ROA: The Authorization Letter

Route Origin Authorization

The ROA (Route Origin Authorization) is the core signed object in RPKI. It is a cryptographically signed statement that says:

"I, the verified owner of 192.0.2.0/24, authorize AS 65000 to announce this prefix to the internet."

A ROA contains exactly three pieces of information:

The Max Length Field — The Critical Detail:

Max Length is the most commonly misunderstood part of RPKI. It controls whether sub-prefix announcements are valid.

Consider a ROA for 10.0.0.0/16 with Max Length /16:

• Announcement of 10.0.0.0/16 from AS 65000 → Valid ✓
• Announcement of 10.0.0.0/24 from AS 65000 → Invalid ✗ (too specific)
• Announcement of 10.0.0.0/16 from AS 65001 → Invalid ✗ (wrong ASN)

Now consider the same ROA but with Max Length /24:

• Announcement of 10.0.0.0/16 from AS 65000 → Valid ✓
• Announcement of 10.0.0.0/24 from AS 65000 → Valid ✓ (within max length)

Why Max Length Matters for Security:

Sub-prefix hijacks are the most effective form of BGP hijacking because BGP's longest-prefix-match rule guarantees the attacker wins the routing decision. If you set Max Length too permissively (e.g., /32 for a /16 block), you allow any sub-prefix announcement from your ASN — which means a misconfiguration inside your own network could still cause a sub-prefix hijack. The safest practice is to set Max Length equal to the prefix length itself, unless you have a specific operational reason to announce more specific routes.

Creating a ROA (Conceptual Workflow):

ROAs are created through your RIR's web portal or API. The workflow is:

1. Log into your RIR's resource portal (e.g., RIPE NCC's RPKI dashboard).
2. Select the IP block you own.
3. Specify the Origin ASN and Max Length.
4. The RIR signs the ROA with your Resource Certificate.
5. The signed ROA is published to the global RPKI repository.
6. Within minutes, validators worldwide fetch it and routers begin enforcing it.