ASPA la vista.. Route leaks#

Alastair Strachan – RIPE NCC

• Why: ASPA is the next RPKI deployment wave after ROV, and this carries the operational guidance plus fresh uptake numbers — useful context for the routing-security work the PM is already doing.
• What: A clear primer on ASPA objects (signed provider-AS lists) with the upstream/downstream path-validation algorithms and the complementary-coverage matrix (ROA for misorigination, ASPA for leaks and partial path spoofing, BGPsec for path spoofing). Signing uptake as of Aug 2026: 2.2% of registered ASNs worldwide (RIPE region 4.6%; Czech Republic leads at 10.9%); hosted signing UIs now live across all RIRs (Krill July 2025, RIPE NCC Nov 2025, ARIN Jan 2026, APNIC June 2026).
• How: Same validator/RTR deployment model as ROV; operational guidance: include all providers (including backups not visible in AS paths), include non-transparent IXP route servers or they register as valleys, reject (don't de-prefer) invalids, and start with logging-only.
• Where applicable: General, but early — router validation support is incomplete ("talk to your vendor"). Mostly educational for a routing-security veteran, but the uptake data and signing checklist are current.