Does RPKI encrypt or authenticate the actual routed traffic?

No. RPKI only validates which ASN is authorized to originate a given IP prefix in BGP announcements. It has no effect on the confidentiality or integrity of the data packets that subsequently flow over that route.

If a prefix has no ROA published, is it automatically hijacked?

No — a missing ROA results in a NotFound state, which most routers treat the same as a Valid route by default (accept). RPKI only actively blocks routes it can prove are Invalid; unprotected prefixes remain exactly as vulnerable as they were before RPKI existed.

Who is responsible for publishing a ROA for my organization's IP space?

The holder of the address block — typically whoever received the allocation from their Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC) — publishes the ROA through that registry's RPKI portal, authorizing the specific ASN(s) permitted to originate it.

Mitigating BGP Hijacking: How RPKI Secures Global Internet Routing

Border Gateway Protocol & Routing Fragility

The Border Gateway Protocol (BGP) connects tens of thousands of Autonomous Systems (AS) to form the global Internet's routing fabric. By design, BGP was built on implicit trust: any network could announce IP prefixes it did not actually own, and neighboring routers had no cryptographic way to verify the claim. This has led to repeated real-world incidents — both accidental route leaks and deliberate hijacks — that rerouted traffic for major services through unauthorized networks.

The Solution: RPKI & Route Origin Authorization (ROA)

Resource Public Key Infrastructure (RPKI) addresses the origin-validation gap by letting an address-block holder cryptographically sign a Route Origin Authorization (ROA) — a statement of the form "AS 64500 is authorized to originate 203.0.113.0/24." Routers that perform Route Origin Validation (ROV) check incoming BGP announcements against the published ROA set and classify each route as:

Announced Prefix + Origin ASN
         │
         ▼
   Check against ROA database
         │
   ┌─────┼─────────────┐
   ▼     ▼             ▼
[Valid] [Invalid]  [NotFound]
Accept  Drop/Deprioritize  Accept (no ROA published)

RPKI Validation States

State	Meaning	Typical Router Behavior
Valid	A matching ROA confirms this ASN is authorized to originate this prefix.	Accept and prefer the route.
Invalid	A ROA exists for this prefix, but it authorizes a different origin ASN.	Reject or heavily deprioritize — this is the hijack signal.
NotFound	No ROA has been published for this prefix at all.	Accept by default; RPKI offers no protection here.

What RPKI Does Not Protect Against

RPKI validates the *origin* AS of a route, not the full AS path. A sophisticated attacker who controls or compromises an AS that is a legitimate neighbor of the real origin can still craft an announcement that passes ROV. BGPsec, a separate and far less widely deployed standard, addresses full path validation — RPKI/ROV is the practical, broadly-adopted first line of defense, not a complete solution.

Check Your IP and ASN

Discover your current Autonomous System Number and trace the live network path packets take with our IP Lookup and Traceroute Tool.