RFC 7935 RPKI Cryptography: 2048-Bit RSA And SHA-256 Guide 2026

The internet’s backbone relies on the Border Gateway Protocol (BGP) for routing data across global networks. However, BGP’s vulnerability to hijacks and misconfigurations has long threatened its stability. Enter the Resource Public Key Infrastructure (RPKI), a framework designed to validate route announcements using cryptographic proofs. At the heart of RPKI’s trustworthiness lies RFC 7935, a pivotal standards document published in August 2016 by the Internet Engineering Task Force (IETF). This RFC meticulously defines the algorithms, parameters, key formats, sizes, and signature structures essential for generating and verifying digital signatures in RPKI objects like certificates, revocation lists, and signed manifests.

Why does this matter today? As of 2026, with rising cyber threats and state-sponsored attacks on routing infrastructure, adhering to these specs ensures that RPKI deployments remain resilient. This article delves into the technical underpinnings of RFC 7935, its evolution from prior standards, practical implications for network operators, and future-proofing strategies. We’ll break down the cryptographic choices, explore implementation challenges, and highlight real-world benefits for securing autonomous systems worldwide.

Understanding RPKI’s Role in BGP Security

RPKI addresses BGP’s core weakness: the lack of origin validation. Without it, any network can announce routes for IP address blocks it doesn’t own, leading to traffic blackholing or redirection. RPKI counters this by issuing Route Origin Authorizations (ROAs)—cryptographically signed objects that bind IP prefixes to authorized autonomous system numbers (ASNs).

Certificates in RPKI form a hierarchical trust chain, rooted in trusted anchors managed by regional internet registries (RIRs) like ARIN, RIPE NCC, and APNIC. These certificates sign CRLs (Certificate Revocation Lists) to invalidate compromised keys, CMS-signed objects like ROAs and manifests for data integrity, and certification requests for chain extension. Every step demands unwavering cryptographic integrity, which RFC 7935 enforces.

Before RFC 7935, RFC 6485 (February 2012) provided initial guidelines but fell short against advancing cryptanalysis. Advances in computing power rendered smaller keys and weaker hashes vulnerable. RFC 7935 updates these to align with contemporary security needs, mandating parameters that withstand foreseeable attacks.

Core Cryptographic Mandates in RFC 7935

RFC 7935 leaves no ambiguity: it prescribes exact algorithms to eliminate variability and ensure interoperability. Here’s a detailed look:

• Hashing Algorithm: SHA-256 is mandatory for certificates, CRLs, CMS signed objects, and certification requests. This 256-bit Secure Hash Algorithm provides collision resistance far superior to SHA-1, which is permitted only for legacy key identifiers per RFC 6487.
• Signature Algorithm: RSA PKCS #1 v1.5 paired with SHA-256, identified via the OID sha256WithRSAEncryption (from RFC 4055). In CMS SignedData, digest and signature algorithms are separated: SHA-256 for digests and rsaEncryption (RFC 3370) for signatures. Validators must accept both for backward compatibility with RFC 6485 objects.
• Key Specifications: RSA keys must feature a 2048-bit modulus and public exponent e=65537 (2^16 + 1). This size balances security and performance; 2048 bits resists factorization attacks with current technology, while the Fermat prime exponent optimizes computation.

These choices aren’t arbitrary. SHA-256’s adoption stems from NIST’s approval and widespread hardware acceleration. RSA-2048, endorsed by bodies like the NSA Suite B, offers a 112-bit security level against quantum threats until post-quantum alternatives mature.

Implications for RPKI Participants

Certificate Authorities (CAs) generating RPKI objects must comply strictly. Non-conformance risks rejection by relying parties (RPs)—validators in routers or monitoring tools. For instance, when a CA issues a certificate, it embeds the subject’s public key in subjectPublicKeyInfo (RFC 5280 format), using the prescribed RSA parameters.

RPs, including BGP speakers with RPKI-enabled software like BIRD or FRR, verify chains by traversing from ROA to root anchor. Invalid signatures trigger ‘Not Found’ or ‘Invalid’ ROA states, preventing bogus routes. Tools like Routinator or OctoRPKI automate this, but they enforce RFC 7935 specs.

Transitioning from RFC 6485 involves auditing existing objects. Many deployments phased in SHA-256 post-2016, but full compliance requires regenerating keys periodically—every 1-5 years, depending on policy.

Security Rationale and Threat Mitigation

RFC 7935’s specs counter specific threats:

• Collision Attacks: SHA-1’s practical breaks (e.g., SHAttered attack, 2017) make it unsuitable; SHA-256 remains secure.
• Factorization: 2048-bit RSA withstands general-number field sieve attacks; estimates suggest 2^112 operations needed, infeasible today.
• Key Reuse: Fixed exponent prevents side-channel leaks common with small e values.

No new threats arise from these mandates, as stated in the RFC. Yet, long-term, RSA’s vulnerability to quantum computers (Shor’s algorithm) looms. Initiatives like RFC 8897 outline RP requirements, paving for algorithm agility.

Practical Deployment Challenges

Implementing RFC 7935 isn’t seamless. Legacy systems may choke on strict OIDs, necessitating software updates. Key generation demands FIPS 140-2 validated libraries like OpenSSL 1.1+.

Performance matters: 2048-bit RSA signing/verification adds latency, but hardware accelerators (e.g., Intel QAT) mitigate this. In high-volume RPKI caches serving millions of objects, efficiency is key.

Global adoption varies: By 2026, over 50% of routes are RPKI-covered, per MANRS reports, but full compliance lags in some regions due to resource constraints.

Future Directions Beyond RFC 7935

While RFC 7935 holds firm, evolution beckons. Research into ECDSA and EdDSA promises smaller keys and faster ops. A 2024 ACM paper highlights RPKI’s RSA exclusivity as a barrier to agility, proposing phased migrations.

Post-quantum cryptography (PQC) trials, like those in CIRAD (CMS-like formats), test lattice-based signatures. IETF drafts aim to parameterize algorithms via objects, enabling smooth upgrades without forklift replacements.

Best Practices for Operators

1. Audit Compliance: Use tools like rpki-client to validate your repository.
2. Key Management: Rotate keys before expiry; monitor CRLs diligently.
3. RP Configuration: Enable strict validation on BGP peers; start with ‘warn’ mode.
4. Monitoring: Track invalidation rates via RIPEstat or similar.

Frequently Asked Questions

What is the main update in RFC 7935 over RFC 6485?

It mandates SHA-256 universally (except key IDs) and standardizes OIDs for better interoperability.

Is 2048-bit RSA still secure in 2026?

Yes, per NIST guidelines; it’s projected safe until 2030, with transitions to larger or alternatives underway.

Do all RPKI tools support RFC 7935?

Major ones like Fascinator and RTRlib do; verify vendor docs.

How does RFC 7935 impact BGPsec?

It influences related specs like RFC 8208 for path validation.

Conclusion

RFC 7935 stands as a cornerstone of RPKI, embedding cryptographic rigor into internet routing security. By standardizing on proven primitives, it empowers operators to thwart hijacks, ensuring data flows to rightful destinations. As threats evolve, staying compliant—and vigilant—remains paramount. Network guardians, integrate these specs to build a more secure internet.