Resource Public Key Infrastructure
RPKI solves the BGP trust problem by introducing cryptographic proof of route ownership. Think of it like a passport system for IP addresses: just as a passport proves a government vouches for your identity, an RPKI certificate proves that a recognized authority vouches for who owns a given IP block.
RPKI (Resource Public Key Infrastructure) uses the same public-key cryptography that underpins HTTPS. It creates a chain of trust rooted in the five Regional Internet Registries (RIRs) — the organizations that allocate IP addresses globally:
| RIR | Region |
|---|---|
| ARIN | North America |
| RIPE NCC | Europe, Middle East, Central Asia |
| APNIC | Asia-Pacific |
| LACNIC | Latin America & Caribbean |
| AFRINIC | Africa |
The Chain of Trust:
- Root Trust Anchors: Each RIR holds a root certificate (a Trust Anchor). These are the ground truth — they know exactly which IP blocks they allocated to which organizations.
- Resource Certificates: When an organization receives an IP block from an RIR, they receive a Resource Certificate — a cryptographic document proving they hold that block.
- Delegation: Organizations can further delegate sub-blocks to customers, creating a tree of certificates that mirrors the actual IP allocation hierarchy.
- Signed Objects: Using their Resource Certificate, an organization signs ROAs (Route Origin Authorizations) — the actual objects that routers use for validation.
How Routers Use RPKI:
Routers do not query the RPKI repositories directly (that would be too slow). Instead, they connect to a local RPKI Validator (software like Routinator, OctoRPKI, or FORT) that fetches and caches the signed objects. The validator exposes a feed to routers via the RTR protocol (RPKI-to-Router), delivering a pre-computed list of valid prefix-ASN pairs. The router checks incoming BGP announcements against this list in real time.