While RPKI is great, saying BGP will be “secure” once it’s deployed is not true. It’ll be more secure, sure. But RPKI only addresses origin validation, not pa

While RPKI is great, saying BGP will be “secure” once it’s deployed is not true. It’ll be more secure, sure. But RPKI only addresses origin validation, not path validation. It won’t stop me announcing your space spuriously provided it has your AS as the origin. Path-validation a la BGPSEC would be needed to stop that. But that’s an extremely difficult problem to solve given the amount of churn in the global routing table. The amount of crypto validation routers would need to do is prohibitive. And Moore’s law doesn’t help because as CPU power goes up so do the key sizes we need to use. Either way people should implement RPKI, or at least sign ROAs for their space. It’s easy to do and makes a bit improvement.