RPKI in Action: Updates and Routing Security#

Gerardo Rada, Jorge Cano, Carlos Martínez (LACNIC)

• Why: LACNIC's open-source RPKI stack — FORT validator plus the Barry and Rapport test tools — is production tooling anyone can adopt, and the session also covers ASPA and delegated-CA enablement in MiLACNIC.
• What: FORT 1.7.0 (July 2026): experimental ASPA support, OpenSSL 4, recommended for production; FORT 2.0 targeted for December 1 with 51 improvements and a more modular architecture. Barry ("the eccentric cousin of FORT") generates valid and invalid RPKI test repositories for validator testing and research. Rapport is an automated test suite for validators — roughly 20 categories and 350 tests (e.g., aspa-profile, rfc6481, rfc6487, router connectivity), extensible to any validator — which replaced the manual smoke-testing that used to accompany every FORT code change. The session also runs interactive route-hijack scenarios and hands-on ASPA configuration, with ASPA and the delegated RPKI model now available through MiLACNIC.
• How: The validator flow shown explicitly: fetch RPKI repositories → local cache → cryptographic validation → serve to routers; Barry scenarios define TA/CA/ROA objects with controlled parameters (validity windows, IP extensions) to build arbitrary test cases.
• Where applicable: Any operator running or evaluating an RPKI validator, and any team building RPKI/ASPA tooling — all three tools are open source with public repositories.