Beyond RPKI Origin Validation, what do we gain with RFC9234 (BGP roles) and ASPA#

Claudio Jeker - RSSF (OpenBGPD lead developer, rpki-client co-maintainer)

• Why: BGP security is a core interest, and this is the rare talk that grounds the RFCs in real 2025–2026 incidents and gives a concrete, ordered deployment checklist. The Hetzner forged-origin hijack case alone is worth the read: it shows exactly where ROV stops protecting you.
• What: An argument that ROV is necessary but insufficient — it does nothing against path leaks (Voxility/Lumen April 2025, Cloudflare January 2026, both with intact origins) and nothing against forged-origin hijacks — and that RFC 9234 (BGP roles + OTC) plus ASPA close those gaps. Includes a sharp section on ROA maxLength as an attack surface: a /16 with maxLength /24 authorizes an attacker to forge your origin for any unannounced more-specific.
• How: RFC 9234 exchanges role information (provider/peer/customer/RS/RS-client) in the BGP OPEN, rejects role-mismatched sessions, and adds the transitive Only-To-Customer attribute so routes learned from providers/peers/RS are marked and rejected when re-exported upward — catching type 1–4 leaks at the source even with a broken export filter. ASPA publishes a signed provider list in the RPKI; routers check AS_PATHs for valley-free propagation, so even partial deployment rejects provably Invalid paths while leaving Unknown paths usable. The Hetzner case (162.55.80.0/24, forged AS_PATH ... 6204 62390 24940, ROV result "Valid") was later invalidated by AS24940's post-attack ASPA record, which doesn't authorize AS62390. Call to action: reject ROV invalids, publish minimal ROAs, configure roles/OTC, publish complete ASPA provider lists (including backup and DDoS-mitigation transit).
• Where applicable: Any ISP, transit provider, or IXP route server; vendor support is the practical constraint — OpenBGPD/BIRD/FRR and (recently) JunOS 25.2R1 and MikroTik RouterOS 7.21 support RFC 9234; ASPA is available in OpenBGPD and BIRD now, with FRR/JunOS/XR planned or in field trial. Broadly applicable; publishing ROAs/ASPA works even before your routers validate.