The document summarizes RPKI (Resource Public Key Infrastructure) deployment status in Bangladesh. It finds that while some large internet providers have deployed RPKI, adoption remains inconsistent overall and several major operators are not performing route origin validation. Specifically, it notes 15% of IPv4 prefixes and 99% of IPv6 prefixes in Bangladesh are invalid due to maximum length issues, and examples are provided of valid and invalid route objects.

1. RPKI Deployment Status
in Bangladesh
Md Abdul Awal
#bdnog15

2. 2 v1.0
2
RPKI – South Asia
0
20
40
60
80
100
BT MV NP LK BD PK AF IN
Valid Not-Found Invalid

3. RPKI at a Glance

4. 4 v1.0
4
What makes a prefix RPKI Invalid
• Digitally signed object
q Binds list of prefixes and the nominated ASN
q can be verified cryptographically
• ** Multiple ROAs can exist for the same prefix
Prefix 203.176.32.0/19
Max-length /24
Origin ASN AS17821

5. 5 v1.0
5
RPKI Components
• Issuing Party – Internet Registries (*IRs)
q Certificate Authority (CA) that issues resource certificates to end-holders
q Publishes the objects (ROAs) signed by the resource certificate holders
APNIC
RPKI
Engine
publication
MyAPNIC GUI
rpki.apnic.net
Repository

6. 6 v1.0
6
RPKI Components
• Relying Party (RP)
q RPKI Validator that gathers data (ROA) from the distributed RPKI repositories
q Validates each entry’s signature against the TA to build a “Validated cache”
rpki.apnic.net
IANA Repo
APNIC
Repo
RIPE Repo
LIR Repo LIR Repo
RP
(RPKI
Validator)
Validated
Cache
rsync/RRDP
rsync/RRDP
rsync/RRDP
rsync/RRDP

7. 7 v1.0
7
Route Origin Validation
17821
65550
2406:6400::/48
65551
2406:6400::/48 65551 65550 17821 i
65552
65553
2406:6400::/48
2406:6400::/48 65553 65552 i
rsync/RRDP
Validator
Global
(RPKI)
Repository
RPKI-to-Router
(RTR)
2406:6400::/32-48
17821
ROA
2406:6400::/32-48
17821
Invalid
Valid

8. 8 v1.0
8
RPKI Validation States
ASN Prefix Max Length
65420 10.0.0.0/16 18
ASN Prefix RPKI State
VALID
VALID
INVALID
INVALID
NOT FOUND
65420 10.0.0.0/16
65420 10.0.128.0/17
65421 10.0.0.0/16
65420 10.0.10.0/24
65430 10.0.0.0/8
ROA
BGP Routes

9. RPKI Deployment Status

10. 10 v1.0
10
Bangladesh – ROA Adoption
https://stats.labs.apnic.net/roa/BD
Last updated: 30 Nov 2022
Inconsistent
Pattern

11. 11 v1.0
11
Bangladesh – INVALIDs
https://stats.labs.apnic.net/roa/BD
Last updated: 30 Nov 2022
IPv4 IPv6
Max_Len?

12. 12 v1.0
12
Bangladesh – INVALIDs
https://stats.labs.apnic.net/roa/BD
Last updated: 30 Nov 2022
15%
85%
0%
IPV4
INV:ML INV:AS INV:ASML
99%
1%
0%
IPV6
INV:ML INV:AS INV:ASML

13. 13 v1.0
13
Bangladesh – RPKI ROV
https://stats.labs.apnic.net/rpki/BD
Last updated: 30 Nov 2022

14. 14 v1.0
14
Bangladesh – RPKI ROV
Big operators are not doing ROV
https://stats.labs.apnic.net/rpki/BD
https://bgp.he.net/country/BD
Last updated: 30 Nov 2022

15. 15 v1.0
15
Bangladesh – Routing Incidents
https://observatory.manrs.org/
Last updated: 30 Nov 2022

16. 16 v1.0
16
Example: RPKI VALIDs
https://bgp.he.net/
Last updated: 30 Nov 2022

17. 17 v1.0
17
Example: RPKI INVALIDs
https://stats.labs.apnic.net/roa/BD
https://bgp.he.net/
Last updated: 30 Nov 2022

18. 18 v1.0
18
What Happens to Your INVALIDs
• Many big providers blocking it already
q Traffic may choose suboptimal path
• You may not realize if your INVALIDs are dropped
q Local providers might not drop it yet
• Your aggregated prefix might be VALID
q Hence no impact realized
q But TE might not work as expected

19. 19 v1.0
19
https://www.apnic.net/community/security/resource-certification/#routing

20. 20 v1.0
20
Any questions?

21. 21