ASPA: the new protocol for improving BGP routing security#

Ondřej Caletka, RIPE NCC

• Why: ASPA (Autonomous System Provider Authorization) is the 2026 RPKI deployment milestone — the first broadly deployed step beyond origin validation toward path verification — and this tutorial is the operator's manual for both signing and validating sides.
• What: A deep dive covering ASPA principles, creating ASPA objects for your ASNs, configuring validation in routers, and troubleshooting validation failures. An ASPA object lists the set of provider ASNs for a customer AS, signed via the RPKI chain of trust; validating operators can drop routes arriving via unauthorized providers. It complements ROV (which stops misorigination but not path spoofing or route-leak types 1–4), supports partial deployment, and is address-family agnostic.
• How: Signing works through the standard RPKI models (hosted, delegated, hybrid) and the RIPE NCC portal; the tutorial includes practical guidance on what belongs in the object — transit providers, backup providers, DDoS-scrubbing providers, non-transparent IXP route servers — and what does not (customers, lateral peers, unless they can act as providers under some circumstances).
• Where applicable: Every ASN holder and every operator doing inbound filtering; value grows with adoption, so early signers shape the ecosystem.