What is RPKI?
RPKI is a public key infrastructure that cryptographically proves which AS may originate a prefix in BGP and helps operators drop invalid, hijacked routes.
Last updated:
RPKI (Resource Public Key Infrastructure) is a public key cryptography system. It lets the holder of internet resources (IP addresses and AS numbers) verifiably state which autonomous system is allowed to originate a given prefix in BGP. With it, operators can distinguish legitimate announcements from forged ones and reduce the impact of route hijacking, which for years was one of the main weaknesses of global routing.
ROA: Route Origin Authorization
The core RPKI object is the ROA (Route Origin Authorization), a digitally signed record in which the prefix holder declares which AS number may originate that prefix and the maximum prefix length allowed (maxLength). A ROA is created in a regional registry (RIR) such as RIPE NCC, ARIN, or APNIC, using a certificate tied to the allocated resources. The certificate chain leads back to the RIR trust anchor, so any operator can independently verify that the record is authentic.
A single ROA can cover multiple prefixes and multiple AS numbers, but each prefix-AS pairing is evaluated separately during validation. The absence of a ROA for a prefix does not mean the announcement is bad, only that it cannot be verified.
Route Origin Validation: valid, invalid, unknown
The mechanism that uses ROAs to assess BGP routes is called ROV (Route Origin Validation). A router or a dedicated validator compares the announced prefix and its origin AS against the available set of ROAs, then assigns one of three states.
- Valid: a ROA exists whose origin AS and prefix length match the announcement.
- Invalid: a ROA exists for the prefix, but the origin AS differs or the prefix is longer than maxLength. This signals a hijack or misconfiguration.
- Unknown (NotFound): no ROA covers the prefix, so its correctness cannot be decided.
Relationship to BGP and MANRS, and practical steps
RPKI does not replace BGP; it complements it. It protects against origin hijacks, where another AS unlawfully announces someone else's prefix. It does not secure the whole AS path against manipulation, which is the job of separate mechanisms such as ASPA. Deploying RPKI is one of the pillars of the MANRS initiative, which promotes good routing practices. In practice an operator should take two parallel actions.
- Origination side: create ROAs for all of your own prefixes, setting the correct AS and a sensible maxLength to avoid accidentally creating invalid states.
- Filtering side: run an RPKI validator (such as Routinator, FORT, or rpki-client) and configure routers to reject routes marked invalid while accepting valid and unknown.
This approach, known as drop invalids, protects both your own prefixes and the traffic your network forwards. Continuous monitoring of ROA status and validator health is essential, because an expired certificate or an incorrect maxLength can unexpectedly invalidate your own routes.
Frequently asked questions
Does RPKI protect the entire AS path in BGP?
No. RPKI with ROAs only protects the origin of a prefix, meaning which AS may announce it. Securing the full AS path is handled by separate mechanisms such as ASPA.
What does an invalid state mean, and is it always an attack?
Invalid means a ROA exists but the origin AS or prefix length does not match. It can indicate a hijack, but more often it results from a misconfiguration or a poorly set maxLength.
Is dropping invalid routes safe?
Yes, dropping invalids is the recommended practice, but it requires that you first create correct ROAs for your own prefixes so you do not invalidate them, and that you monitor the validator.
How does RPKI relate to MANRS?
Publishing ROAs and filtering invalid routes is one of the key actions recommended by the MANRS initiative, which promotes shared good practices for routing security.