Shikanoko Networks (SKNK)
Back to blog

SKNK Technical Guide

What Is RPKI? How Modern Networks Prevent BGP Hijacking

Learn how Resource Public Key Infrastructure (RPKI) helps Internet operators validate BGP route announcements, reduce route hijacking, and improve routing security.

In One Sentence

BGP tells routers where traffic can go. RPKI helps routers verify whether those route announcements can be trusted.

Key Concepts

Term Meaning
ASN Identifies an Autonomous System
BGP Exchanges routing information between networks
Prefix The IP address block being advertised
ROA Authorizes a specific ASN to originate a specific prefix
RPKI Validates whether route origins are authorized

Introduction

Every day, Internet routers exchange thousands of BGP route announcements.

Most of the time, those announcements are legitimate.

But what happens when a network advertises IP prefixes it doesn't actually have permission to announce?

Without additional validation, other routers may accept those routes and begin forwarding traffic toward the wrong destination.

This isn't a flaw in BGP.

It's a consequence of how Internet routing was originally designed: routers exchange routing information, but they don't automatically verify whether every announcement is authorized.

To reduce that risk, the Internet community developed Resource Public Key Infrastructure (RPKI).

Rather than replacing BGP, RPKI allows network operators to verify whether an Autonomous System is authorized to originate a particular IP prefix.

In this guide, you'll learn:

  • Why BGP needed additional route validation
  • What RPKI actually does
  • How Route Origin Authorizations (ROAs) work
  • How Route Origin Validation improves routing security
  • Why RPKI strengthens BGP without replacing it

New to Internet routing? Start with What Is an ASN? and BGP Basics.

Why BGP Needed RPKI

BGP was designed to exchange routing information between Autonomous Systems. It was never designed to verify whether every routing announcement was legitimate.

When the Internet was much smaller, this wasn't considered a major problem. Networks generally trusted one another, and the number of participating organizations was relatively limited.

Today's Internet is very different. Tens of thousands of Autonomous Systems exchange routing information continuously, often across multiple providers, Internet exchanges, and continents. In this environment, mistakes can happen. So can malicious announcements.

Imagine a company legitimately announcing the following route:

203.0.113.0/24
Origin AS64500

Now imagine another network accidentally announces the same prefix:

203.0.113.0/24
Origin AS65000

Without additional validation, neighboring routers don't automatically know which announcement is legitimate. Both routes may appear technically valid from BGP's perspective.

From the protocol's point of view, both announcements follow the rules.

BGP can exchange routing information, but it cannot determine who is actually authorized to originate a prefix.

This trust-based design helped the Internet scale, but it also introduced opportunities for incorrect route announcements to spread beyond the originating network. RPKI was developed to address this specific problem.

What Is RPKI?

Resource Public Key Infrastructure (RPKI) is a framework that allows Internet number resource holders to cryptographically authorize which Autonomous Systems may originate their IP prefixes.

Despite its name, RPKI isn't designed to encrypt Internet traffic.

Instead, it validates routing information.

A useful way to think about the relationship:

  • BGP tells routers where traffic can go.
  • RPKI helps routers verify whether that routing information can be trusted.

Rather than changing how BGP exchanges routes, RPKI adds an independent validation layer. Routers can continue exchanging routes exactly as before. The difference is that they can now determine whether the originating Autonomous System has been authorized to announce a particular IP prefix.

What Is a ROA?

The core building block of RPKI is the Route Origin Authorization, commonly abbreviated as ROA.

A ROA is a digitally signed statement created by the legitimate holder of an IP prefix. Think of a ROA as a signed authorization saying:

"This ASN is allowed to originate this IP prefix."

For example, a simplified ROA might authorize:

Prefix: 203.0.113.0/24
       ↓
Authorized Origin ASN: AS64500

If another Autonomous System later announces the same prefix, routers performing Route Origin Validation can compare the announcement with the published ROA. The goal isn't to determine the best path — it's simply to verify whether the originating ASN is authorized.

Who Publishes ROAs?

Route Origin Authorizations are typically published by the holder of the IP address resources or an organization authorized to manage them, depending on the applicable registry policies and operational model.

In practice, many organizations that announce their own IP prefixes choose to publish ROAs as part of standard network operations. For SKNK IPv6 PA prefixes, RPKI authority is controlled by SKNK because the address space is held by its LIR. SKNK creates, maintains, and withdraws the ROA; customers have a right to use the prefix but do not directly hold the RIPE NCC resource certificate and cannot manage that PA-prefix ROA independently in the RIPE NCC Portal.

How Route Origin Validation Works

Once ROAs have been published, routers can validate incoming BGP announcements before accepting them into their routing tables. A simplified validation process looks like this:

Receive BGP Route
        │
        ▼
Extract Prefix + Origin ASN
        │
        ▼
Lookup Published ROA
        │
        ▼
    Validation Result
    ┌───────┼───────┐
    ▼       ▼       ▼
  Valid  Invalid  Not Found

The router compares the Origin ASN contained in the BGP announcement with the Origin ASN authorized by the published ROA.

If they match, the route is valid. If the ROA authorizes a different ASN, the route is invalid. If no matching ROA exists, the router cannot verify the announcement.

Importantly, routers don't all react in exactly the same way after validation. How validation results influence routing decisions depends on the policies configured by the network operator. RPKI provides validation information — operators decide how to use it.

Different network operators may apply different routing policies after Route Origin Validation. RPKI standardizes validation results, but it does not mandate how those results must influence routing decisions.

Valid vs Invalid vs Not Found

After comparing a BGP route announcement with the published ROA, Route Origin Validation produces one of three possible results. Understanding these three states is enough to understand how RPKI works in practice.

Validation State Meaning Typical Interpretation
Valid The Origin ASN matches a published ROA. The route origin has been successfully validated.
Invalid A matching ROA exists, but it authorizes a different Origin ASN. The announced origin does not match the published authorization.
Not Found No matching ROA exists for the prefix. No validation information is available.

These validation states are intentionally simple. RPKI answers only one question: "Is this Autonomous System authorized to originate this IP prefix?" It does not determine whether a route is the fastest, shortest, or most desirable. Those decisions remain part of BGP's routing policy.

Does RPKI Stop Every BGP Hijack?

A common misconception is that deploying RPKI completely eliminates BGP hijacking. It doesn't.

RPKI significantly reduces one important class of routing problems, but it doesn't validate every aspect of Internet routing. It verifies whether the originating Autonomous System is authorized to announce a particular IP prefix. It does not validate every step of the routing path.

For example, RPKI cannot determine whether every Autonomous System listed in the AS Path is correct. Nor can it prevent every routing policy mistake made by network operators.

In other words:

  • RPKI validates who originated the route.
  • BGP still determines how the route propagates.

This distinction is important because Internet routing security involves multiple layers rather than a single technology.

Does RPKI Replace BGP?

No. BGP and RPKI solve different problems.

BGP RPKI
Exchanges routes Validates route origins
Determines reachability Verifies authorization
Routing protocol Validation framework
Required for inter-domain routing Optional security enhancement adopted by operators

BGP is responsible for exchanging routing information between Autonomous Systems. RPKI provides cryptographic validation that helps determine whether a route announcement should be trusted. One distributes routing information. The other validates part of that information. Neither technology replaces the other — modern Internet routing relies on both.

Does RPKI Affect Performance?

Route Origin Validation affects route selection, not packet forwarding.

Once a route has been accepted, RPKI has no impact on how packets move across the network.

Should Every ASN Publish ROAs?

For organizations announcing their own IP prefixes, publishing Route Origin Authorizations is generally considered good operational practice. A ROA allows other networks performing Route Origin Validation to verify that your ASN is authorized to originate your prefixes.

Without a published ROA, your announcements typically fall into the Not Found validation state. That does not automatically make them invalid — it simply means other operators have no published authorization information to validate against.

Whether publishing ROAs is appropriate depends on your network architecture and operational requirements. Organizations operating public Internet routing often evaluate RPKI alongside other routing security practices.

Common Misconceptions About RPKI

Several misunderstandings appear frequently when people first encounter RPKI.

"RPKI replaces BGP."

No. BGP continues to exchange routing information exactly as before. RPKI simply provides additional validation.

"RPKI encrypts Internet traffic."

It doesn't. RPKI validates routing information. Protocols such as TLS are responsible for encrypting application traffic.

"Invalid routes are always rejected."

Not necessarily. Different network operators apply different routing policies. Some reject invalid routes. Others lower their preference or monitor them before taking action. The validation result is standardized — the routing policy is not.

"RPKI prevents every routing incident."

No. RPKI significantly improves route origin validation, but Internet routing security involves multiple operational practices working together.

Frequently Asked Questions

What does RPKI stand for?

RPKI stands for Resource Public Key Infrastructure. It is a framework used to validate the origin of BGP route announcements.

What is a ROA?

A Route Origin Authorization (ROA) is a digitally signed statement authorizing a specific Autonomous System to originate a specific IP prefix.

Is RPKI mandatory?

No. Deployment depends on the policies and operational decisions of individual network operators.

Does RPKI prevent BGP hijacking?

It helps reduce the risk of unauthorized route origin announcements by allowing operators to validate the originating ASN. However, it is not a complete solution for every routing security issue.

What happens if no ROA exists?

The validation state is typically Not Found, meaning no published authorization information is available for that prefix.

Does RPKI support IPv6?

Yes. Route Origin Validation applies to both IPv4 and IPv6 prefixes.

Does RPKI require BGP?

RPKI is designed to work alongside BGP, but deploying RPKI does not require you to run BGP yourself. For SKNK IPv6 PA prefixes, SKNK manages the associated ROA as LIR; customers remain responsible for their own BGP announcements and network operation.

Can I deploy RPKI without my own ASN?

Yes. If your IP prefixes are announced through a sponsoring organization or upstream provider, ROA publication is typically handled through that relationship rather than requiring your own ASN.

Conclusion

BGP made it possible for thousands of independently operated networks to exchange routing information and build today's Internet.

RPKI builds on that foundation by helping operators verify that route announcements originate from authorized Autonomous Systems.

It doesn't replace BGP.

It doesn't change how routes are exchanged.

Instead, it strengthens one of the Internet's most important assumptions — that routing information should be trusted only after it can be verified.

As Route Origin Validation becomes more widely deployed, RPKI continues to improve the reliability of global Internet routing while remaining fully compatible with the protocol that already connects the world.

Key Takeaways

  • BGP exchanges routing information. RPKI helps verify that those route announcements are authorized.
  • A ROA authorizes a specific ASN to originate a specific IP prefix.
  • Route Origin Validation produces three possible states: Valid, Invalid, and Not Found.
  • RPKI improves routing security but does not replace BGP or prevent every type of routing incident.
  • Publishing ROAs is widely regarded as good operational practice for networks announcing their own prefixes.

Continue Reading