🔏

RPKI: Route Origin Validation

Complex

Free preview · 2 of 5 steps

The BGP hijack problem

BGP was designed for trust — any AS can announce any IP prefix. This has enabled famous hijacks: Pakistan Telecom blackholing YouTube in 2008, Amazon Route 53 hijacked for crypto theft in 2018. RPKI (Resource Public Key Infrastructure) adds cryptographic proof: only the legitimate IP holder can authorize which ASN may originate a prefix.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step