What Is RPKI? BGP Route Origin Validation
RPKI (Resource Public Key Infrastructure) is a cryptographic framework that adds security to BGP routing. It allows network operators to create signed certificates (Route Origin Authorizations, or ROAs) that prove which ASN is authorized to announce specific IP prefixes, preventing BGP hijacking attacks.
Cómo Funciona
RPKI uses a hierarchical PKI structure rooted in the five Regional Internet Registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC). Each RIR issues certificates for IP address holders. Operators create ROAs that specify: which prefix they hold, the authorized origin ASN, and the maximum prefix length. BGP routers with RPKI-enabled validators check each received route against the ROA database and mark routes as Valid, Invalid, or NotFound. Invalid routes are typically rejected.
Por Qué Importa
Without RPKI, any ASN can announce any IP prefix. This has led to notable BGP hijacks — including a 2018 incident where a Pakistan Telecom route leaked caused YouTube to be unreachable globally, and incidents where traffic was routed through Russian state networks. RPKI prevents these attacks by making unauthorized route origins cryptographically detectable.
Problemas Comunes
- ROA misconfiguration causing own prefixes to become Invalid
- ROA maximum prefix length too restrictive (blocking legitimate /24 announcements from a /22 ROA)
- RPKI validator outdated, using stale ROA data
- Operators not creating ROAs, leaving prefixes as NotFound
- Incorrect ASN in ROA causing valid routes to fail validation