On Wed, Aug 26, 2026 at 02:52:06PM +0200, Havard Eidnes wrote:
It is recommended to avoid using the maxLength attribute in ROAs. See BCP 185. https://www.rfc-editor.org/info/rfc9319/
Wait, what?!?
Is that just a wording issue, or did I totally mis-understand the whole purpose of RPKI ROAs?
I'll have to admit that I've not looked too closely under the covers, but to my mind, if I originate 192.168.0.0/16 into the routing system, and do not want to authorize any longer routes in this address space than this /16, do I not then use the maxLength attribute to say "16"? That's certainly what it looks like to me through the RIPE NCC RPKI ROA issuance assistant...
So isn't then the recommendation of BCP 185 to not authorize "too many" un-announced prefixes by having a large difference between the prefix length and maxLength in ROAs, rather than discouraging the use of maxLength altogether?
From an on-the-wire ROA encoding perspective the maxLength field is optional. If you do not wish to authorize longer-than-/16 routes for your /16, then you'd simply omit putting a value in that field. The RIPE NCC RPKI user interface is somewhat confusing in this regard: their ROA creation form mandates that a value be filled in the maxLength input field, and then the sbackend system which generates & signs the ROA will automatically omit the maxLength if the specified maximum length is equal to the prefix length. From a semantic perspective, there is no difference between omitting the maxLength field or explicitly setting the maxLength field to be the prefix length. RFC 9582 specifies: "The maxLength element SHOULD NOT be encoded if the maximum length is equal to the prefix length." source: I co-authored RFC 9582 and RFC 9319 / BCP 185. Kind regards, Job