv4 Run-Out, Trading, and the RPKI RIPE 56 / Berlin 2008.05.

1 IPv4 Run-Out, Trading, and the RPKI RIPE 56 / Berlin Randy Bush <randy@psg.com>

2 RIPE v4 Trade RPKI 2 Internet Initiative Japan Originally, an initiative to get Japan on the Internet Asian and some US backbone Commercial customer base Internet, not telephant, MPLS,... First commercial IPv6 deployment WIDE, Kame IPv6 code base...

3 IPv4 Free-Pool Run-Out IPv4 Free Pool will run-out in a few years This is not news. See graphs of Frank Solensky over ten years ago; and Geoff's IPv4 will go to a trading model Registries will become title agents, not allocators, of IPv4 space RIRs are developing full multi-rir/lir open source software to certify and verify title to IPv4 and IPv6 resources RIPE v4 Trade RPKI 3

4 RIPE v4 Trade RPKI 4 What Should Have Happened IPv4 Free Pool Today IPv6 Deployment $/IPv4 /24

5 RIPE v4 Trade RPKI 5 What Is Happening? Today $/IPv4 /24 IPv4 Free Pool IPv6 Deployment Optimism

6 RIPE v4 Trade RPKI 6 If You Think IPv6 is Being Deployed

7 IPv6 Prefix Allocations RIPE v4 Trade RPKI 7

8 BGP Prefix Announcements RIPE v4 Trade RPKI 8

9 RIPE v4 Trade RPKI 9 As you have seen from Geoff, the last year is better!

10 RIPE v4 Trade RPKI 10 So We Need IPv4 Run-Out to be Reasonably Optimal and also Fair

11 RIPE v4 Trade RPKI 11 Are current societal and administrative systems fair? What's 'fair'?

12 Is This 'Fair'? RIPE v4 Trade RPKI 12

13 RIPE v4 Trade RPKI 13 That was ARIN for Other regions have somewhat different distributions

14 RIPE v4 Trade RPKI 14 Yes, it models the market concentration in North America but...

15 RIPE v4 Trade RPKI 15 Meanwhile a newcomer may not be able to 'justify' a /20-/24

16 RIPE v4 Trade RPKI 16 The RIR communities have placed severe barriers to entry at the low end!

17 RIPE v4 Trade RPKI 17 Is that how we think the last few /8s should be distributed?

18 RIPE v4 Trade RPKI 18 Why is This? We're saving routing table size at the expense of barrier to entry Should we be doing this at the end? Instead, give me tools deal with folk who de-aggregate unnecessarily

19 What Might We Do? I am not an expert, but I admit it, which is a differentiator :) Even distribution to RIRs of the last /8s Within RIRs, damp big request[er]s Enable small requests Save the last /16 in each region for unknowns and emergencies Open market with transparency RIPE v4 Trade RPKI 19

20 ARIN Legacy Prefix Announcements RIPE v4 Trade RPKI 20

21 Unannounced /24 Equivalents RIPE v4 Trade RPKI 21

22 RIPE v4 Trade RPKI 22 That's Legacy Space There is also a lot of underutilized RIR Space Post-Legacy

23 RIPE v4 Trade RPKI 23 How to Put IPv4 Space to Best Use?

24 RIPE v4 Trade RPKI 24 Best Use is Supposed to be What Markets Do

25 RIPE v4 Trade RPKI 25 There Already is a Black Market in IPv4 Address Space

26 RIPE v4 Trade RPKI 26 Would you Rather Have a Black Market or an Open Market?

27 RIPE v4 Trade RPKI 27 I personally prefer a possibly flawed open market to amateur over-regulators

28 RIPE v4 Trade RPKI 28 So How Do We Make the Market Transparent and Safe?

29 RIPE v4 Trade RPKI 29 The First Problem is that the Buyer Needs Assurance that the Seller can Actually Convey Title

30 RIPE v4 Trade RPKI 30 Serious Problems! Poor quality of whois data Poor quality of IRR data No formal means of verifying if a new customer legitimately holds IP space X No formal means of verifying routing announcements

31 RIPE v4 Trade RPKI 31 Requirements Formally verifiable assertions of rights in IP Address Space and ASNs Formally verifiable assertions of rights of ASNs to originate prefixes Formally verifiable assertions of the correctness of routing announcements Formally verifiable Assignment, Transfer, of IP prefixes and ASNs

32 RIPE v4 Trade RPKI 32 Resource Public Key Infrastructure RPKI DataBase IP Resource Certs ASN Resource Certs Rights to Route

33 RIPE v4 Trade RPKI 33 Application Range Handle both resource ownership ASNs and IP space And verifiable transactions with others: Allocation Sub-Delegation Transfer, Trade, Sale, Lease,...

34 RIPE v4 Trade RPKI 34 RPKI Interfaces/Users RIR Rsch & Audit ASN Cert Addr Cert Contractual Cert Exchange of ISP Certificate Public Key Infrastructure DataBase Addr Cert Sub-Alloc Addr Attest ISP Contractual Cert Exchange ISP Replica Replica Replica Replica Global ISP Routing Infrastructure Right To Route Cert Exchange End Site

35 Underlying Certificate RPKI Architecture Allows any open implementation to be used by all Allows each RIR/LIR to have own business processes and front end And allows ISPs and end sites to build their own processes using the base toolset RIPE v4 Trade RPKI 35

36 [Hardware] Signing Module RPKI Engine IR Back End IR RPKI Priv Keys Internal CA Data Keys for Talking to IR BackEnd XML to Parent My Resources My RightsToRoute ID=Me Private RPKI Keys ID=Me Public RPKI Keys Biz EE Signing Key & Up/Down EE Public Keys Certs Issued to DownStreams Internal CA Data My Misc Config Options Issued ROAs XML Object Transport & Handler XML to Child Command Data Stub Provided to be Hacked Publication XML Protocol Repo Mgt Resource PKI Private IR Biz Trust Anchor Internal CA Data Business Key/Cert Management IP Resource Certs ASN Resource Certs Rights to Route RIPE v4 Trade RPKI 36

37 State of Play APNIC did a simple prototype OpenSSL 3779 done by ARIN Protocols and specs cooperative RIRs APNIC & ARIN driving the protocol, designs, model, essentially XML/CMS Multi-RIR and ISP/user tools in production this year The result are all open source RIPE v4 Trade RPKI 37

38 RIPE v4 Trade RPKI 38 What We Can Do We can't make more IPv4 Space We can't fix the speed of light We can use markets/trading to get the best use of IPv4 space We can see that those markets are safe

39 RIPE v4 Trade RPKI 39 Thanks To ARIN and ISOC for continuing support of Research and Development APNIC, RIPE, LACNIC, AfriNIC Internet Initiative Japan

40 RIPE v4 Trade RPKI 40 Questions? Mark Dranse will Answer Them!

IPv4 Run-Out, Trading, and the RPKI

IPv4 Run-Out, Trading, and the RPKI MENOG 3 / Salmiya 2008.04.15 Randy Bush http://rip.psg.com/~randy/080415.menog-v4-trad-rpki.pdf 2008.04.15 MENOG v4 Trade RPKI 2 Internet Initiative