What Is RPKI? BGP Route Security Explained

It helps answer an important routing question:

“Is this ASN authorized to announce this IP network?”

RPKI does not replace BGP.

Instead, it provides cryptographically verifiable information that networks can use when evaluating BGP route announcements.

What Does RPKI Stand For?

RPKI stands for:

Resource Public Key Infrastructure

It is designed to improve routing security around Internet number resources, including IPv4 and IPv6 prefixes.

The system uses digital certificates connected to Internet number-resource ownership and authorization.

Why Does BGP Need Additional Security?

BGP was designed around trust between networks.

Traditionally, if a network announced:

“I can reach this IP prefix,”

other networks had limited built-in ability to verify whether that network was actually authorized to originate it.

This creates several risks.

RPKI helps provide additional validation around route origination.

What Is a ROA?

ROA stands for:

Route Origin Authorization

A ROA specifies which ASN is authorized to originate a particular IP prefix.

For example, a ROA might effectively state:

That gives networks using RPKI validation a way to check whether a BGP announcement matches the published authorization.

RPKI Valid, Invalid and Not Found

Route Origin Validation commonly places BGP routes into three broad states.

What Does RPKI Valid Mean?

An RPKI Valid route means that the BGP origin matches the authorization represented by the ROA.

This gives receiving networks additional confidence that the origin ASN is authorized to advertise the prefix.

It does not guarantee that:

• The network is secure
• The traffic is legitimate
• The IP reputation is good
• The entire BGP path is correct

RPKI specifically helps validate route origin authorization.

What Does RPKI Invalid Mean?

An RPKI Invalid route indicates a mismatch between the BGP announcement and the published ROA information.

This may indicate:

• A configuration error
• An outdated ROA
• The wrong ASN originating the prefix
• An unauthorized announcement
• An incorrect maximum prefix length

Many networks may reject or deprioritize RPKI Invalid routes according to their routing policies.

That makes accurate RPKI configuration increasingly important.

What Is Maximum Length in a ROA?

A ROA can authorize not only an originating ASN but also the maximum prefix length that ASN is allowed to advertise.

For example:

could authorize the ASN to advertise:

192.0.2.0/23

or valid /24 more-specifics within that block.

Incorrect maximum-length configuration can cause otherwise legitimate announcements to become RPKI Invalid.

RPKI and BGP

BGP distributes the route.

RPKI helps validate whether the origin ASN is authorized.

Learn more about BGP.

The two technologies work together but perform different functions.

BGP answers:

“How can I reach this network?”

RPKI helps answer:

“Is this origin authorized?”

RPKI and ASNs

Because ROAs identify the ASN authorized to originate a prefix, ASNs are a fundamental part of RPKI.

Learn more about ASNs.

If the authorized originating ASN changes, the associated ROA may also need to be updated.

RPKI and IPv4 Leasing

RPKI can become particularly important when IPv4 resources are leased or routed through another organization’s network.

The parties need to understand:

• Who will originate the prefix
• Which ASN will appear as the BGP origin
• Who controls the relevant registry resources
• Whether a ROA exists
• Whether the ROA must be changed
• Whether more-specific announcements are allowed

These details should be resolved before the route is placed into production.

Why Managed IPv4 Deployments Can Simplify Routing

One approach is to keep the IPv4 resources originated within the provider’s existing network.

In that scenario, the customer uses the addresses within a managed infrastructure environment rather than independently originating the prefix.

This can reduce some of the complexity involving:

• LOAs
• Customer ASN changes
• Route origin changes
• RPKI modifications
• Upstream coordination

The correct design depends upon the customer’s technical requirements.

Is RPKI the Same as an LOA?

No.

An LOA, or Letter of Authorization, is generally a document used to authorize another party to perform certain routing or network actions.

RPKI uses cryptographically verifiable resource authorization.

They may both appear in routing-related workflows, but they are not the same thing.

Does RPKI Prevent All BGP Hijacking?

No.

RPKI significantly improves origin validation, but it does not solve every routing-security problem.

It primarily verifies whether the originating ASN is authorized.

It does not validate the entire AS path in traditional Route Origin Validation.

Network security therefore still requires:

• Route filtering
• Monitoring
• Proper BGP configuration
• Prefix controls
• Upstream coordination
• Routing policies

Why Businesses Should Care About RPKI

If your organization operates dedicated public IP resources, routing mistakes can affect availability.

An invalid route could lead some networks to reject your prefix.

Proper RPKI configuration can improve route-origin security and reduce the likelihood that unauthorized origin announcements are accepted.

RPKI and Network Reputation Are Different

RPKI validates routing authorization.

IP reputation evaluates behavior associated with an address or network.

They solve different problems.

An IP can be:

RPKI Valid

but have poor reputation.

Or:

RPKI Not Found

while having excellent reputation.

Learn more about IP reputation.

Businesses should consider both routing security and address reputation.

Managed BGP and RPKI

Organizations operating their own routing infrastructure should coordinate BGP and RPKI carefully.

NetWest can evaluate qualified network deployments requiring:

• Prefix origination
• BGP configuration
• ASN integration
• Route policy
• RPKI coordination
• Route monitoring
• Failover design
• Network troubleshooting

Learn more about Managed BGP.