Indian Registry for Internet Names and Numbers

Resource Certification

Resource Public Key Infrastructure (RPKI) and Route Origin Authorisations for IRINN affiliates.

Resource Public Key Infrastructure (RPKI) is a security framework designed to secure Border Gateway Protocol (BGP) routing.

RPKI is similar to IRR route objects, but adds authentication with cryptography. Resource certification is based on X.509 PKI certificate standards.

A Route Origin Authorisation (ROA) is a cryptographically signed object that states which Autonomous System Number is authorised to originate a particular IP address prefix, or set of prefixes. ROAs are based on RPKI, which lets other networks verify that a BGP announcement genuinely comes from the resource holder and that the route is valid.

Benefits of a ROA

  • Protection against route hijacking
  • Stops bad routing information and misconfiguration propagating
  • Secures BGP

How to request ROA registration

Send an email to [email protected], from your registered email address, with the following details:

  1. The ASN through which you will announce your IP block
  2. The IP prefix
  3. The most specific announcement length — for example /22, /23 or /24

Worked example

ASN
AS24029
IP prefix
192.168.0.0/22
Most specific announcement
/24

This produces seven ROA prefix entries: one /22, two /23s and four /24s.

Checking ROA validity

Once your ROA is published, you can verify it using the RIPE NCC RPKI validator at rpki-validator.ripe.net/roas ↗.

Set the most specific announcement carefully.

A ROA that is more specific than what you actually announce will cause your longer announcements to be marked invalid and potentially dropped by networks that enforce Route Origin Validation.