BGP’s trust problem and the RPKI fix

The Border Gateway Protocol (BGP) is what keeps the Internet’s independently managed networks — Autonomous Systems (ASes) — reachable from one another. But BGP was designed with no built-in way to authenticate the routing information it exchanges. Operators must simply trust that the routes they receive are accurate, which leaves the Internet open to bogus route injection, DoS via blackholing, impersonation, and machine-in-the-middle attacks. Even simple fat-finger errors can propagate far beyond their origin and cause wide disruption, such as the June 24, 2019 incident when a Pennsylvania ISP accidentally routed Cloudflare traffic through a capacity-limited network, knocking millions of users offline.

The IETF’s answer to this is the Resource Public Key Infrastructure (RPKI), standardized in RFC 7115. RPKI uses a public key infrastructure to cryptographically attest that an AS advertising a route to an IP prefix is the legitimate owner of that address space. It works in two phases:

  • Signing origins: An AS protects its own prefixes by publishing Route Origin Authorization (ROA) records.
  • Validating origins: A receiving AS performs Route Origin Validation (ROV, per RFC 6483), rejecting routes for which RPKI records are invalid.

RPKI isn’t new, but adoption has lagged. One reason is that it requires two-sided coordination: signing prefixes is only useful if other networks validate, and validating is only beneficial if others sign. That network effect disincentivizes early deployment, though projects like MANRS and Cloudflare’s isbgpsafeyet.com aim to change that.

Measuring signing versus validating

Measuring the first phase is straightforward: ROA data is publicly available in RPKI repositories, and querying them against global routing tables (from RouteViews and RIPE RIS) shows current coverage. There are now 393,344 IPv4 and 86,306 IPv6 ROAs, covering about 40% of globally routed prefix-AS origin pairs.

Measuring the second phase — actual ROV deployment — is harder because ROV is configured inside BGP routers that operators don’t publicly expose. The technique is to infer ROV by comparing reachability of RPKI-valid versus RPKI-invalid prefixes from vantage points within an AS. If a user can reach an RPKI-invalid origin, the path to them is not filtering it; if they cannot, some AS on the path is applying ROV.

A limitation arises when an upstream AS filters invalid routes: vantage points behind it can’t tell whether the filtering happens at their own AS or upstream. Announcing the invalid origin from multiple locations in an anycast network mitigates this by giving vantage points direct paths to Cloudflare’s network, so an AS that doesn’t itself deploy ROV is unlikely to benefit from upstream filtering. (One caveat: the invalid origin’s IP must not be covered by a less specific prefix with a valid or unknown RPKI route, or users could reach it through that route regardless.)

This is the method behind isbgpsafeyet.com. Recently, Cloudflare extended it by measuring whether end-user browsers can connect to invalid RPKI origins. Each measurement session attempts a request to both valid.rpki.cloudflare.com, which always succeeds, and invalid.rpki.cloudflare.com, which should fail if the user’s ISP validates routes. This yields continuous, up-to-date measurements from hundreds of thousands of browsers daily.

Global ROV: a 6.5% protection rate

During October 2022, the system logged 69.7 million successful probes from 41,531 ASNs, covering 96.5% of the world’s Internet population by AS size. Request counts followed expected diurnal traffic patterns.

The headline finding: out of roughly four billion Internet users, only 261 million (6.5%) are protected by BGP Route Origin Validation.

Country-level adoption varies dramatically:

  • Sweden and Bolivia show the highest adoption, over 80%.
  • Finland, Denmark, Chad, Greece, and the United States have crossed 50%.

Adoption within a country can be driven by a few large ASes or by many smaller ones. In the Netherlands, Denmark, Switzerland, and the US, larger ASes carry most of the load; in Greece and Yemen, smaller networks are leading.

Why the global figure is so low

A histogram of adoption across the 6,765 ASes studied shows two clear clusters: most ASes either do no validation at all or sit close to 100% adoption. Between those extremes, a smaller number of ASes show partial drop rates — which can reflect ROV deployed on only some routers or the effect of an upstream validator.

For counting protected users, only ASes with observed adoption above 95% were treated as comprehensive, since incomplete deployment still exposes users to route leaks from BGP peers. That threshold captures 686 ASes protecting the 261 million users.

The contrast between the country adoption map and the actual count of fully protected users stems from two facts: partial deployment is common, and even in countries with strong overall adoption, the largest ASes may be missing. Comparing the United States and the European Union highlights the asymmetry: 111 US ASes with comprehensive deployment cover 112 million users, while European Union ASes with full deployment are more than twice as numerous but protect only half as many users — reflecting that end-user ASes typically operate within single countries.

What this means for routing safety

The probe methodology focuses on end-user networks like ISPs. It does not capture indirect validation from upper-tier transit providers, which may filter invalid routes upstream from non-validating ASes. That indirect protection limits the blast radius of route leaks but still leaves a non-validating AS vulnerable to leaks from its own peers. Likewise, an AS remains exposed until its own ROV deployment is fairly complete.

Some countries — Denmark, Greece, Switzerland, Sweden, and Australia — already cover over half of their Internet populations with comprehensive ROV. Others, including the Netherlands and the US, sit slightly above 40%, powered by a few large networks.

But globally, only 6.5% of users are currently safe from malicious or accidental route leaks. Cloudflare Radar will track ROV adoption using this 95% deployment threshold going forward — and by that measure, there is a long way to go before BGP can be declared safe.