Engineering Update#

Mark Kosters, ARIN (CTO)

• Why: Densely useful for three of the PM's interests at once: identity (ARIN's own MFA mix), physical DC work (ARIN's data center migration), and routing security infrastructure (RPKI trust anchor constraints, ASPA, and the planned retirement of legacy directory services).
• What: The operational report on ARIN's public services. Highlights: MFA adoption across 53,065 users is 61% TOTP, 36% SMS, and only 3% FIDO2 — a sobering data point for anyone betting on passkey adoption in registry-adjacent systems; all authorizations have moved into ARIN Online (email-based approvals retired); ASPA support released; RPKI Trust Anchor Constraints work is underway, leveraging extended stats and extended transfer logs to attest registry contents per the IETF constraining-trust-anchors draft (already implemented in rpki-client); a consultation is planned on retiring RWhois and Whois-RWS, collapsing four directory-service interfaces (Whois, RWhois, Whois-RWS, RDAP) down toward RDAP.
• How: On infrastructure, ARIN moved its computer room from HQ to a new Northern Virginia data center, replaced end-of-life hardware, and now runs public-facing services on Red Hat OpenShift with services under OpenShift KubeVirt virtual machines, with Prometheus monitoring displacing Sensu. RRDP is now the largest public-facing traffic class at 46.6% — a signal of how RPKI repo synchronization has become the dominant directory workload.
• Where applicable: ARIN-specific as an implementation, but the pattern — registry services re-platformed onto hosted Kubernetes with VMs for legacy services, and protocol-surface reduction (retiring RWhois/Whois-RWS in favor of RDAP) — is a template any infrastructure registry operator (including internal IPAM/identity services) can study. The FIDO2-at-3% figure is a broadly citable adoption reality check.