<story><title>Is BGP Safe Yet?</title><url>https://isbgpsafeyet.com/</url></story><parent_chain><item><author>tptacek</author><text>It would be interesting to read more about the &lt;i&gt;problems&lt;/i&gt; with RPKI. The set of organizations that need to implement RPKI to make it effective is pretty small, and yet it&amp;#x27;s been a long slog to get it even to this point. It&amp;#x27;s not like network engineers at Google, Comcast, and Verizon are unfamiliar with it. What&amp;#x27;s going wrong?</text></item></parent_chain><comment><author>pathseeker</author><text>RPKI doesn&amp;#x27;t sign hops in the path for a BGP update. That means to hijack a prefix, all you need to do is to take a legitimate route and re-advertise it with your AS as the second hop in the path.&lt;p&gt;This isn&amp;#x27;t as damaging as being able to advertise a smaller prefix because it won&amp;#x27;t send &lt;i&gt;all&lt;/i&gt; traffic to you. It will just send from routers where your path is shorter than the original.&lt;p&gt;To actually prevent hijacking via path shortening attacks like this, you need a full BGPSEC implementation &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;BGPsec&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;BGPsec&lt;/a&gt; which is a much higher barrier than RPKI because the crypto operations jump 1 or 2 orders of magnitude (signing every re-advertised route rather than just originated routes).&lt;p&gt;So RPKI gets the cert infra in place, but it doesn&amp;#x27;t really fully solve the problem.</text></comment>
<story><title>Is BGP Safe Yet?</title><url>https://isbgpsafeyet.com/</url></story><parent_chain><item><author>tptacek</author><text>It would be interesting to read more about the &lt;i&gt;problems&lt;/i&gt; with RPKI. The set of organizations that need to implement RPKI to make it effective is pretty small, and yet it&amp;#x27;s been a long slog to get it even to this point. It&amp;#x27;s not like network engineers at Google, Comcast, and Verizon are unfamiliar with it. What&amp;#x27;s going wrong?</text></item></parent_chain><comment><author>eastdakota</author><text>The excuse used to be there wasn’t adequate tooling. That’s changed over the last 18 months. See, for example, the open source GoRTR tool our team released:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cloudflare&amp;#x2F;gortr&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cloudflare&amp;#x2F;gortr&lt;/a&gt;&lt;p&gt;And the fact that major ISPs with complex networks like AT&amp;amp;T, NTT, and Telia have implemented it proves it’s possible.</text></comment>