Routing Security & RPKI
The internet's biggest vulnerability is that it operates on blind trust. RPKI brings cryptography to BGP, allowing networks to verify if a route is legitimate.
The State of RPKI Adoption
Resource Public Key Infrastructure (RPKI) uses cryptographic certificates to link an IP address block to its rightful Autonomous System Number (ASN). This creates a Route Origin Authorization (ROA).
If a network (like a Tier 1 transit provider) enables Route Origin Validation (ROV), they will drop any BGP announcement that conflicts with the cryptographic ROA, effectively stopping BGP hijacks before they spread.
| Region (RIR) | ROA Creation % (Valid IP Space) | Notes |
|---|---|---|
| RIPE NCC (Europe) | ~65% | Leading global adoption, driven by strict regional policies. |
| APNIC (Asia Pacific) | ~45% | Strong adoption in Japan and ANZ, lagging in emerging markets. |
| ARIN (North America) | ~35% | Historically slow due to legacy legal agreements, but accelerating. |
| LACNIC (Latin America) | ~40% | Steady growth, driven by IXP mandates. |
Tool: RPKI Validation State Simulator
Simulate how a router processes a BGP announcement against an RPKI ROA database.
Common Mistakes in RPKI Deployment
- Signing but not validating: Creating ROAs protects your space from being hijacked by others (if others are dropping invalids). However, to protect your network's outbound traffic from being routed maliciously, you must actually drop "Invalid" routes at your own BGP edge routers.
- Misconfiguring max-length: Allowing a max-length of /24 on a /16 block makes you highly vulnerable to forge-origin attacks.
FAQ
Why isn't RPKI adoption 100%?
Fear of dropping traffic. If a network misconfigures their ROA, and a transit provider drops invalids, that network vanishes from the internet. The economic penalty for a self-inflicted outage often outweighs the perceived risk of a BGP hijack.