BGPsec

A BGP extension in which every AS on the path signs the route announcement, so the AS path itself can be verified.

BGPsec (RFC 8205, September 2017) is the path-validation layer meant to supplement RPKI origin validation, which checks only who originated a prefix. The reader meets it in routing-security discussions as a finished standard that, in 2024, the US government found not yet implemented by commercial router vendors.

It works through an optional non-transitive path attribute that carries digital signatures produced by each AS that propagates the UPDATE. The assurance is that every AS listed has explicitly authorised the advertisement of the route to the next AS in the path. RFC 8205 presents it as a supplement to origin validation; used together, the two are meant to prevent a wide variety of route hijacking attacks.

Partial deployment is the hard part. If an AS on the path does not support BGPsec, the signed UPDATE is converted to an unsigned one before it is forwarded to that AS, and the assurance for that path is lost; RFC 8207 describes the result as islands of assured paths. It also protects the control plane only: it does not guarantee that data packets follow the indicated path.

Deployment is where it stops. In 2015 BCP 194 still called it ongoing work that could not be implemented. The Office of the National Cyber Director's roadmap of September 2024 says the standards were completed in 2017 and prototype reference implementations exist, but the standard has yet to be implemented by commercial router vendors, and it names two barriers: it changes the format of BGP messages, and it typically requires routers to process signatures.

Also known as: bgp-sec, bgpsec protocol, bgp path validation, as path signing

Sources

← All glossary entries