re alex's preso on how the ripe/ncc roa generation gui works, with help
from geoff, the latest version of draft-ietf-sidr-origin-ops gives more
detailed advice on the subject.
Use of RPKI-based origin validation obviates the utility of
announcing many longer prefixes when the covering prefix would do.
To aid translation of ROAs into efficient search algorithms in
routers, ROAs SHOULD be as precise as possible, i.e. match prefixes
as announced in BGP. E.g. software and operators SHOULD avoid use of
excessive max length values in ROAs unless operationally necessary.
Therefore, ROA generation software MUST use the prefix length as the
max length if the user does not specify a max length.
Operators SHOULD be conservative in use of max length in ROAs. E.g.,
if a prefix will have only a few sub-prefixes announced, multiple
ROAs for the specific announcements SHOULD be used as opposed to one
ROA with a long max length.
the third para specifically addresses the issue alex raised, thanks
alex.
randy
