rfc9977v1.txt   rfc9977.txt 
skipping to change at line 119 skipping to change at line 119
much, you throw together different clients in different locations; much, you throw together different clients in different locations;
if you aggregate too little, you fill up the geolocation database if you aggregate too little, you fill up the geolocation database
with unnecessary entries. with unnecessary entries.
This document specifies how to augment the Routing Policy This document specifies how to augment the Routing Policy
Specification Language (RPSL) [RFC2725] inetnum: class to refer Specification Language (RPSL) [RFC2725] inetnum: class to refer
specifically to prefixlen files and how to use the files. In all specifically to prefixlen files and how to use the files. In all
places where inetnum: is used, inet6num: must also be assumed places where inetnum: is used, inet6num: must also be assumed
[RFC4012]. [RFC4012].
The reader may find [INETNUM] and [INET6NUM] informative, and The reader may find [DBOBJECTS] informative, with certainly more
certainly more verbose descriptions of the inetnum: database classes verbose descriptions, on the inetnum: and inet6num database classes.
exist in those documents.
An optional means for authenticating prefixlen data is also defined An optional means for authenticating prefixlen data is also defined
in Section 6. in Section 6.
2. Requirements Language 2. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in "OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
skipping to change at line 146 skipping to change at line 145
prefixlen files are CSV files [RFC4180] in text format with UTF-8 prefixlen files are CSV files [RFC4180] in text format with UTF-8
encoding [RFC3629], excluding problematic code points as described in encoding [RFC3629], excluding problematic code points as described in
[RFC9839]. Lines MUST be delimited by a line break (CRLF), and blank [RFC9839]. Lines MUST be delimited by a line break (CRLF), and blank
lines MUST be ignored. Text from a '#' character to the end of the lines MUST be ignored. Text from a '#' character to the end of the
current line MUST be treated as a comment only and is similarly current line MUST be treated as a comment only and is similarly
ignored. The first field of each line that is not ignored specifies ignored. The first field of each line that is not ignored specifies
the prefix in question, the second the end-site prefix length within the prefix in question, the second the end-site prefix length within
that prefix as an integer, and the third the number of end-sites that prefix as an integer, and the third the number of end-sites
within an end-site prefix length for networks using Carrier-Grade NAT within an end-site prefix length for networks using Carrier-Grade NAT
(CGN) [RFC6598] or proxies. In all places Carrier-Grade NAT or CGN (CGN) [RFC6598] or proxies. In all places Carrier-Grade NAT or CGN
is used in this document, this applies to proxies as well. Note that is used in this document, the specifications apply to proxies as
all three fields MUST be present. This means there MUST be exactly well. Note that all three fields MUST be present. This means there
two commas in each non-commented line delimiting the three fields. MUST be exactly two commas in each non-commented line delimiting the
The first field MUST NOT be empty on lines that are not comments, three fields. The first field MUST NOT be empty on lines that are
while the second and third field can be empty in certain scenarios. not comments, while the second and third field can be empty in
If both the second and third fields are empty, the publisher does not certain scenarios. If both the second and third fields are empty,
want to disclose any prefix length information. the publisher does not want to disclose any prefix length
information.
3.1. End-Site Prefix Length Without CGN or Proxies 3.1. End-Site Prefix Length Without CGN or Proxies
If an ISP delegates /56 IPv6 prefixes of the 2001:db8::/32 range and If an ISP delegates /56 IPv6 prefixes of the 2001:db8::/32 range and
/32 IPv4 prefixes (i.e., a single IPv4 address) of the 192.0.2.0/24 /32 IPv4 prefixes (i.e., a single IPv4 address) of the 192.0.2.0/24
range to its customers without the use of CGN [RFC6598] or proxy range to its customers without the use of CGN [RFC6598] or proxy
techniques, it would create a prefix length file containing the techniques, it would create a prefix length file containing the
following example entries: following example entries:
2001:db8::/32,56,1 2001:db8::/32,56,1
skipping to change at line 202 skipping to change at line 202
192.0.2.0/24,26,1000 192.0.2.0/24,26,1000
It is important to note that the third field denoting the number of It is important to note that the third field denoting the number of
CGN end-sites is referring to the prefix length specified in the CGN end-sites is referring to the prefix length specified in the
second field. second field.
Note that this specification can be applied to IPv6 networks as well. Note that this specification can be applied to IPv6 networks as well.
3.3. Longest Prefix Matching 3.3. Longest Prefix Matching
Prefix length files can contain sub-prefixes entries of a parent Prefix length files can contain sub-prefix entries of a parent
prefix, which needs to be taken into account when processing these prefix; this needs to be taken into account when processing these
files. For example, if a cloud provider assigns /120 IPv6 prefixes files. For example, if a cloud provider assigns /120 IPv6 prefixes
to each customer VM and a /64 prefix to premium customers, it would to each customer VM and a /64 prefix to premium customers, it would
create a prefix length file containing the following example entries: create a prefix length file containing the following example entries:
2001:db8::/32,120, 2001:db8::/32,120,
2001:db8:abcd::/48,64, 2001:db8:abcd::/48,64,
Note that the second entry in the above example is a subprefix of the Note that the second entry in the above example is a subprefix of the
first entry. Therefore, longest prefix matching has to be performed first entry. Therefore, longest prefix matching has to be performed
when parsing prefixlen files. when parsing prefixlen files.
skipping to change at line 793 skipping to change at line 793
Subsets", RFC 9839, DOI 10.17487/RFC9839, August 2025, Subsets", RFC 9839, DOI 10.17487/RFC9839, August 2025,
<https://www.rfc-editor.org/info/rfc9839>. <https://www.rfc-editor.org/info/rfc9839>.
[X680] ITU-T, "Information technology - Abstract Syntax Notation [X680] ITU-T, "Information technology - Abstract Syntax Notation
One (ASN.1): Specification of basic notation", ITU-T One (ASN.1): Specification of basic notation", ITU-T
Recommendation X.680, ISO/IEC 8824-1:2021, February 2021, Recommendation X.680, ISO/IEC 8824-1:2021, February 2021,
<https://www.itu.int/rec/T-REC-X.680>. <https://www.itu.int/rec/T-REC-X.680>.
11.2. Informative References 11.2. Informative References
[INET6NUM] RIPE NCC, "Description of the INET6NUM Object", October [DBOBJECTS]
2019, <https://www.ripe.net/manage-ips-and- RIPE NCC, "Descriptions of Primary Objects",
asns/db/support/documentation/ripe-database-documentation/ <https://docs.db.ripe.net/RPSL-Object-Types/Descriptions-
rpsl-object-types/4-2-descriptions-of-primary- of-Primary-Objects>.
objects/4-2-3-description-of-the-inet6num-object>.
[INETNUM] RIPE NCC, "Description of the INETNUM Object", June 2020,
<https://www.ripe.net/manage-ips-and-
asns/db/support/documentation/ripe-database-documentation/
rpsl-object-types/4-2-descriptions-of-primary-
objects/4-2-4-description-of-the-inetnum-object>.
[PREFIXLEN-FINDER] [PREFIXLEN-FINDER]
"prefixlen-finder", June 2021, "prefixlen-finder", commit
5f446617796bc17d7e9495513537438ec26ab8e6, May 2026,
<https://github.com/massimocandela/prefixlen-finder>. <https://github.com/massimocandela/prefixlen-finder>.
[RFC0959] Postel, J. and J. Reynolds, "File Transfer Protocol", [RFC0959] Postel, J. and J. Reynolds, "File Transfer Protocol",
STD 9, RFC 959, DOI 10.17487/RFC0959, October 1985, STD 9, RFC 959, DOI 10.17487/RFC0959, October 1985,
<https://www.rfc-editor.org/info/rfc959>. <https://www.rfc-editor.org/info/rfc959>.
[RFC3912] Daigle, L., "WHOIS Protocol Specification", RFC 3912, [RFC3912] Daigle, L., "WHOIS Protocol Specification", RFC 3912,
DOI 10.17487/RFC3912, September 2004, DOI 10.17487/RFC3912, September 2004,
<https://www.rfc-editor.org/info/rfc3912>. <https://www.rfc-editor.org/info/rfc3912>.
skipping to change at line 926 skipping to change at line 920
id-ct-prefixlenCSVwithCRLF OBJECT IDENTIFIER ::= id-ct-prefixlenCSVwithCRLF OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-9(9) smime(16) ct(1) 57 } pkcs-9(9) smime(16) ct(1) 57 }
END END
<CODE ENDS> <CODE ENDS>
Appendix B. Example Appendix B. Example
This appendix provides an example, including a trust anchor, a CRL This appendix provides an example, including a trust anchor, a
signed by the trust anchor, a CA certificate subordinate to the trust Certificate Revocation List (CRL) signed by the trust anchor, a CA
anchor, a CRL signed by the CA, an end-entity certificate subordinate certificate subordinate to the trust anchor, a CRL signed by the CA,
to the CA for signing the prefixlen file, and a detached signature. an end-entity certificate subordinate to the CA for signing the
prefixlen file, and a detached signature.
The trust anchor is represented by a self-signed certificate. As The trust anchor is represented by a self-signed certificate. As
usual in the RPKI, the trust anchor has authority over all IPv4 usual in the RPKI, the trust anchor has authority over all IPv4
address blocks, all IPv6 address blocks, and all Autonomous System address blocks, all IPv6 address blocks, and all Autonomous System
(AS) numbers. (AS) numbers.
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIEQTCCAymgAwIBAgIUEggycNoFVRjAuN/Fw7URu0DEZNAwDQYJKoZIhvcNAQEL MIIEQTCCAymgAwIBAgIUEggycNoFVRjAuN/Fw7URu0DEZNAwDQYJKoZIhvcNAQEL
BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yMzA5MTkyMDMzMzlaFw0zMzA5 BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yMzA5MTkyMDMzMzlaFw0zMzA5
MTYyMDMzMzlaMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEwggEiMA0GCSqGSIb3DQEB MTYyMDMzMzlaMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEwggEiMA0GCSqGSIb3DQEB
skipping to change at line 966 skipping to change at line 961
JBclMHVd3tXse9If3nXYF4bxRIcir1lXlAbYN+Eo1U3i5qJO+fxouzt7Merk2Dih JBclMHVd3tXse9If3nXYF4bxRIcir1lXlAbYN+Eo1U3i5qJO+fxouzt7Merk2Dih
nsenTeXKzN7tfmuCYZZHCC8viCoJWdH+o1uRM4TiQApZsUJ8sF4TABrrRJmA/Ed5 nsenTeXKzN7tfmuCYZZHCC8viCoJWdH+o1uRM4TiQApZsUJ8sF4TABrrRJmA/Ed5
v0CTBbgqTx7yg0+VarFLPdnjYgtpoCJqwE2C1UpX15rZSaLVuGXtbwXd/cHEg5vF v0CTBbgqTx7yg0+VarFLPdnjYgtpoCJqwE2C1UpX15rZSaLVuGXtbwXd/cHEg5vF
W6QTsMeMQFEUa6hkicDGtxLTUdhckBgmCGoF2nlZii5f1BTWAg== W6QTsMeMQFEUa6hkicDGtxLTUdhckBgmCGoF2nlZii5f1BTWAg==
-----END CERTIFICATE----- -----END CERTIFICATE-----
The CRL issued by the trust anchor. The CRL issued by the trust anchor.
-----BEGIN X509 CRL----- -----BEGIN X509 CRL-----
MIIBjjB4AgEBMA0GCSqGSIb3DQEBCwUAMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEX MIIBjjB4AgEBMA0GCSqGSIb3DQEBCwUAMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEX
DTI1MTIwNDEzNDgxMVoXDTI2MDEwMzEzNDgxMVqgLzAtMB8GA1UdIwQYMBaAFMC9 DTI2MDUwNzIxMjI0OVoXDTI2MDYwNjIxMjI0OVqgLzAtMB8GA1UdIwQYMBaAFMC9
Ul2+0niyFuyzo0OV0gYLmQgyMAoGA1UdFAQDAgELMA0GCSqGSIb3DQEBCwUAA4IB Ul2+0niyFuyzo0OV0gYLmQgyMAoGA1UdFAQDAgEMMA0GCSqGSIb3DQEBCwUAA4IB
AQDLltErZwESHDSkwhnL++hFPAJUJf6NapOV9bzUBr5D6vLgs01dke3AFoUNJCng AQCkHXyCcQHejmVdHOL5Diafa3ys4HTb2eRqeNaMzwfY6T1D26hX6XuUyu0C7LV2
15p5EPi7BZnZMx3b+My+Hh8jMOxloKBe6eeZ0impCw5ZveWGwe4u3vH3snl9QkjZ OThlAL8JWiN2afgfs5juBAWdauwY5YSKAvQpXidFeCIXpSWLHmk545p7t9og6qpy
Slz+zxaNidKl/9W5h4rjznwKD98//t75ACa9UFImsE53U5cXwUor0QKd3VDkKLVf 840l+N+J2WnP9iGNCqgKG06CiRAoPtZZQCqqLZVcrELtDAOFNmZF0Bf+cE2SmsZO
nivSzVPaC3hvN85wOXMgC/M3MwD5PCKJ/jEBDfEADfnUIXUbjys13ycH2mX3gBZa 8N/ab/fw05Ptm/IBqN3j+ekaILELFRWUGPaAXMimWYn6sNmzYdihUn2fNff294PZ
svDot/HDgpcQVRZBJC4ecPy9aBfj8EEfmIwidQtS+4vyh7lrR9xKn8wUqvti3Ulx Mygxfw8dpWlA01QQt8d9V+3NklyOKEB3X+X12eA4KYaVDCt4USWMlnlETNO3XwDe
wYTdSdP9LWR+Ha7xdvSMJUiU Cg5BBjoh5EtXzsNWf2ipZTNb
-----END X509 CRL----- -----END X509 CRL-----
The CA certificate is issued by the trust anchor. This certificate The CA certificate is issued by the trust anchor. This certificate
grants authority over one IPv4 address block (192.0.2.0/24), one IPv6 grants authority over one IPv4 address block (192.0.2.0/24), one IPv6
address block(2001:db8::/32), and two AS numbers (64496 and 64497). address block(2001:db8::/32), and two AS numbers (64496 and 64497).
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIE+zCCA+OgAwIBAgIUcyCzS10hdfG65kbRq7toQAvRDMEwDQYJKoZIhvcNAQEL MIIE+zCCA+OgAwIBAgIUcyCzS10hdfG65kbRq7toQAvRDMIwDQYJKoZIhvcNAQEL
BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yNTEyMDQxMzQ4MTFaFw0yNjEy BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yNjA1MDcyMTIyNDlaFw0yNzA1
MDQxMzQ4MTFaMDMxMTAvBgNVBAMTKDNBQ0UyQ0VGNEZCMjFCN0QxMUUzRTE4NEVG MDcyMTIyNDlaMDMxMTAvBgNVBAMTKDNBQ0UyQ0VGNEZCMjFCN0QxMUUzRTE4NEVG
QzFFMjk3QjM3Nzg2NDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc QzFFMjk3QjM3Nzg2NDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc
zz1qwTxC2ocw5rqp8ktm2XyYkl8riBVuqlXwfefTxsR2YFpgz9vkYUd5Az9EVEG7 zz1qwTxC2ocw5rqp8ktm2XyYkl8riBVuqlXwfefTxsR2YFpgz9vkYUd5Az9EVEG7
6wGIyZbtmhK63eEeaqbKz2GHub467498BXeVrYysO+YuIGgCEYKznNDZ4j5aaDbo 6wGIyZbtmhK63eEeaqbKz2GHub467498BXeVrYysO+YuIGgCEYKznNDZ4j5aaDbo
j5+4/z0Qvv6HEsxQd0f8br6lKJwgeRM6+fm7796HNPB0aqD7Zj9NRCLXjbB0DCgJ j5+4/z0Qvv6HEsxQd0f8br6lKJwgeRM6+fm7796HNPB0aqD7Zj9NRCLXjbB0DCgJ
liH6rXMKR86ofgll9V2mRjesvhdKYgkGbOif9rvxVpLJ/6zdru5CE9yeuJZ59l+n liH6rXMKR86ofgll9V2mRjesvhdKYgkGbOif9rvxVpLJ/6zdru5CE9yeuJZ59l+n
YH/r6PzdJ4Q7yKrJX8qD6A60j4+biaU4MQ72KpsjhQNTTqF/HRwi0N54GDaknEwE YH/r6PzdJ4Q7yKrJX8qD6A60j4+biaU4MQ72KpsjhQNTTqF/HRwi0N54GDaknEwE
TnJQHgLJDYqww9yKWtjjAgMBAAGjggIjMIICHzAdBgNVHQ4EFgQUOs4s70+yG30R TnJQHgLJDYqww9yKWtjjAgMBAAGjggIjMIICHzAdBgNVHQ4EFgQUOs4s70+yG30R
4+GE78Hil7N3hkIwHwYDVR0jBBgwFoAUwL1SXb7SeLIW7LOjQ5XSBguZCDIwDwYD 4+GE78Hil7N3hkIwHwYDVR0jBBgwFoAUwL1SXb7SeLIW7LOjQ5XSBguZCDIwDwYD
VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwGAYDVR0gAQH/BA4wDDAKBggr VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwGAYDVR0gAQH/BA4wDDAKBggr
BgEFBQcOAjBDBgNVHR8EPDA6MDigNqA0hjJyc3luYzovL3Jwa2kuZXhhbXBsZS5u BgEFBQcOAjBDBgNVHR8EPDA6MDigNqA0hjJyc3luYzovL3Jwa2kuZXhhbXBsZS5u
ZXQvcmVwb3NpdG9yeS9leGFtcGxlLXRhLmNybDBOBggrBgEFBQcBAQRCMEAwPgYI ZXQvcmVwb3NpdG9yeS9leGFtcGxlLXRhLmNybDBOBggrBgEFBQcBAQRCMEAwPgYI
KwYBBQUHMAKGMnJzeW5jOi8vcnBraS5leGFtcGxlLm5ldC9yZXBvc2l0b3J5L2V4 KwYBBQUHMAKGMnJzeW5jOi8vcnBraS5leGFtcGxlLm5ldC9yZXBvc2l0b3J5L2V4
YW1wbGUtdGEuY2VyMIG5BggrBgEFBQcBCwSBrDCBqTA+BggrBgEFBQcwCoYycnN5 YW1wbGUtdGEuY2VyMIG5BggrBgEFBQcBCwSBrDCBqTA+BggrBgEFBQcwCoYycnN5
bmM6Ly9ycGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvcnkvZXhhbXBsZS1jYS5tZnQw bmM6Ly9ycGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvcnkvZXhhbXBsZS1jYS5tZnQw
NQYIKwYBBQUHMA2GKWh0dHBzOi8vcnJkcC5leGFtcGxlLm5ldC9ub3RpZmljYXRp NQYIKwYBBQUHMA2GKWh0dHBzOi8vcnJkcC5leGFtcGxlLm5ldC9ub3RpZmljYXRp
b24ueG1sMDAGCCsGAQUFBzAFhiRyc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVw b24ueG1sMDAGCCsGAQUFBzAFhiRyc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVw
b3NpdG9yeS8wLgYIKwYBBQUHAQcBAf8EHzAdMAwEAgABMAYDBADAAAIwDQQCAAIw b3NpdG9yeS8wLgYIKwYBBQUHAQcBAf8EHzAdMAwEAgABMAYDBADAAAIwDQQCAAIw
BwMFACABDbgwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgMA+/ACAwD78TANBgkq BwMFACABDbgwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgMA+/ACAwD78TANBgkq
hkiG9w0BAQsFAAOCAQEAdgCV/G9f6NIC3MhqAqSoA56/7bJJ2QC3bChnwZH0MB3p hkiG9w0BAQsFAAOCAQEAipx10/ZrY11NYH+iVRtq32hAFGGaXysLWrjFVYd05+25
VjYNhcY99ZFBv9TdsAd0GsPMEL4zGqvxkSQZjrJHSqe6GHJB5Kr4/SDbbyu6vylh 2nPtZYPmtLRf7TWMSwF27AkGPzvonjsRF2a7wdMAPDIW2nKctmDS1nFGWw+6vXyN
QPDNIBnH2o5iXU/34Klx3Wf42ttsi7DAhGcR6OOAR4UrO/7ng19oFXe3tBWDcVLf Di+jhwHm7+FyFWh3u2ilzop+o6ecUiCF8rkE22TWHRkBJforN0eqUjJi0R/o4oaB
Jd6Bqptp8fkfpSyHQEezZ0xA5h/SXeN+qvbL0rOJcI4+Ybbqa7U21+cz/JftAdgw q9sZs+Jr3vTmelRYjvP8Eej3AWRm+rilbP8yW3OOvV3sTvgJc4DmbFNJ2LBJ+cLx
vatxQzGxl47HyvC7IpROI0+8jXB9xwOGKxznBve9/LeIZzMYBRuYV6jVWe4V6ja9 1fjl+Wf/YHPo2kHw8f1TJsgXSI6kYBUradIyXIW1HGrWdiKiY+oXp+jVbf8cMvp/
2crgaoDZaOH78JLjg3Qt+hVSQ667lak3QXZ1FVp1WA== KkLf1UqqCjgdu3GGQuukKjbNHeJPMuHmVw5Qa3iGzg==
-----END CERTIFICATE----- -----END CERTIFICATE-----
The CRL issued by the CA. The CRL issued by the CA.
-----BEGIN X509 CRL----- -----BEGIN X509 CRL-----
MIIBrTCBlgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzQUNFMkNFRjRG MIIBrTCBlgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzQUNFMkNFRjRG
QjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyFw0yNTEyMDQxMzQ4MTFaFw0y QjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyFw0yNjA1MDcyMTIyNDlaFw0y
NjAxMDMxMzQ4MTFaoC8wLTAfBgNVHSMEGDAWgBQ6zizvT7IbfRHj4YTvweKXs3eG NjA2MDYyMTIyNDlaoC8wLTAfBgNVHSMEGDAWgBQ6zizvT7IbfRHj4YTvweKXs3eG
QjAKBgNVHRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAyxbVA6TeFHU8BqciB0q1 QjAKBgNVHRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAFEEWr/QvDz2efRDS9mep
Of81r/Ux/PTKIyhpVznTcVxa4wodsQcaMVNKYxINHNwctCm901Rx3nO61BqZpvaL GSpNS2QPbeV7Oz+rO5sZAIxrpuBZObe0NRlZaMamM0X+lSgKnEai2Ep5Pm4NzG6M
XPdkstlnzG+WaHcfUj09sTx7Eb/r17J1EACr2p9dVq4fTpuw/+Nq7ecj80NM74z6 Z1dHSrp196l65o0CTiPK0r4IqEUfY1Q6tkzXzc/6c9kUxMerE1saY/OlN29yYJ4F
uCiA5iyEjI0PYen4/IOgods0ceUm0QBOCTKNI3cbjZjiAfY9tRgqR1F2eeeproEM IDHrczvK5y1ddK8g3FB7fNjti4RCFAec8RsyizemDwS4JLd1R3y1+olJ5OH6Gvqq
+ulVORW4yfivsMGMHApaeLVnUTnAln9YqnL7mQGMBrRIBwYi2dk76K++iQBhWEP0 uMTSAJHl4LL5DeAZm3WLzL49PJWcaKoNe0oAPDdEalW5GXlAMsbQw9W8mOvBKotP
Ofv22y7UIbfqycrYROuJ9yGdwi5IAhpbKoQIzS5DimN+xykJdGPm0d2jUwNRibPh 5Q9k8VVXaILSFn2+AzPKX7fQXoA954KMVnDAgN0r8Fa743J7TlbFbk+l5+V/+88f
GQ== cA==
-----END X509 CRL----- -----END X509 CRL-----
The end-entity certificate is issued by the CA. This certificate The end-entity certificate is issued by the CA. This certificate
grants signature authority for one IPv4 address block (192.0.2.0/24). grants signature authority for one IPv4 address block (192.0.2.0/24).
Signature authority for the IPv6 address block and the AS numbers is Signature authority for the IPv6 address block and the AS numbers is
not needed for the prefixlen file that will be signed, so these items not needed for the prefixlen file that will be signed, so these items
are not included in the end-entity certificate. are not included in the end-entity certificate.
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIEVjCCAz6gAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZvowDQYJKoZIhvcNAQEL MIIEVjCCAz6gAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZvswDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExRTNFMTg0RUZDMUUyOTdC BQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExRTNFMTg0RUZDMUUyOTdC
Mzc3ODY0MjAeFw0yNTEyMDQxMzQ4MTFaFw0yNjA5MzAxMzQ4MTFaMDMxMTAvBgNV Mzc3ODY0MjAeFw0yNjA1MDcyMTIyNDlaFw0yNzAzMDMyMTIyNDlaMDMxMTAvBgNV
BAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM0NUFCRjA1M0ExODcwggEi BAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM0NUFCRjA1M0ExODcwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycTQrOb/qB2W3i3Ki8PhA/DEW MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycTQrOb/qB2W3i3Ki8PhA/DEW
yii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQgtPCVwr62hTQZCIowBN0BL0c yii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQgtPCVwr62hTQZCIowBN0BL0c
K0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZmr5xphXRvE+mzuJVLgu2V1upm K0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZmr5xphXRvE+mzuJVLgu2V1upm
BXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXhaFLe08y4DPfr/S/tXJOBm7QzQp BXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXhaFLe08y4DPfr/S/tXJOBm7QzQp
tmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKGzqTFCcc3EW9l5UFE1MFLlnoEog tmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKGzqTFCcc3EW9l5UFE1MFLlnoEog
qtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQft5w6g6cmxG+aYDdIEB34zrAgMB qtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQft5w6g6cmxG+aYDdIEB34zrAgMB
AAGjggFgMIIBXDAdBgNVHQ4EFgQUkUZSo71RwUQmAZiIn1xFq/BToYcwHwYDVR0j AAGjggFgMIIBXDAdBgNVHQ4EFgQUkUZSo71RwUQmAZiIn1xFq/BToYcwHwYDVR0j
BBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkIwDgYDVR0PAQH/BAQDAgeAMBgGA1Ud BBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkIwDgYDVR0PAQH/BAQDAgeAMBgGA1Ud
IAEB/wQOMAwwCgYIKwYBBQUHDgIwYQYDVR0fBFowWDBWoFSgUoZQcnN5bmM6Ly9y IAEB/wQOMAwwCgYIKwYBBQUHDgIwYQYDVR0fBFowWDBWoFSgUoZQcnN5bmM6Ly9y
cGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvcnkvM0FDRTJDRUY0RkIyMUI3RDExRTNF cGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvcnkvM0FDRTJDRUY0RkIyMUI3RDExRTNF
MTg0RUZDMUUyOTdCMzc3ODY0Mi5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUF MTg0RUZDMUUyOTdCMzc3ODY0Mi5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUF
BzAChlByc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVwb3NpdG9yeS8zQUNFMkNF BzAChlByc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVwb3NpdG9yeS8zQUNFMkNF
RjRGQjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyLmNlcjAfBggrBgEFBQcB RjRGQjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyLmNlcjAfBggrBgEFBQcB
BwEB/wQQMA4wDAQCAAEwBgMEAMAAAjANBgkqhkiG9w0BAQsFAAOCAQEAwvEWPwHe BwEB/wQQMA4wDAQCAAEwBgMEAMAAAjANBgkqhkiG9w0BAQsFAAOCAQEAUIykBaqY
VSFYwknmaOJrVeHrDez4BYg/uqpws0ny8LNUApsStUTrvsdkOMYVqJBifFpUtx7y nR/U+AXYzCqRbMqdygFY9R11fiNQubpkf5kEYHFxTut0CZLz9dToxuHRDLbPhjJv
1hfEZDkDIP7TC78pYaiTR5WAxSv/dxr9GuGUNgx7YDmvOST9OAZvfEBrNtj7DC+Z Ci3cDkb2ICy1Fdcit5oi9jFl1MD/sFa4l/FWGM07PhgKY+Isz3DXEw9furF7Al3I
jumMNWxMdTkjsLswXmlUF7dZxQjt01w5Wf5aD/MlV87d6mX49A0rjuaeIRTMglUq gbB0and5HQrvQbO6AnqixSYDffANsnZssojMzlHJIA9OLHIuhGZ66t+yh2VclhwV
EzqmnqSVTHVqtQwWlCG45ltS2Keu788RMnkiRDL2CJUoy8Axy5xcYSpf+keqFE13 7JdS+0EdyA0npIrTGyp//pD5vrigF04y+J4Y61jFXfmbWZbNJF/bMzFeBxD2PKaE
UUyegHcBUEODfk8AP0hnc6YhXC6+oBz72HbgYqTYyjQNYGS+49b58u5nXWqJoMJm uwixf65s3yI0JDjBbXjUtUhqyty0IZqV2HcuWU7MKH9Qc/wvrJDd4K4xTbkWWYgA
yxybgehJbawpCA== ql7bgmJTHpW2Gw==
-----END CERTIFICATE----- -----END CERTIFICATE-----
The end-entity certificate is displayed below in detail. For The end-entity certificate is displayed below in detail. For
brevity, the other two certificates are not. brevity, the other two certificates are not.
0 1110: SEQUENCE { 0 1110: SEQUENCE {
4 830: SEQUENCE { 4 830: SEQUENCE {
8 3: [0] { 8 3: [0] {
10 1: INTEGER 2 10 1: INTEGER 2
: } : }
13 20: INTEGER 13 20: INTEGER
: 27 AD 39 40 83 D7 F2 B5 B9 9B 86 70 C7 75 B2 B9 : 27 AD 39 40 83 D7 F2 B5 B9 9B 86 70 C7 75 B2 B9
: 6E E1 66 FA : 6E E1 66 FB
35 13: SEQUENCE { 35 13: SEQUENCE {
37 9: OBJECT IDENTIFIER 37 9: OBJECT IDENTIFIER
: sha256WithRSAEncryption (1 2 840 113549 1 1 11) : sha256WithRSAEncryption (1 2 840 113549 1 1 11)
48 0: NULL 48 0: NULL
: } : }
50 51: SEQUENCE { 50 51: SEQUENCE {
52 49: SET { 52 49: SET {
54 47: SEQUENCE { 54 47: SEQUENCE {
56 3: OBJECT IDENTIFIER commonName (2 5 4 3) 56 3: OBJECT IDENTIFIER commonName (2 5 4 3)
61 40: PrintableString 61 40: PrintableString
: '3ACE2CEF4FB21B7D11E3E184EFC1E297B3778642' : '3ACE2CEF4FB21B7D11E3E184EFC1E297B3778642'
: } : }
: } : }
: } : }
103 30: SEQUENCE { 103 30: SEQUENCE {
105 13: UTCTime 04/12/2025 13:48:11 GMT 105 13: UTCTime 07/05/2026 21:22:49 GMT
120 13: UTCTime 30/09/2026 13:48:11 GMT 120 13: UTCTime 03/03/2027 21:22:49 GMT
: } : }
135 51: SEQUENCE { 135 51: SEQUENCE {
137 49: SET { 137 49: SET {
139 47: SEQUENCE { 139 47: SEQUENCE {
141 3: OBJECT IDENTIFIER commonName (2 5 4 3) 141 3: OBJECT IDENTIFIER commonName (2 5 4 3)
146 40: PrintableString 146 40: PrintableString
: '914652A3BD51C144260198889F5C45ABF053A187' : '914652A3BD51C144260198889F5C45ABF053A187'
: } : }
: } : }
: } : }
skipping to change at line 1225 skipping to change at line 1220
: } : }
: } : }
: } : }
: } : }
838 13: SEQUENCE { 838 13: SEQUENCE {
840 9: OBJECT IDENTIFIER 840 9: OBJECT IDENTIFIER
: sha256WithRSAEncryption (1 2 840 113549 1 1 11) : sha256WithRSAEncryption (1 2 840 113549 1 1 11)
851 0: NULL 851 0: NULL
: } : }
853 257: BIT STRING 853 257: BIT STRING
: C2 F1 16 3F 01 DE 55 21 58 C2 49 E6 68 E2 6B 55 : 50 8C A4 05 AA 98 9D 1F D4 F8 05 D8 CC 2A 91 6C
: E1 EB 0D EC F8 05 88 3F BA AA 70 B3 49 F2 F0 B3 : CA 9D CA 01 58 F5 1D 75 7E 23 50 B9 BA 64 7F 99
: 54 02 9B 12 B5 44 EB BE C7 64 38 C6 15 A8 90 62 : 04 60 71 71 4E EB 74 09 92 F3 F5 D4 E8 C6 E1 D1
: 7C 5A 54 B7 1E F2 D6 17 C4 64 39 03 20 FE D3 0B : 0C B6 CF 86 32 6F 0A 2D DC 0E 46 F6 20 2C B5 15
: BF 29 61 A8 93 47 95 80 C5 2B FF 77 1A FD 1A E1 : D7 22 B7 9A 22 F6 31 65 D4 C0 FF B0 56 B8 97 F1
: 94 36 0C 7B 60 39 AF 39 24 FD 38 06 6F 7C 40 6B : 56 18 CD 3B 3E 18 0A 63 E2 2C CF 70 D7 13 0F 5F
: 36 D8 FB 0C 2F 99 8E E9 8C 35 6C 4C 75 39 23 B0 : BA B1 7B 02 5D C8 81 B0 74 6A 77 79 1D 0A EF 41
: BB 30 5E 69 54 17 B7 59 C5 08 ED D3 5C 39 59 FE : B3 BA 02 7A A2 C5 26 03 7D F0 0D B2 76 6C B2 88
: 5A 0F F3 25 57 CE DD EA 65 F8 F4 0D 2B 8E E6 9E : CC CE 51 C9 20 0F 4E 2C 72 2E 84 66 7A EA DF B2
: 21 14 CC 82 55 2A 13 3A A6 9E A4 95 4C 75 6A B5 : 87 65 5C 96 1C 15 EC 97 52 FB 41 1D C8 0D 27 A4
: 0C 16 94 21 B8 E6 5B 52 D8 A7 AE EF CF 11 32 79 : 8A D3 1B 2A 7F FE 90 F9 BE B8 A0 17 4E 32 F8 9E
: 22 44 32 F6 08 95 28 CB C0 31 CB 9C 5C 61 2A 5F : 18 EB 58 C5 5D F9 9B 59 96 CD 24 5F DB 33 31 5E
: FA 47 AA 14 4D 77 51 4C 9E 80 77 01 50 43 83 7E : 07 10 F6 3C A6 84 BB 08 B1 7F AE 6C DF 22 34 24
: 4F 00 3F 48 67 73 A6 21 5C 2E BE A0 1C FB D8 76 : 38 C1 6D 78 D4 B5 48 6A CA DC B4 21 9A 95 D8 77
: E0 62 A4 D8 CA 34 0D 60 64 BE E3 D6 F9 F2 EE 67 : 2E 59 4E CC 28 7F 50 73 FC 2F AC 90 DD E0 AE 31
: 5D 6A 89 A0 C2 66 CB 1C 9B 81 E8 49 6D AC 29 08 : 4D B9 16 59 88 00 AA 5E DB 82 62 53 1E 95 B6 1B
: } : }
To allow reproduction of the signature results, the end-entity To allow reproduction of the signature results, the end-entity
private key is provided. For brevity, the other two private keys are private key is provided. For brevity, the other two private keys are
not. not.
-----BEGIN RSA PRIVATE KEY----- -----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAsnE0Kzm/6gdlt4tyovD4QPwxFsootk4BqPaYAsDvZbCESOmW MIIEpQIBAAKCAQEAsnE0Kzm/6gdlt4tyovD4QPwxFsootk4BqPaYAsDvZbCESOmW
/5Pmkollj/ZEnM5XEILTwlcK+toU0GQiKMATdAS9HCtP+ZNYpiXYuanTN57yrMDP /5Pmkollj/ZEnM5XEILTwlcK+toU0GQiKMATdAS9HCtP+ZNYpiXYuanTN57yrMDP
Ap6EddbwfKUBcK7mZq+caYV0bxPps7iVS4LtldbqZgV7lpaHsprnYellifhg48D1 Ap6EddbwfKUBcK7mZq+caYV0bxPps7iVS4LtldbqZgV7lpaHsprnYellifhg48D1
skipping to change at line 1280 skipping to change at line 1275
PvDXVubRAoGAdqXeSWoLxuzZXzl8rsaKrQsTYaXnOWaZieU1SL5vVe8nK257UDqZ PvDXVubRAoGAdqXeSWoLxuzZXzl8rsaKrQsTYaXnOWaZieU1SL5vVe8nK257UDqZ
E3ng2j5XPTUWli+aNGFEJGRoNtcQvO60O/sFZUhu52sqq9mWVYZNh1TB5aP8X+pV E3ng2j5XPTUWli+aNGFEJGRoNtcQvO60O/sFZUhu52sqq9mWVYZNh1TB5aP8X+pV
iFcZOLUvQEcN6PA+YQK5FU11rAI1M0Gm5RDnVnUl0L2xfCYxb7FzV6Y= iFcZOLUvQEcN6PA+YQK5FU11rAI1M0Gm5RDnVnUl0L2xfCYxb7FzV6Y=
-----END RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----
Signing of "192.0.2.0/24,32,1" (terminated by CR and LF), yields the Signing of "192.0.2.0/24,32,1" (terminated by CR and LF), yields the
following detached CMS signature. following detached CMS signature.
# RPKI Signature: 192.0.2.0 - 192.0.2.255 # RPKI Signature: 192.0.2.0 - 192.0.2.255
# MIIGQAYJKoZIhvcNAQcCoIIGMTCCBi0CAQMxDTALBglghkgBZQMEAgEwDQYLKoZ # MIIGQAYJKoZIhvcNAQcCoIIGMTCCBi0CAQMxDTALBglghkgBZQMEAgEwDQYLKoZ
# IhvcNAQkQAS+gggRaMIIEVjCCAz6gAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZv # IhvcNAQkQATmgggRaMIIEVjCCAz6gAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZv
# owDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExR # swDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExR
# TNFMTg0RUZDMUUyOTdCMzc3ODY0MjAeFw0yNTEyMDQxMzQ4MTFaFw0yNjA5MzAx # TNFMTg0RUZDMUUyOTdCMzc3ODY0MjAeFw0yNjA1MDcyMTIyNDlaFw0yNzAzMDMy
# MzQ4MTFaMDMxMTAvBgNVBAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM # MTIyNDlaMDMxMTAvBgNVBAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM
# 0NUFCRjA1M0ExODcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycT # 0NUFCRjA1M0ExODcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycT
# QrOb/qB2W3i3Ki8PhA/DEWyii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQg # QrOb/qB2W3i3Ki8PhA/DEWyii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQg
# tPCVwr62hTQZCIowBN0BL0cK0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZm # tPCVwr62hTQZCIowBN0BL0cK0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZm
# r5xphXRvE+mzuJVLgu2V1upmBXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXha # r5xphXRvE+mzuJVLgu2V1upmBXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXha
# FLe08y4DPfr/S/tXJOBm7QzQptmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKG # FLe08y4DPfr/S/tXJOBm7QzQptmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKG
# zqTFCcc3EW9l5UFE1MFLlnoEogqtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQ # zqTFCcc3EW9l5UFE1MFLlnoEogqtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQ
# ft5w6g6cmxG+aYDdIEB34zrAgMBAAGjggFgMIIBXDAdBgNVHQ4EFgQUkUZSo71R # ft5w6g6cmxG+aYDdIEB34zrAgMBAAGjggFgMIIBXDAdBgNVHQ4EFgQUkUZSo71R
# wUQmAZiIn1xFq/BToYcwHwYDVR0jBBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkI # wUQmAZiIn1xFq/BToYcwHwYDVR0jBBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkI
# wDgYDVR0PAQH/BAQDAgeAMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwYQYDVR # wDgYDVR0PAQH/BAQDAgeAMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwYQYDVR
# 0fBFowWDBWoFSgUoZQcnN5bmM6Ly9ycGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvc # 0fBFowWDBWoFSgUoZQcnN5bmM6Ly9ycGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvc
# nkvM0FDRTJDRUY0RkIyMUI3RDExRTNFMTg0RUZDMUUyOTdCMzc3ODY0Mi5jcmww # nkvM0FDRTJDRUY0RkIyMUI3RDExRTNFMTg0RUZDMUUyOTdCMzc3ODY0Mi5jcmww
# bAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlByc3luYzovL3Jwa2kuZXhhbXB # bAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlByc3luYzovL3Jwa2kuZXhhbXB
# sZS5uZXQvcmVwb3NpdG9yeS8zQUNFMkNFRjRGQjIxQjdEMTFFM0UxODRFRkMxRT # sZS5uZXQvcmVwb3NpdG9yeS8zQUNFMkNFRjRGQjIxQjdEMTFFM0UxODRFRkMxRT
# I5N0IzNzc4NjQyLmNlcjAfBggrBgEFBQcBBwEB/wQQMA4wDAQCAAEwBgMEAMAAA # I5N0IzNzc4NjQyLmNlcjAfBggrBgEFBQcBBwEB/wQQMA4wDAQCAAEwBgMEAMAAA
# jANBgkqhkiG9w0BAQsFAAOCAQEAwvEWPwHeVSFYwknmaOJrVeHrDez4BYg/uqpw # jANBgkqhkiG9w0BAQsFAAOCAQEAUIykBaqYnR/U+AXYzCqRbMqdygFY9R11fiNQ
# s0ny8LNUApsStUTrvsdkOMYVqJBifFpUtx7y1hfEZDkDIP7TC78pYaiTR5WAxSv # ubpkf5kEYHFxTut0CZLz9dToxuHRDLbPhjJvCi3cDkb2ICy1Fdcit5oi9jFl1MD
# /dxr9GuGUNgx7YDmvOST9OAZvfEBrNtj7DC+ZjumMNWxMdTkjsLswXmlUF7dZxQ # /sFa4l/FWGM07PhgKY+Isz3DXEw9furF7Al3IgbB0and5HQrvQbO6AnqixSYDff
# jt01w5Wf5aD/MlV87d6mX49A0rjuaeIRTMglUqEzqmnqSVTHVqtQwWlCG45ltS2 # ANsnZssojMzlHJIA9OLHIuhGZ66t+yh2VclhwV7JdS+0EdyA0npIrTGyp//pD5v
# Keu788RMnkiRDL2CJUoy8Axy5xcYSpf+keqFE13UUyegHcBUEODfk8AP0hnc6Yh # rigF04y+J4Y61jFXfmbWZbNJF/bMzFeBxD2PKaEuwixf65s3yI0JDjBbXjUtUhq
# XC6+oBz72HbgYqTYyjQNYGS+49b58u5nXWqJoMJmyxybgehJbawpCDGCAaowggG # yty0IZqV2HcuWU7MKH9Qc/wvrJDd4K4xTbkWWYgAql7bgmJTHpW2GzGCAaowggG
# mAgEDgBSRRlKjvVHBRCYBmIifXEWr8FOhhzALBglghkgBZQMEAgGgazAaBgkqhk # mAgEDgBSRRlKjvVHBRCYBmIifXEWr8FOhhzALBglghkgBZQMEAgGgazAaBgkqhk
# iG9w0BCQMxDQYLKoZIhvcNAQkQAS8wHAYJKoZIhvcNAQkFMQ8XDTI1MTIwNDEzN # iG9w0BCQMxDQYLKoZIhvcNAQkQATkwHAYJKoZIhvcNAQkFMQ8XDTI2MDUwNzIxM
# DgxMVowLwYJKoZIhvcNAQkEMSIEIGMBdMKw5mjZYL9qP4ivwgMt8g2+qEO0+Dcn # jI0OVowLwYJKoZIhvcNAQkEMSIEIGMBdMKw5mjZYL9qP4ivwgMt8g2+qEO0+Dcn
# N5vQO1bNMA0GCSqGSIb3DQEBAQUABIIBABRER8F8BATarhuti2Zkqv6sxEgV6Kb # N5vQO1bNMA0GCSqGSIb3DQEBAQUABIIBAKzRicWBpSyN5nw39eDNfVai2H1mO0n
# Xjd5NCHiumoD57flhRf68BmdR5agZDq7whq68MpRXxPwwRHWGSCKUXoIOo5O4VX # APgZUmVF/vgSCWtR0da1iZots4qwn0XwvvIgu5eZ7edhn9axLXhjTAOQajT4cOw
# 1xKwAlu8t8Wpx+P+wGmIi1nDuFSPNSHtgw1cMGNSwCYfDzkn18pBB6qKCWyS0Ea # 9+raD7+SYdBIAUgZpuFy3Olnu4HykCd8Ub44lPfZVG1lF1LeN248+rWgozpE7xz
# tTIBp/oqvlUHHOyN4bFsvdbyahEQ5JGmF9yZaSZ8LV73B+X5VbpkjpQP+SL9Lpu # Dv5G83OslbvVzGXaVShJM4fsDfpkpKoQ4LszlBeqguU2yTm3XWVjkxH7VJvTtIT
# mh41Jg2BrPyvnWgJakE2S0G3U/b9dujknHM5JpuQP8fX4guziTVu+3LoF0sD6ux # SzO3jAqwqnCjfu3mnxCoz7LKES4DPZERsFoJv1zyDdHIXjPnfZuTBjjCOubjaQx
# rd3g39IKaRz/hukUI02tMLI0ZpNp4Kjc/ObD4tcwvg2bmOjHF953M5EWGYZE= # rRwgZtQ8Ljz3gpz1VzL9mKAv0pUzcyxtQfakHwdYtxyO33z2InljtTFJCroI=
# End Signature: 192.0.2.0 - 192.0.2.255 # End Signature: 192.0.2.0 - 192.0.2.255
Acknowledgments Acknowledgments
Thanks to the authors of [RFC8805] and [RFC9632] and the folk they Thanks to the authors of [RFC8805] and [RFC9632] and the folk they
acknowledge from whom ideas and text have been liberally acknowledge from whom ideas and text have been liberally
expropriated. Thanks to John R. Levine for providing useful feedback expropriated. Thanks to John R. Levine for providing useful feedback
on the document. on the document.
Authors' Addresses Authors' Addresses
 End of changes. 19 change blocks. 
100 lines changed or deleted 95 lines changed or added

This html diff was produced by rfcdiff 1.48.