RPKI is Coming of Age

Abstract

Despite its critical role in Internet connectivity, the Border Gateway Protocol (BGP) remains highly vulnerable to attacks such as prefix hijacking, where an Autonomous System (AS) announces routes for IP space it does not control. To address this issue, the Resource Public Key Infrastructure (RPKI) was developed starting in 2008, with deployment beginning in 2011. This paper performs the first comprehensive, longitudinal study of the deployment, coverage, and quality of RPKI. We use a unique dataset containing all RPKI Route Origin Authorizations (ROAs) from the moment RPKI was first deployed, more than 8 years ago. We combine this dataset with BGP announcements from more than 3,300 BGP collectors worldwide. Our analysis shows the after a gradual start, RPKI has seen a rapid increase in adoption over the past two years. We also show that although misconfigurations were rampant when RPKI was first deployed (causing many announcements to appear as invalid) they are quite rare today. We develop a taxonomy of invalid RPKI announcements, then quantify their prevalence. We further identify suspicious announcements indicative of prefix hijacking and present case studies of likely hijacks. Overall, we conclude that while misconfigurations still do occur, RPKI is "ready for the big screen," and routing security can be increased by dropping invalid announcements. To foster reproducibility and further studies, we release all RPKI data and the tools we used to analyze it into the public domain.

IRRedicator: Pruning IRR with RPKI-Valid BGP Insights

“…Despite its strong attestation, however, it has not been widely deployed yet due to the negative impact of misissued ROA, the certificate dependencies in the hierarchy of RPKI [27], [29], and its incapability of route-leak protection. Also, RPKI depends on the Public Key Infrastructure (PKI) managed by RIRs, the quality of RPKI deployment and its management is significantly different across the RIRs; for example, we found that on March 1st, 2023, 59.2% of IP prefixes in RIPE NCC, the European RIR, were covered by ROA objects, while only 23.9% of IP prefixes in AFRINIC, the RIR for Africa, were done ( §III), consistent with findings reported in 2019 [17]. Because of this limitation, Mutually Agreed Norms for Routing Security (MANRS) recommends the use of both IRR and RPKI [60].…”

“…We find that the number of BGP announcements and the number of covered BGP announcements increased on those dates, but the number of valid BGP announcements was almost the same as the other days. We also find that AS37468, operated by Angola Cables, made more than 176K BGP announcements on July 19th, 2018, which it did not announce for the four weeks around that day, which aligns with the report in [17].…”

“…The first reason involves mislabeled Route objects resulting from errors in the configuration of the MaxLength attribute in the corresponding ROA objects, as reported in [17]. For instance, a Route object covered by a ROA object with a valid origin AS may be incorrectly labeled as invalid due to a misconfigured MaxLength attribute.…”

“…C. Efforts to build a PKI for BGP RPKI [37] was introduced in 2008 but has been deployed slowly. Chung et al [17] reported that the deployment is growing, but also there are deployment disparities across the RIRs. To tackle the low deployment problem, Hlavacek et al proposes a method to register ROAs automatically [29] to encourage network operators.…”

Understanding Route Origin Validation Deployment in the Real World and Why MANRS Action 1 Is Not Followed

“…Since many IP spaces are not covered in ROA records, ROV may identify the validation result of an illegitimate BGP announcement as "unknown" and thus improperly accepts it. What's worse, it is also frequently observed that ROV may mistakenly discard legitimate BGP announcements due to incomplete or misconfigured ROA records [49], [48]. Therefore, to improve the accuracy and effectiveness of ROV, it is necessary to increase the deployment rate of ROA.…”