ASPA - RPKI BGP Path Verification#

Tim Bruijnzeels (RIPE NCC)

• Why: RPKI today only validates route origin; ASPA is the next mechanism, validating AS paths and rejecting route leaks. Anyone responsible for BGP security needs to know where this stands operationally.
• What: A walkthrough of the ASPA object type and its verification algorithm, how to sign provider authorizations in the RIPE NCC RPKI Dashboard, how validation behaves in practice, and real uptake and lessons learned so far. (from abstract only)
• How: AS holders publish an ASPA object authorizing their upstream providers; validators use it to check received paths for customer→provider consistency, detecting and rejecting "valleys" — leaked paths — in addition to origin validation.
• Where applicable: General BGP technique, not org-specific. Requires RPKI CA participation and validator support on receiving routers; protection only materializes as transit providers adopt it, which makes the uptake discussion the key operational caveat.