alt Hacker NewsThere's two kinds of route hijacks. Origin or path based.
RPKI addresses who is allowed to originate a prefix. There are other technical changes that need to be implemented to get path validation, this cloud flare blog has a good write up on the issues/solutions.
Replies
alibarber • today at 11:57 AM
There's another quite good blog from Cloudflare about this here too:
RPKI addresses both.
Route Origin Authorizations (ROAs) enforce which ASes are allowed to originate a prefix. ROAs address origin hijacks, and have been around for longer.
Autonomous System Provider Authorizations (ASPAs) enforce which ASes are allowed to be adjacent to each other in an AS_PATH. ASPAs address path hijacks, and were introduced more recently. It used to be that you had to self-host (as in the article) in order to publish ASPAs, but RIRs are now starting to support them on their hosted RPKI offerings. I'm surprised the article didn't mention this as a reason to run your own RPKI.
If the first hop publishes a ROA, and all subsequent hops publish an ASPA, then the full path can be validated.