Trust Anchor Format

Resource Public Key Infrastructure (RPKI) Trust Anchor Locator

“…The TAL is analogous to the TrustAnchorInfo data structure specified in [RFC5914], which is on the Standards Track. That specification could be used to represent the TAL, if one defined an rsync URI extension for that data structure.…”

Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

“…| However, [RFC5914] defines several formats for representing trust | anchor information, including self-signed certificates, and [RFC5937] | provides an example of how such information may be used to initialize | the path validation inputs. Implementations are free to make use of | any additional information that is included in a trust anchor | representation, or to ignore such information.…”

Trust Anchor Management Requirements

“…However, if the store containing this TA is used by multiple applications that serve different purposes, the same key may be used (inappropriately) to validate other types of objects such as certificates or Online Certificate Status Protocol (OCSP) responses. Prior to publication of [RFC5914], there was no standard general-purpose mechanism for limiting the applicability (scope) of a trust anchor. A common practice to address this problem is to place different TAs in different stores and limit the set of applications that access a given TA store.…”

“…The requirements stated in this document were prepared prior to the publication of [RFC5914] and [RFC5934]. The document was not published at that time to allow for changes in requirements during the development of the associated technical specifications.…”

“…The document was not published at that time to allow for changes in requirements during the development of the associated technical specifications. The requirements described below are those that were considered during the development of [RFC5914] and [RFC5934].…”