What is RRDP?

RRDP (RPKI Repository Delta Protocol) is the HTTPS-based protocol RPKI validators use to download repositories, fetching only what has changed.

RPKI data, certificates, ROAs, manifests and revocation lists, is published by the RIRs and by organisations that run their own certificate authorities, each in its own repository. Validators must fetch all of these regularly. RRDP, defined in RFC 8182, organises a repository around a small notification file that states a session ID and the current serial number, and points to:

• a snapshot, containing every object in the repository;
• a series of deltas, each containing the objects published or withdrawn since the previous serial.

A validator that already holds serial 1200 and sees the repository is now at 1203 fetches just three small deltas; one that is new, or has fallen too far behind, fetches the snapshot. Each referenced file is listed with a hash so the validator can check it received what the notification described.

Before RRDP, repositories were fetched with rsync, which is harder to scale and to put behind ordinary HTTPS caching and content delivery networks. RRDP is now the preferred transport in validators such as Routinator and rpki-client, with rsync kept as a fallback. It's worth knowing that the security of RPKI does not rest on the transport: validators still check every object's signature back to a trust anchor, so a tampered file is rejected whichever protocol delivered it. Problems with a single repository, such as a slow or unreachable server, usually show up as a validator warning and missing VRPs for that publisher rather than a total failure. See RPKI and TAL; the RPKI and Route Origin Validation lesson covers validators and how their output reaches routers.