This document provides information on resource public key infrastructure (RPKI) and route origin authorization (ROA). It discusses problems with relying solely on Internet routing registries (IRRs), and how RPKI addresses these issues by tying IP addresses and autonomous system numbers (ASNs) to public keys. It describes the RPKI certificate structure and chain of trust, as well as the roles of signing ROAs, validating others, hosted RPKI systems, and relying parties. Examples of incidents from inaccurate or incomplete IRR data are given. The status of major transit and cloud providers in supporting RPKI is listed.

1. Name | Date | Event
Presentation Subtitle
Presentation Title

2. Section Title
Section subtitle

3. 3

4. 4
RIRs are responsible for:
• Keeping the registry up to date, correct,
and secur
e
• Using hierarchical allocation
s
• Maintaining neutrality towards all
members

5. Section Title
Section subtitle

6. 6
Internet building blocks
ASN (Autonomous System Number)

7. 7
ASN (Autonomous System Number)
Internet building blocks
ASN Addresses Interconnect
Autonomous System

8. RPKI Webinar 8
Routing on the Internet
“BGP protocol”
Can I
trust B?
Routing table
194.x.x.x = B
Routing table
193.x.x.x = A
Is A
correct?
A
193.x.x.x
B
194.x.x.x
B: “I have 194.x.x.x”
A: “I have 193.x.x.x”

9. 9
Route Propagation
AS15 AS756
R1
AS33
AS164
66.2.9.0/24
M
ED=700
MED=500
LP=100
LP=50
AS25 AS5
R2
LP=40
tra
ffi
c
route

10. RPKI Webinar 10
Accidents Happen
• Fat Fingers
- 2 and 3 are really close on our keyboards….
• Policy Violations (leaks)
- Oops, we did not want this to go on the public Internet
- Infamous incident with Pakistan Telecom and YouTube

11. RPKI Webinar 11
Incidents Are Common
• 2019 Routing Security Review
- 12,600 incidents
- 4,4% of all ASNs affected
- 3,000 ASNs are victims of at least one incident
- 1,300 ASNs caused at least one incident
Source: https://bgpstream.com

12. RPKI Webinar 12
Routing on the Internet
Can I
trust B?
Routing table
194.x.x.x = B
Routing table
193.x.x.x = A
Is A
correct?
A
193.x.x.x
B
194.x.x.x
B: “I have 194.x.x.x”
A: “I have 193.x.x.x”
“Internet Routing Registry”

13. BGP Operations and Security 13
Problem Statement
• Some IRR data can not be fully trusted
- Accuracy
- Incomplete data
- Lack of maintenance
• Not every RIR has an IRR
- Third party databases need to be used
- No verification of who holds IPs/ASNs

14. •
Problem Statement
14

15. Section Title
Section subtitle

16. BGP Operations and Security 16
Resource Public Key Infrastructure
• Ties IP addresses and ASNs to public keys
• Follows the hierarchy of the registries
• Authorised statements from resource holders
- “ASN X is authorised to announce my Prefix Y”
- Signed, holder of Y

17. BGP Operations and Security 17
RPKI Certificate Structure
Member Member Member
ROA ROA ROA
Certificate hierarchy follows allocation hierarchy
ARIN APNIC RIPE LACNIC AFRINIC

18. BGP Operations and Security 18
RPKI Chain of Trust
ALL Resources
LIR’s Resources
Root’s private key signature
signature
public key
public key

19. BGP Operations and Security 19
Two elements of RPKI
Signing
Create your ROAs
Validating
Verifying others

20. BGP Operations and Security 20
RPKI Chain of Trust
LIR’s Resources
signature
public key
ALL Resources
signature
public key
ROA
signature

21. BGP Operations and Security 21
Hosted RPKI
• RIR hosts a CA and signs all ROAs
• Automate signing and key rollovers
• Allows you focus on creating and publishing
ROAs

22. BGP Operations and Security 22
Route Origin Authorisation
Prefix
is authorised to be announced by
AS Number
LIR’s private key
ROA
signature

23. Presenter name | Event | Date 23
• Source: https://stat.ripe.net/NL#tabId=routing

24. Presenter name | Event | Date 24
• Source: https://stat.ripe.net/NL#tabId=routing

25. BGP Operations and Security 25
Hosted or Delegated RPKI
RIPE
ROA ROA
ROA ROA
ROA
Member Member Member
ROA
Member-X CA Member-Y CA
RIPE NCC Hosted System

26. Section Title
Section subtitle

27. BGP Operations and Security 27
Two elements of RPKI
Signing
Create your ROAs
Validating
Verifying others

28. BGP Operations and Security 28
Trust Anchor Locator (TAL)
RIPE NCC ARIN APNIC AFRINIC
LACNIC
Validator
Repository Repository Repository Repository Repository
• Location of RIR repositories
• Root’s public key
TAL TAL TAL TAL
List of ROAs
Cerfificates

29. BGP Operations and Security 29
Relying Party
RIPE NCC ARIN APNIC AFRINIC
LACNIC
Validator
Repository Repository Repository Repository Repository
List of ROAs
Cerfificates

30. BGP Operations and Security 30
Relying Party
ROA
AS111 10.0.8.0/22
AS222 10.0.6.0/24
AS333 10.4.16.0/20
AS111 10.0.12.0/22
AS111 10.0.16.0/22
AS111 10.0.20.0/22
BGP Announcements
BETTER ROUTING DECISIONS

31. RPKI Webinar 31
Routing on the Internet
Is A
correct?
A
192.0.2.0/24
B
193.0.24.0/21
A: “I have 192.0.2.0/24”
1. Create route
authorisation record
(ROA)
2. Validate route
RPKI Repository
A is authorised
to announce
192.0.2.0/24
BGP

32. Status of Transit and Cloud
32
Name Type Details Status
Telia Transit Signed & Filtering Safe
Cogent Transit Signed & Filtering Safe
GTT Transit Signed & Filtering Safe
NTT Transit Signed & Filtering Safe
Hurricane Electric Transit Signed & Filtering Safe
Tata Transit Signed & Filtering Safe
PCCW Transit Signed & Filtering Safe
RETN Transit Partially Signed &
Filtering
Safe
Cloud
fl
are Cloud Signed & Filtering Safe
Amazon Cloud Signed & Filtering Safe
Net
fl
ix Cloud Signed & Filtering Safe
Wikimedia
Foundation
Cloud Signed & Filtering Safe
Scaleway Cloud Signed & Filtering Safe
• Source: isbgpsafeyet.com

33. Presenter name | Event | Date 33
What We’re Working On
• Repository Resiliency: Cloud
• Security: Audit Framework, different security
assessments
• Improving Q&A
• Reporting on our findings
• Doing RPKI ourselves!

34. Questions