RPKI ROA (Route Origin Authorization)
A Route Origin Authorization (ROA) is a cryptographically signed object, defined in RFC 6482 under the Resource Public Key Infrastructure (RPKI) architecture of RFC 6480, that states which autonomous system number is authorized to originate routing announcements for a specific IP prefix, up to a stated maximum prefix length. A regional internet registry -- ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC -- lets the holder of an address block publish ROAs for it in a repository other networks can fetch and cryptographically verify. A router performing Route Origin Validation (ROV) checks each incoming BGP announcement's origin AS and prefix against the published ROAs and can mark the announcement invalid if it doesn't match, giving operators an automated, cryptographic way to catch the kind of false announcement that BGP hijacking depends on, instead of relying on the mutual trust BGP assumes by default. ROAs only protect against incorrect origin AS claims; they don't verify the full AS path an announcement travels, so a hijack that keeps the correct origin AS while forging the path in between isn't caught by ROV alone. Adoption is growing but still partial -- a ROA only helps once enough networks along the path actually validate against it.
By AdminKit team, Netbase JSC · Updated