PQC for the RPKI#

Dirk Doesburg, Radboud University / SIDN Labs

• Why: The RPKI is RSA-only, and a quantum-capable attacker is worse than no RPKI at all: forged ROAs can make legitimate announcements ROV-Invalid while malicious ones validate. Migration will take years, so the groundwork — which signatures, how to migrate — matters now. This is routing security with a long planning horizon.
• What: An MSc thesis laying out the full migration path. (1) Attack analysis: forged ROAs/revocations (including entire CAs), AS0-roa DoS, and ASPA forgery. (2) Signature evaluation across post-quantum schemes: Falcon-512 wins (NIST level 1, 897 B public key, 666 B signature; RPKI grows from 838 MB to ~1.4 GB, download from ~14.5 s to ~24 s, versus catastrophes like SLH-DSA at ~14 GB). (3) The "null scheme": replaces the one-time EE key and signature in each signed object with a SHA256 digest, cutting the median hybrid (Falcon-512 + RSA-2048) ROA from 4,354 to 2,295 bytes and ~35% of verification CPU — largely paying for the PQC switch; documented as an Internet-Draft with working prototypes in Krill and Routinator. (4) A mixed-tree migration procedure simpler than RFC 6916: no globally coordinated milestone days, no top-down switch, ordinary RFC 6489-style key rollovers per CA, with relying-party software and trust anchors updated first.
• How: Measured real costs (RPKI download ~14.5 s, ~13 CPU-seconds of verification as baseline) across candidate algorithms; hybrid signatures recommended for safety during transition.
• Where applicable: RPKI-wide — every RIR, CA, and relying party, not org-specific. Prototypes exist for two of the main open-source tools; actual migration requires SIDRops standards work and multi-year lead time, which is precisely the argument for engaging now.