https://www.arin.net/resources/manage/rpki/ https://www.arin.net/resources/manage/rpki/ Basically, RPKI is to BGP as things like DKIM are to email, or DNSSEC i

https://www.arin.net/resources/manage/rpki/ https://www.arin.net/resources/manage/rpki/ Basically, RPKI is to BGP as things like DKIM are to email, or DNSSEC is to the DNS system. Different AS's announce route prefix's to attract packets from other AS's. Orgs like ARIN and such act as trust anchors (CA's, in Web of Trust parlance) for Network operators who use RPKI clients to validate incoming BGP announcements cryptographically against the trust anchor list. The idea would be that an Iraqi telco could announce they terminate a prefix they don't, blackholing the traffic originating from within their network to those prefixes, but they wouldn't get the cryptographic vouch by their RIR, so other AS's would ignore altering their routing tables. Insulating the damage to essentially inside the network that was making the fraudulent announcement. It could even still be worked around by people internal to that network as long as they cross into another AS's routing domain, say by VPN, which would then allow traffic to route as normal. There is the argument to be made that RPKI is only as useful as the numbering authorities are capable of maintaining a strict position of neutrality. Thus is the way of all of all Trust. It is alas, the best we have.