What is RPKI? Resource Public Key Infrastructure

Resource Public Key Infrastructure (RPKI) is a cryptographic security framework that protects Internet routing. It ensures only authorized networks can announce specific IP address blocks through the Border Gateway Protocol (BGP). By validating route origins, RPKI reduces the risk of hijacks, leaks, and outages caused by misconfigurations or malicious activity.

How RPKI Works

• Delegation chain: IANA allocates IPs and ASNs to Regional Internet Registries (RIRs), who pass them to Local Internet Registries (LIRs/ISPs) and ultimately to resource holders.
• ROAs: Resource holders create Route Origin Authorizations (ROAs), cryptographic certificates that specify which ASN may originate a prefix.
• Publication: ROAs are stored in public repositories (rsync/HTTPS).
• Validation: An RPKI validator downloads ROAs, checks them, and outputs Validated ROA Payloads (VRPs).
• Routers & policy: Routers import VRPs (via the RTR protocol) and apply routing policy — rejecting Invalid routes and preferring Valid ones.

Why RPKI Matters

• Prevents hijacks – stops attackers from falsely announcing IP space.
• Reduces leaks – minimizes accidental routing errors.
• Compliance ready – many large networks require RPKI for MANRS alignment.
• Protects users – ISPs with RPKI lower the risk of traffic redirection to malicious sites.

In Short: RPKI adds trust to the Internet’s nervous system. It turns BGP route announcements from “trust me” into cryptographic proof of legitimacy.