Why is ASPA still a draft#

Maria Matejka, BIRD | CZ.NIC

• Why: An implementer's-eye view of why ASPA (AS Provider Authorization) keeps stalling — useful both for BGP protocol understanding and as a case study in how draft specs mislead even careful implementers.
• What: Clarifies what ASPA is and isn't ("ROA for the rest of the AS path": each AS signs its provider list — not whole-path authorization, not neighbor-pair authorization, not a BGPsec replacement), then walks through BIRD's implementation history: their first validation algorithm was wrong (assuming neighbor-pair authorization), and the wrongness survived review because the draft text suggested that reading on first pass.
• How: Details the RTR ASPA PDU design confusion (a redundant AS Count field questioned after the document had passed last call) and a 2024 clarification exchange that exposed deeper ambiguity in the validation algorithm.
• Where applicable: Anyone implementing or planning to deploy ASPA; also a good cautionary tale for anyone writing specs that will be implemented by third parties.