Authenticating networks with RPKI RSC#

Arnold Nipper, DE-CIX (with Yolandi Cloete)

• Why: Machine-verifiable proof that the party you're talking to controls the network resources it claims — network identity, which rhymes with the workload-identity problem in other domains.
• What: PeeringDB is introducing signup authentication for networks via RPKI RSC (RPKI Signed Checklists) in March 2026, and the talk solicits community input on follow-on features: whether to surface how and when a network authenticated, and whether to support periodic re-authentication.
• How: RSC objects let a resource holder sign an arbitrary checklist of their holdings; PeeringDB will use them to verify that a PeeringDB record is created by whoever actually holds the ASN/prefixes. (APNIC's annual report in the same program notes RSC objects are now provided in its RPKI services too.)
• Where applicable: PeeringDB-specific rollout, but the pattern — cryptographic resource-holder authentication replacing manual LOA/email verification — is general, and directly relevant to anyone building inter-org trust flows. Caveat: this is a thin lightning talk and the deck ends with a sponsorship pitch; the signal is the feature, not the depth.