On Thu, Oct 29, 2026 at 11:11:24PM +0100, Gert Doering wrote:
On Thu, Oct 22, 2026 at 09:50:37AM +0200, Tim Bruijnzeels wrote:
Please note that BGPsec is complementary to ROAs/ROV and ASPA. BGPsec focuses specifically on preventing spoofing of the path. It does not check the route origins, as ROAs/ROV do, or detect route leaks, as ASPA does.
My understanding is that BGPsec specifically allows signing of the origin, and crypto *validation* of the origin (= the spoofed-origin attacks against ROA/ROV get addressed by that). So benefit, even if the path might see still spoofery.
What's cryptographically signed is the AS path: every AS hop along the path appends a signature (chain starts at the origin AS). https://www.rfc-editor.org/info/rfc8205/#section-3 I think what Tim meant to say is that BGPsec doesn't help to verify that a given AS was *authorized to originate a given prefix* (that aspect is addressed by ROAs). However, bgpsec _does_ help to verify that the AS_PATH isn't spoofed, so if one combines ROAs Origin Validation AND BGPsec AS path validation, you'd arrive at something quite robust. I hope this ASCII art helps a bit: +----------------------+ | out-of-band | | 2001:67c:208c::/48 | | | +---------------------------------|---------+ ROA | | AS_PATH in-band | | | | | | | | 1299 __ 8455 __ 51088 ____|_ 15562 | | | \....../\......./\......|../ | | | sig3 sig2 sig1 | | | | BGPsec | | | +---------------------------------|---------+ | | | +----------------------+ The ROA is signed by the prefix holder of 2001:67c:208c::/48. The BGP update from 15562 toward 51088 is signed by the AS holder of AS15562. The BGP update from 51088 toward 8455 is signed by the AS holder of AS51088. The BGP update from 8455 toward 1299 is signed by the AS holder of AS8455. Verifying "sig1" by itself doesn't tell you that 15562 actually is permitted to originate 2001:67c:208c::/48. The signature merely tells us that it really was 15562 that originated that prefix. When all four signatures are verified (the ROA signature inside the RPKI validator, and the bgpsec signatures inside the BGP router), one can establish not only that the AS path was authentic (not spoofed), but also that the right-side AS was authorized to originate the prefix. Kind regards, Job