RPKI now protects 70% of internet routes

Internet routing security has significantly improved as RPKI now protects 70% of routes, reducing the impact of misconfigurations and attacks.

Resource Public Key Infrastructure (RPKI) now protects 70.3% of internet routes, a significant increase from 54.0% a year ago, representing a 16.4 percentage point gain. This surge is primarily driven by China, which moved from 3.7% to 83.0% RPKI-valid IPv4 addresses in the past year. The growth in RPKI protection over the last year surpasses the combined gains of the two preceding years. While invalid routes are barely propagating, reaching only a few network points, this means that statistics previously inflated by broad invalid route visibility are now more accurate. IPv6 RPKI adoption has also accelerated, now surpassing IPv4 coverage with 79% of prefixes protected. However, RPKI does not validate routing paths, meaning attackers can still exploit loose ROA configurations to announce RPKI-valid routes, as seen in a recent hypervisor update attack.

The dramatic increase in RPKI adoption, particularly the substantial shift in China, indicates a growing global commitment to securing internet routing infrastructure. This acceleration suggests that the technology is maturing and being more widely adopted by major network operators. The improved RPKI coverage means that accidental or deliberate routing errors are less likely to cause widespread disruptions. Furthermore, the convergence of IPv4 and IPv6 coverage, with IPv6 now leading, signals a more unified approach to securing the internet's future address space.

Despite the increased coverage, the exploit demonstrated highlights that RPKI is not a complete solution for routing security. The ability for attackers to leverage loose RPKI configurations, specifically `maxLength` settings, indicates a need for better operator practices and potentially new standards to address this vulnerability. The concentration of unprotected addresses in the United States, particularly within the Department of Defense's announced space, points to specific areas that warrant attention for enhanced security measures.