RPKI and ROAs on 44Net
This page answers a recurring question:
Why can’t 44Net publish ROAs?
The short answer is that 44Net subnets are administered by ARIN under "legacy" status, and ARIN does not provide RPKI or IRR services for legacy resources that are not covered by an ARIN service agreement.
The basics
RPKI (Resource Public Key Infrastructure) is the system used to make cryptographically verifiable statements about Internet number resources.
A ROA (Route Origin Authorization) is one of those statements. It says which ASN is authorized to originate a prefix.
Route origin validation compares an announcement with validated ROA data. If no ROA covers the announced prefix, the result is NotFound. If a ROA covers it but none permits the announced origin ASN and prefix length, the result is Invalid. A matching authorization produces Valid. These states are defined in RFC 6811.
Providers decide which validation states they accept. A provider may reject a NotFound route without classifying it as Invalid.
What that means for 44Net
Before arranging service, confirm whether your provider accepts routes with a NotFound status. If it requires Valid, ask whether it can make an exception using ARDC's authorization and IRR records. See documentation ARDC can provide.
What is ARDC doing about it?
The foundation monitors the situation and available options as part of its responsibility to steward the address space. If and when there is a development worth sharing, ARDC will update the community. In the meantime, ARDC is happy to discuss exceptions with providers and customers on a case-by-case basis.
What about SWIP?
ARDC does not SWIP customer subnets, because the address space is leased to the customer, not transferred. We also cannot currently add customer- or provider-specific text to the parent ARIN Whois or RDAP record.
External references
- ARIN: Legacy Resources at ARIN
- ARIN: Routing Security Eligibility FAQs
- ARIN: Resource Public Key Infrastructure
- ARIN: Network Modifications