RPKI

networkingsecurity

Stands for: Resource Public Key Infrastructure

A system of signed records that lets routers check whether a network is allowed to announce a given address block.

Resource Public Key Infrastructure (RFC 6480) attaches cryptographic proof of who may originate which prefixes, so a router can reject bogus BGP announcements. It is the main defence against route hijacks, accidental or malicious.

Resource Public Key Infrastructure lets an address holder publish a signed statement of which autonomous system is authorized to originate their prefixes, so a router can reject an announcement that contradicts it. It is the first meaningful defence against the routing hijacks that BGP's trust model otherwise permits.

Its limits are worth stating precisely. Origin validation confirms who announced a prefix, not that the path is genuine, so a hijack that forges a plausible path can still succeed; path validation is a separate and much less deployed problem. Adoption is also uneven, and a route object only protects you where the receiving network actually checks. It is a real improvement and not a solution, which is the honest description of most incremental security in a system nobody can redesign.

Also known as: rpki, route origin validation, roa

← All glossary entries