IETF drafts shrink RPKI storage by 90% with canonical cache

Volunteer-run RPKI archives have struggled to keep pace with the growth of autonomous systems issuing Route Origin Authorization objects. A new pair of IETF drafts now offers a solution that slashes storage requirements without compromising cryptographic validation or historical fidelity.

What the drafts propose

The Canonical Cache Representation (CCR) and RPKI Spool drafts define a binary encoding and compression pipeline for RPKI-validated objects. Instead of storing each cryptographically signed object individually, the system aggregates them into a single tar archive, encodes the payloads in ASN.1, and applies zstd compression. A Merkle tree maintains a compact hash state that allows recipients to verify the integrity of the entire archive without decompressing it.

Job Snijders, one of the draft authors, noted in an APNIC podcast that the approach was born from necessity. His personal RPKI archive, which began as a manageable side project, became unsustainable as the number of ROA producers grew from hundreds to tens of thousands. The new format reduces storage overhead by up to 90% while preserving the ability to reconstruct the exact state of the RPKI repository at any historical moment.

Why the change matters

The storage savings are not merely academic. Public RPKI repositories now contain millions of objects, and each must be re-signed and re-published every few hours to maintain cryptographic freshness. This churn generates terabytes of data annually, much of which is redundant. The new encoding reduces the size of each snapshot by an order of magnitude, making it feasible for researchers, network operators, and regulators to maintain long-term archives without resorting to cloud-scale infrastructure.

Distribution efficiency also improves. The compressed archives can be transferred over standard HTTP or rsync, and the Merkle tree allows recipients to verify the integrity of the entire dataset with a single hash comparison. This is particularly valuable for operators who need to mirror the global RPKI state but lack the resources to process the full, uncompressed feed.

What to watch

The drafts are currently in the IETF standards track, with implementations already available in open-source RPKI tooling. If adopted widely, the new format could enable a new class of historical analysis tools that track routing security trends over time. Operators should monitor the progress of the drafts and plan for integration into their RPKI validation pipelines once the standards are finalized.