Demystifying RPKI-Invalid Prefixes: Hidden Causes and Security Risks

Demystifying RPKI-Invalid Prefixes: Hidden Causes and Security Risks

Speakers: Weitong Li

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=zS4ZT9da-AM

Overview

RPKI (Resource Public Key Infrastructure) is the primary mechanism for securing BGP routing, allowing resource owners to create cryptographically signed Route Origin Authorizations (ROAs) that specify which Autonomous Systems are authorized to announce specific IP prefixes. Yet despite growing RPKI deployment (now covering 55% of routable IPv4 prefixes), over 7,000 RPKI-invalid prefixes appear in global routing tables every day -- and this number is not decreasing. This talk investigates why these invalid prefixes exist, expanding on prior work that explained approximately 80% of them as misconfigurations. By identifying previously undocumented causes including IP tunneling transit, direct IP leasing, and broker-mediated IP leasing, the researchers explain 97% of daily RPKI-invalid prefixes as misconfigurations rather than actual hijacks. Critically, the research reveals that even when alternate valid paths exist, 18% of invalid routes cause path divergence -- traffic flowing through unintended paths that degrade performance, bypass security defenses like DDoS protection, and in IP leasing cases create man-in-the-middle opportunities.

Background

▶ Watch: 7,000+ RPKI-invalid prefixes daily despite growing deployment (1:00)

BGP works through prefix announcements that build routing paths across the internet. Without security mechanisms, any AS can announce any prefix, enabling prefix hijacking. RPKI addresses this by allowing resource owners to create ROAs signed by Regional Internet Registries (RIRs), and routers performing Route Origin Validation (ROV) can filter announcements where the origin AS does not match the ROA.

Prior research identified two common causes of RPKI-invalid prefixes: same-organization misconfigurations (where two ASes controlled by the same organization misconfigure ROAs) and IP transit service misconfigurations (where transit providers create incorrect ROAs for customer prefixes). By reproducing prior work from seven years earlier, the researchers confirmed that these two causes explain approximately 80% of daily invalid prefixes, but over 1,500 invalid prefixes remained unexplained each day.

All Tier-1 ISPs now perform ROV filtering. If a route is RPKI-invalid, it will be filtered by these networks, potentially causing disconnection. However, over 95% of invalid routes have valid or unknown alternate paths, so disconnection is rare (only 3% of cases).

Key Findings

▶ Watch: New causes: IP tunneling, direct leasing, broker leasing (5:30)

Three newly identified misconfiguration categories: Beyond the known same-organization and transit misconfigurations, the researchers identified: (1) combined transit + same-organization scenarios, (2) tunneling transit (VPN/IPsec-based transit where the origin AS shows as the transit provider, leaving no BGP-visible relationship), (3) direct IP leasing (increasingly common as IPv4 exhaustion drives address market activity), and (4) broker-mediated IP leasing (through platforms like IPXO). With these additions, 97% of daily RPKI-invalid prefixes are explained as misconfigurations.

Path divergence affects 18% of invalid routes: Using active measurements (ping and traceroute) from 2,000 RIPE Atlas vantage points, the researchers found that while only 3% of invalid routes cause disconnection, 18% cause path divergence -- traffic flowing through different paths than intended. Traceroute measurements confirm additional latency, additional hops, and degraded performance.

Security risks from path divergence: When traffic diverges from its intended path, it may bypass security defenses like DDoS protection services positioned at the intended transit provider. In IP leasing scenarios, path divergence can route traffic through the leaser (IP address owner) instead of the lessee (actual user), creating an inadvertent man-in-the-middle situation -- particularly problematic when leaser and lessee may not even know each other (in broker-mediated leasing).

Misconfigurations persist without disconnection: When invalid routes cause disconnection, they are fixed quickly (most within one week, 35% within one day). But when no disconnection occurs (path divergence only), less than half are fixed within one week and over 20% persist for more than two months, because operators do not notice the misconfiguration.

Technical Deep Dive

▶ Watch: Methodology for identifying hidden service providers (7:30)

The research methodology combines BGP data analysis, WHOIS record examination, active measurements, and ISP interviews.

For classification, the researchers collect BGP routing tables from RouteViews and RIPE RIS over 18 months, validating each route against daily ROAs. Transit relationships are detected by checking whether the ROA's authorized origin AS appears in the BGP AS path. Same-organization relationships use AS-to-organization mapping datasets.

For newly identified categories, broker leasing is detected through WHOIS fingerprints (brokers change abuse contacts and other fields). Tunneling transit and direct leasing are harder to identify because they leave no evidence in BGP or WHOIS data. The researchers' approach identifies service provider ASes rather than individual prefixes, based on the hypothesis that providers with many customers will have multiple misconfigured ROAs (a single customer with a misconfigured ROA is more likely a one-off error).

Active measurements use ping and traceroute from 2,000 RIPE Atlas vantage points to determine whether RPKI-invalid prefixes experience disconnection or path divergence. Traceroute data reveals additional hops and latency introduced by path divergence.

The researchers interviewed 16 ISPs and leasing brokers to understand how misconfigurations occur in practice. Key findings include that ROA management teams are often separate from BGP operations teams with poor internal communication, and that even Tier-1 ISPs lack automated monitoring tools to detect ROA/BGP mismatches.

Demo / Proof of Concept

▶ Watch: Man-in-the-middle risk in IP leasing scenarios (10:30)

The active measurement campaign demonstrates real-world impact. Ping measurements from 2,000 RIPE Atlas vantage points confirm that 3% of RPKI-invalid prefixes experience disconnection and 18% experience path divergence. Traceroute measurements show the performance and security consequences of path divergence: additional hops, increased latency, and evidence of traffic flowing through unintended intermediate networks. The temporal analysis of fix rates reveals that misconfigurations without visible symptoms (no disconnection) persist for months, with over 20% unfixed after two months.

Defensive Implications

▶ Watch: Fix rates: path divergence misconfigurations persist for months (11:30)

For network operators, the finding that ROA management teams are often disconnected from BGP operations teams points to an organizational fix: automated monitoring that detects mismatches between ROAs and actual BGP announcements. The research shows that even major Tier-1 ISPs lack such monitoring despite deploying ROV filtering.

For IP address lessees, RPKI-invalid prefixes during IP leasing can route your traffic through the leaser's network -- an entity you may not know or trust, particularly in broker-mediated scenarios. Organizations leasing IP address space should monitor their prefixes' RPKI validation status and ensure ROAs are correctly configured.

For RIRs and policy makers, the IP leasing ecosystem lacks adequate tooling for ROA management during leasing transactions. The manual processes involved in direct and broker leasing are a primary source of misconfigurations. Better registration support and automated ROA provisioning during leasing would reduce invalid prefixes.

For security architects, the path divergence finding means that routing-layer security controls (DDoS protection positioned at specific transit providers, traffic monitoring at expected network points) may be bypassed by RPKI misconfigurations without any adversarial action.

Key Takeaways

• Over 7,000 RPKI-invalid prefixes appear daily; 97% are explained as misconfigurations, not hijacks
• Previously unidentified causes include tunneling transit, direct IP leasing, and broker-mediated IP leasing
• Only 3% of invalid routes cause disconnection, but 18% cause path divergence with performance and security impact
• Path divergence can bypass DDoS protection and create man-in-the-middle scenarios in IP leasing
• Misconfigurations without disconnection persist for months because operators do not detect them
• Even Tier-1 ISPs lack automated ROA/BGP mismatch monitoring despite deploying ROV
• IPv4 exhaustion is driving IP leasing, which creates new categories of RPKI misconfigurations

About the Speaker(s)

Weitong Li is a researcher working on internet routing security, BGP, and RPKI. The research is a collaboration with colleagues at Akamai and CAIDA Labs, combining BGP data analysis, active measurements, and ISP interviews to provide a comprehensive view of RPKI deployment challenges.