Lessons from 10 months of ASPA#

Tim Bruijnzeels (RIPE NCC)

• Why: Routing security is squarely in the PM's network-security scope, and this is the rare talk with actual deployment telemetry rather than aspiration. It gives a clean mental model of what ROA, ASPA, and BGPsec each do and don't protect against, plus real uptake numbers.
• What: A status report on ASPA (AS Provider Authorization) ten months in: how ASPA objects work, the AS0 convention for transit-free networks, valley-free path validation from both ends of a path, and the deployment picture. Key data points: signing UIs landed across Krill, RIPE NCC, ARIN, and APNIC through 2025–2026; relative signing uptake as of 15 Aug 2026 is 2.2% of registered ASNs worldwide, 4.6% in the RIPE region, 6.1% in NL, and 10.9% in CZ. Validation is coming: supported in BIRD, OpenBGPd, and NIST-BGP-SR, with Cisco IOS-XR in test; YYCIX was the first to drop ASPA-invalid (2023).
• How: ASPA objects are RPKI-signed by a customer AS listing its provider ASes; validators feed routers over RPKI-RTR (no router crypto), and routers evaluate plausible up-ramp/down-ramp paths. The talk shows working config: deny quick from ebgp avs invalid in OpenBGPd, and aspa_check_downstream() filters in BIRD 3.2.1+ as deployed in the RIPE meeting network. RIS-based path analysis toward AS0 networks shows how common invalids already are.
• Where applicable: Any operator with an ASN. Actionable today: sign ASPAs (include all transits, maintain them), and plan to reject invalids — with the explicit warning that ASPA is a "sharp tool" and people will drop invalids. Not org-specific; the uptake figures are global/regional RIR statistics.