{"id":34866,"date":"2026-10-15T18:47:11","date_gmt":"2026-10-15T18:47:11","guid":{"rendered":"https:\/\/blog.lacnic.net\/rpki-se-esta-volviendo-perjudicial-para-la-estabilidad-del-bgp\/"},"modified":"2026-10-29T14:28:21","modified_gmt":"2026-10-29T14:28:21","slug":"bgp-rpki","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/bgp-rpki\/","title":{"rendered":"Is RPKI becoming harmful to BGP stability?"},"content":{"rendered":"\n

By\u00a0Samuele Quinzi<\/a>\u00a0<\/strong><\/p>\n\n\n\n

This article was originally published on the <\/em>APNIC blog.<\/em><\/a><\/p>\n\n\n\n

RPKI has become the Internet\u2019s primary defence against Border Gateway Protocol (BGP) route hijacks. By allowing network operators to cryptographically authorize Autonomous Systems (ASes) that may originate specific IP prefixes, RPKI helps prevent a wide range of accidental leaks, misconfigurations, and some malicious route hijacking attacks.<\/p>\n\n\n\n

Each time a Route Origin Authorization (ROA) is created, modified, revoked, or expires, routers performing Route Origin Validation (ROV) may need to reconsider routing decisions. Those decisions can then propagate through BGP, generating additional BGP updates. In other words, RPKI introduces a new class of events that can potentially trigger routing changes across the Internet.<\/p>\n\n\n\n

This raises the following concern: Could the growing deployment of RPKI become a threat to routing stability? To answer that question, we analysed more than 11 years of RPKI and BGP data, measuring how much routing activity can be associated with RPKI-related changes.<\/p>\n\n\n\n

RPKI is growing fast<\/strong> <\/h2>\n\n\n\n

To understand the relevance of our question on the impact of RPKI on routing, it is worth looking at how much the RPKI ecosystem has changed over time.<\/p>\n\n\n\n

\"Figura<\/figure>\n\n\n\n

Figure 1 \u2014 Number of ROA additions, expirations, and revocations in the RIPE Archive from 2014 to 2025.<\/p>\n\n\n\n

Figure 1 shows the evolution of RPKI changes observed between 2014 and 2025. The number of ROA creations, expirations, and revocations has increased significantly over the years for both IPv4 and IPv6.<\/p>\n\n\n\n

This trend reflects the steady adoption of RPKI by network operators and the increasing amount of address space protected through ROAs. Regulatory initiatives and industry best practices are further accelerating this deployment.<\/p>\n\n\n\n

The implication is straightforward: If each RPKI change has the potential to trigger routing updates, then a rapidly growing number of RPKI changes could translate into a rapidly growing amount of BGP activity.<\/p>\n\n\n\n

The motivation behind our study is understanding whether this BGP activity remains negligible or becomes operationally significant.<\/p>\n\n\n\n

Building an 11-year RPKI time machine<\/strong><\/h2>\n\n\n\n

Measuring the impact of RPKI on BGP is more challenging than it may initially appear.<\/p>\n\n\n\n

The first challenge is identifying the moments when RPKI can actually influence routing. A ROA creation or revocation does not automatically correspond to a routing change. What matters is whether the set of authorizations seen by routers changes. We refer to these moments as RPKI events. An RPKI event occurs whenever a validated authorization (VRP) becomes available or disappears, potentially changing the validation state, impacting the routing decisions, and thus triggering one or more BGP announcements.<\/p>\n\n\n\n

The second challenge is historical visibility. While it is possible to observe recent RPKI activity in detail, obtaining a comparable view over more than a decade requires reconstructing events from archival data.<\/p>\n\n\n\n

To address these challenges, we developed a methodology that combines historical RPKI information with BGP update measurements.<\/p>\n\n\n\n