The Use of Maxlength in the RPKI draft-yossigi-rpkimaxlen-00 Yossi Gilad, Sharon Goldberg, Kotikalapudi Sriram

When used properly, the RPKI defeats subprefix hijacks  RPKI valid AS 666 fails to attract traffic! Path: AS 111 168.122.0.0/16 X RPKI invalid AS 666 Cyberbunker AS 34109 Path: AS 666 168.122.0.0/24 AS 111 AS 111 ROA: AS 111 168.122.0.0/16 RPKI RPKI 168.122.0.0/16

Loose maxlength  forged-origin subprefix hijack this attack is highly effective because 168.122.0.0/24 is unannouced  RPKI valid longest prefix match  AS 666 attracts all traffic for the subprefix! Path: AS 111 168.122.0.0/16  RPKI valid AS 666 Cyberbunker AS 34109 Path: AS 666, AS111 168.122.0.0/24 AS 111 AS 111 ROA: AS 111 168.122.0.0/16 to maxlength 24 RPKI RPKI 168.122.0.0/16

Maxlength misconfigurations are common! forged-origin subprefix hijack affects any ROA where maxlength m > prefixlen p, unless every subprefix of length m is announced in BGP 16% of the IP prefixes in ROAs have maxlength > prefixlen 89% of these are vulnerable to forged-origin subprefix hijacks Even large providers are vulnerable

https://github.com/yossigi/compress_roas Recommendations As a best common practice: Operators should refrain from using maxlength in ROAs Each ROA should instead have explicit lists of prefixes authorized to be originated by a single AS Whenever possible, use minimal ROAs where each listed prefix is originated in BGP. The RPKI already support this. No extra ROAs needed. To reduce the number of RPKI filtering rules, we developed software that RPKI local caches can use to compresses lists of prefixes from ROAs back to (AS, prefix,maxlength) tuples https://github.com/yossigi/compress_roas See also our technical report: http://eprint.iacr.org/2016/1015.pdf

Sometimes ROAs need to include unannounced prefixes AS 222 gives traffic-scrubbing service to AS 111 during DDoS attacks Path: AS 111 168.122.0.0/16 Path: AS 222 168.122.0.0/17 168.122.128.0/17 Scrubbing service AS 222 Scrubs traffic, relays to AS 111 AS 111 AS 111 168.122.0.0/16

Sometimes ROAs need to include unannounced prefixes Scrubbing would fail if there was only the ROA for announced pfx  RPKI valid Path: AS 111 168.122.0.0/16 RPKI invalid X Path: AS 222 168.122.0.0/17 168.122.128.0/17 Scrubbing service AS 222 RPKI invalid X AS 111 AS 111 RPKI 168.122.0.0/16 ROA: AS 111 168.122.0.0/16

Sometimes ROAs need to include unannounced prefixes Add a (non “minimal”) ROA for AS 222 that does not use maxlength  RPKI valid  RPKI valid Path: AS 111 168.122.0.0/16 Path: AS 222 168.122.0.0/17 168.122.128.0/17  RPKI valid Scrubbing service AS 222 ROA: AS 222 168.122.0.0/17 168.122.128.0/17 AS 111 AS 111 RPKI 168.122.0.0/16 ROA: AS 111 168.122.0.0/16