Skip to content

Routing Security#

ITNOG9 digest Program Core pick 19–20 May 2025

Slides

Marco Paesani

  • Why: RPKI/ROV is now baseline; the frontier is path-origin validation (route leaks) via ASPA — this is both BGP operation and network security, squarely in the PM's core, and the deck has a concrete adoption timeline (global ASPA target 2027).
  • What: A survey of the routing-security stack: why BGP's lack of security is structural (hijacks per RFC 7908 types 5–6, route leaks types 1–4), the MANRS history from 2013/14, RPKI v0/v1 (RFC 6810/8210) and ROV adoption trajectory (2019–2023, now best practice), BGPsec's practical problems (router hardware/software changes, slower convergence, needs near-universal deployment), and ASPA as "RPKI v2" — incremental, partial-adoption-beneficial, using existing RPKI infrastructure with minimal overhead.
  • How: ASPA verification per draft-ietf-sidrops-aspa-verification-22 (March 2025): ASes register authorized providers, and BGP roles per RFC 9234 (Provider, RS, RS-Client, Customer, Lateral-Peer, Sibling) constrain which learned paths may be re-advertised — catching route leaks ROV cannot. Includes a real static-ASPA config example on Huawei NetEngine 8000 and Routinator 0.14.2 support; NIST monitoring references. RIPE's ASPA support is on hold pending IETF consensus.
  • Where applicable: Any AS operating BGP. Caveats: ASPA is still Internet-Draft stage, and it complements rather than replaces ROV — the deck is explicit that both are needed together.