Skip to content

Autonomous System Provider Authorisation#

NetUK3 (The Brewery) digest Program Core pick The Brewery · 6–7 July 2026

Abstract Recording

Ralph Smit (RIPE NCC)

Play the recording: Autonomous System Provider Authorisation

  • Why: The natural companion to the talk above: ASPA is the concrete next step in RPKI path validation, and this is the operator-facing how-to from the registry that runs hosted RPKI for most of Europe.
  • What: An introduction to ASPA objects — a relatively new RPKI object type signed by AS owners that declares an AS's authorised upstream providers, preventing route leaks, BGP path spoofing, and valley-free violations. Covers how to create ASPA objects (hosted RPKI at ARIN/RIPE NCC, or delegated CA software such as Krill) and the current state of uptake, including support in some software routers (from abstract only).
  • How: An AS signs an ASPA listing its providers; validators can then reject paths in which the AS appears to route via an unauthorised upstream — enforcing a signed, valley-free provider relationship.
  • Where applicable: Any AS owner; ASPA creation is available today through the mainstream hosted and delegated RPKI paths, so this is directly actionable rather than speculative. Expect a short talk (25 min) — intro-and-summary depth.