Skip to main content

RPKI

RPKI (Resource Public Key Infrastructure) is a security framework designed to improve the integrity and trustworthiness of Internet routing. It helps network operators ensure that routing announcements for IP addresses and Autonomous System Numbers (ASNs) are valid and authorised by the rightful resource holder.

RPKI proves the association between specific IP address blocks or ASNs and the holders of those Internet number resources. The certificates are proof of the resource holder's right of use of their resources and can be validated cryptographically.

RPKI was developed to address one of the Internet’s key vulnerabilities: the possibility of incorrect or malicious routing announcements, such as route hijacking or route leaks, which can lead to traffic interception, outages, or other security issues.

RPKI and the RIPE NCC

The RIPE NCC plays a key role in supporting RPKI:

  • Issuing Certificates:
    • The RIPE NCC issues cryptographic certificates for Internet resources in its service region.
  • Hosted RPKI:
    • The RIPE NCC provides a free hosted RPKI service for members to create and manage ROAs easily through the LIR Portal.
  • Training and Support:
    • The RIPE NCC offers training courses, webinars, and documentation to help network operators implement RPKI effectively.

Benefits of RPKI

  • Verified Resource Ownership:
    RPKI ensures that routing information matches verified delegated resources, providing resource holders with proof of ownership for their IP addresses or ASNs.
  • Proof of Holdership:
    Resource holders can demonstrate their legitimate ownership when distributing resources to customers or end users.
  • Protection with Digital Signatures:
    Resource users can safeguard information related to their delegated resources using digital signatures. Any attempt to alter this information will invalidate the signature.
  • Secure Resource Association:
    Only resource holders with a properly delegated right to use specific resources can generate valid digital signatures, securely linking Internet number resources to their ownership.

How RPKI works

RPKI uses cryptographic certificates to verify the ownership of Internet resources and to validate routing announcements.

Certificates:

  • The RIPE NCC issues digital certificates to resource holders (e.g., IP address blocks or ASNs).
  • These certificates prove that the resource holder is authorised to use the resources.

Route Origin Authorizations (ROAs):

  • Resource holders can create ROAs, which specify which ASNs are authorised to announce their IP prefixes.
  • For example, a ROA might say, "IP prefix 192.0.2.0/24 is authorised to be announced by ASN 12345."

Validation:

  • Network operators use RPKI-enabled tools to check routing announcements against these ROAs.
  • If a route matches a valid ROA, it is considered valid. If not, it may be flagged as suspicious or rejected.

How to Get Started with RPKI

  • Log in to the RIPE NCC LIR Portal:

If you're a resource holder, you can manage your RPKI certificates and create ROAs directly through the LIR Portal.

  • Set Up Validation Tools:

Use RPKI-enabled tools to validate routing announcements and ensure secure routing.

  • Monitor and Update ROAs:

Keep your ROAs accurate and up-to-date to reflect your current routing policies.