ASPA#
ZANOG@iWeek 2026 digest Program Core pick 21–23 April 2026
Massimiliano Stucchi
- Why: ASPA (Autonomous System Provider Authorization) is the newest piece of the RPKI puzzle and targets exactly the gap left by ROAs and BGPsec: route leaks (invalid AS paths) rather than misorigination. If the PM's organisation runs BGP with upstreams, this is the next deployment decision after ROV.
- What: No abstract is provided in the program or on the session page — content cannot be confirmed. Judging from title, speaker, and the adjacent routing-security session, expect an introduction to ASPA: what the objects are, what attacks they address, and the current state of implementation and adoption. Treat this write-up's mechanism description as background, not as confirmed talk content.
- How: (Mechanism background.) An ASPA is an RPKI-signed object in which a customer AS lists its authorized transit providers. Relying parties use these provider sets to verify AS-path plausibility — a route announced to an unauthorized upstream is flagged as a leak — without requiring the full cryptographic path signing of BGPsec, so it is deployable incrementally.
- Where applicable: Any AS with upstream providers; verification value grows with ecosystem adoption (RPKI relying parties, IXP route servers). Caveat: with no abstract, the talk's actual depth and specifics are unknown — check the recording if it matters.