ASPA

Stands for: Autonomous System Provider Authorization

A signed RPKI object in which an AS names its transit providers, so that routers can check an AS path for leaks.

Autonomous System Provider Authorization is still work in progress: on 19 October 2026 its profile and verification documents were IETF Internet-Drafts, revision 29, and no ASPA RFC existed. It targets what origin validation cannot see, a route with the right origin on the wrong path.

The profile draft defines an ASPA as a digitally signed object through which the holder of an AS number authorises one or more other ASes as its transit providers. The verification draft uses those objects to check a route's AS_PATH, adding means to detect and mitigate route leaks and AS_PATH manipulations. The objects are published in the global Resource Public Key Infrastructure (RPKI), the system that also holds ROAs.

The status, as the IETF datatracker showed it on 19 October 2026: draft-ietf-sidrops-aspa-verification-29 of 16 October 2026 and draft-ietf-sidrops-aspa-profile-29 of 29 July 2026, both at WG Consensus: Waiting for Write-Up, with the IESG state I-D Exists. The RFC index of 16 October 2026 lists no ASPA RFC. The profile draft itself reports roughly 2,400 ASPA objects published as of July 2026, a figure from the draft rather than from a measurement.

Expectations are cautious. The US roadmap of September 2024 said the ASPA standards were nearing completion. Cloudflare, writing after the 1.1.1.1 incident of 27 June 2024, in which the leaked route was RPKI Valid, called ASPA a long-term effort that depends on networks, especially large providers, rejecting invalid AS paths based on ASPA objects.

Also known as: autonomous system provider authorization, aspa object, aspa verification, as_path verification, aspa validation

Sources

← All glossary entries