What is RPKI, and how does route origin validation work?
Show the answer
Say this first
RPKI is a certificate system rooted at the five RIRs. The holder of address space signs a Route Origin Authorization (ROA), for example "AS 64500 may originate 203.0.113.0/24, up to length /24". Validator software fetches and checks the ROAs and feeds the results to routers over the RTR protocol. Each BGP route then gets a state: Valid (a ROA covers it and origin and length match), Invalid (covered, but wrong origin or too specific) or NotFound (no ROA covers it). The common policy is drop Invalid and accept the rest. It checks the origin AS only, not the path.
Go deeper
Moving parts
- ROA: created in the RIR portal by the address holder.
- Validator (relying party): Routinator, rpki-client, FORT and others download the repositories and verify signatures.
- RTR (RFC 8210): routers pull the validated list from the validator.
- Router policy: what to do with each state.
IOS-XE example
router bgp 64500
bgp rpki server tcp 10.10.0.50 port 3323 refresh 600
neighbor 192.0.2.1 route-map ISP1-IN in
!
route-map ISP1-IN deny 5
match rpki invalid
route-map ISP1-IN permit 10
set local-preference 200Port 3323 is the RTR port Routinator uses by default. Some releases also factor validation state into best path
by themselves; an explicit deny makes the intent obvious. Check the session with show ip bgp rpki servers.
The maxLength trap
If your ROA says max length /24 and you announce the /24, a hijacker's /25 is Invalid. If the ROA allowed /25 while you only announce the /24, an attacker can announce a /25 with your AS as the forged origin and it shows Valid. RFC 9319 recommends ROAs that match exactly what you announce.
They will ask next
Which attacks does origin validation not stop?
A forged origin (the attacker puts your AS at the end of its fake path) and route leaks, where the origin is correct but the path is not. BGPsec (RFC 8205) is barely deployed; ASPA, which lets an AS publish its providers, is being standardised for leak detection.
What if all validators go down?
Routers keep the last data for a while, then routes fall back to NotFound and are accepted. It fails open, which is the right default, but run at least two validators.
Traps
- Saying RPKI encrypts or signs BGP updates. It only lets routers check the origin AS against signed data.
- Assuming every Invalid route is an attack. Many are stale ROAs after a customer moved providers.