This document discusses RPKI (Resource Public Key Infrastructure) for securing Internet routing. It provides statistics on RPKI adoption in Luxembourg and neighboring countries, showing that while Luxembourg has over 65% of its address space covered by ROAs, not all networks have fully implemented RPKI. The goal is 100% RPKI implementation to validate all routes and prevent route hijacking, but obstacles still exist to full deployment. The presenter's contact information is provided for any questions.

1. RPKI for Secure Routing
Brief introduction and some statistics
Presentation
Gerardo Viviers - RIPE NCC

2. About Routing Security
Brief Intro to RPKI

3. Hey! You!
Ok! I’ll add it to
my routes…
BGP is Naive…
3
I have the network Y
Hi! What’s up?
‘Cause I trust you,
stranger!

4. • Typing errors
- Also known as “fat
fi
ngers”
- 2 and 3 are really close on our keyboards…
• Routing policy violations
- Leaks,
fi
ltering miscon
fi
gurations
- “We didn’t mean this to go to the public Internet”
• Malicious attacks
- Route manipulation, BGP hijack, BGP DDOS
Routing Incidents
4

5. If Only We Could Do Something…
5

6. • Filter Routes based on:
- Best practices
- Internet Routing Registry
- RPKI
• All recommendations from MANRS
You Can Do Something!
6

7. RPKI System
7
External
Repositories
RIPE NCC ARIN APNIC
Validator
RPKI Repositories
Validated Cache
rsync/RRDP
RPKI-RTR
LACNIC AFRINIC
ROAs

8. Routing Security using RPKI
8
RPKI repository
ASN K is authorised
to announce
pre
fi
x Y
RIRs
Trust Anchors
I have the
network Y
K
I have the
network Y
X

9. RPKI Bene
fi
ts
9
Proof of origin
Cryptographic
identity veri
fi
cation
Route hijacking
prevention

10. • If we compare ROAs and route(6) objects…
- What percent of pre
fi
xes is in the IRR?
- How many are covered by ROAs?
• IRR is not maintained very well
• RPKI has advantage of all
fi
ve RIRs supporting it
RPKI versus IRR?
10

11. Statistics
To Understand Better

12. ASNs: 86
IPv4: 1313
IPv6: 186
Routing Statistics Luxembourg
12
Source: RIPEstat

13. RPKI in Luxembourg
13
ROA Coverage

14. Neighbour countries comparison
14
% of IPv4 covered by ROAs
Amount of IPv4 address space

15. • Creating ROAs is only half the job…
• Comparing against BGP is the other half!
• This is what ROV is all about
• You decide what to do with the announcements
What about Route Origin Validation?
15

16. World Stats on ROV
16
Source: APNIC

17. Regional Stats on ROV
17
Country RPKI Validates
Netherlands (NL) 71.95%
Luxembourg (LU) 65.96%
Switzerland (CH) 63.84%
France (FR) 56.59%
Belgium (BE) 22.49%
Germany (DE) 5.90% Source: APNIC
DE
LU
NL
BE
FR
CH

18. • Address space is being covered by ROAs
• But not all address space…
• Why not? What are the obstacles?
• The goal is to have 100% implementation
of RPKI in every network
• End result should be a more secure Internet
Few ROAs, Many ROVs
18

19. Questions
19
gviviers@ripe.net