1. The Use of Maxlength in the RPKI draft-yossigi-rpkimaxlen-00
Yossi Gilad, Sharon Goldberg,
Kotikalapudi Sriram

2. When used properly, the RPKI defeats subprefix hijacks
RPKI valid
AS 666 fails to attract traffic!
Path: AS 111
/16 X
RPKI invalid
AS 666
Cyberbunker
AS 34109
Path: AS 666
/24
AS 111
AS 111
ROA: AS 111
/16
RPKI
RPKI
/16

3. Loose maxlength  forged-origin subprefix hijack
this attack is highly effective because /24 is unannouced 
RPKI valid
longest prefix match  AS 666 attracts all traffic for the subprefix!
Path: AS 111
/16 
RPKI valid
AS 666
Cyberbunker
AS 34109
Path: AS 666, AS111
/24
AS 111
AS 111
ROA: AS 111
/16
to maxlength 24
RPKI
RPKI
/16

4. Maxlength misconfigurations are common!
forged-origin subprefix hijack affects any ROA where
maxlength m > prefixlen p, unless
every subprefix of length m is announced in BGP
16% of the IP prefixes in ROAs have maxlength > prefixlen
89% of these are vulnerable to forged-origin subprefix hijacks
Even large providers are vulnerable

5. https://github.com/yossigi/compress_roas
Recommendations
As a best common practice:
Operators should refrain from using maxlength in ROAs
Each ROA should instead have explicit lists of prefixes authorized to be originated by a single AS
Whenever possible, use minimal ROAs where each listed prefix is originated in BGP.
The RPKI already support this. No extra ROAs needed.
To reduce the number of RPKI filtering rules, we developed software that RPKI local caches can use to compresses lists of prefixes from ROAs back to (AS, prefix,maxlength) tuples
See also our technical report:

6. Sometimes ROAs need to include unannounced prefixes
AS 222 gives traffic-scrubbing service to AS 111 during DDoS attacks
Path: AS 111
/16
Path: AS 222
/17
/17
Scrubbing service
AS 222
Scrubs traffic, relays to AS 111
AS 111
AS 111
/16

7. Sometimes ROAs need to include unannounced prefixes
Scrubbing would fail if there was only the ROA for announced pfx 
RPKI valid
Path: AS 111
/16
RPKI invalid X
Path: AS 222
/17
/17
Scrubbing service
AS 222
RPKI invalid X
AS 111
AS 111
RPKI
/16
ROA: AS 111
/16

8. Sometimes ROAs need to include unannounced prefixes
Add a (non “minimal”) ROA for AS 222 that does not use maxlength 
RPKI valid 
RPKI valid
Path: AS 111
/16
Path: AS 222
/17
/17 
RPKI valid
Scrubbing service
AS 222
ROA: AS 222
/17
/17
AS 111
AS 111
RPKI
/16
ROA: AS 111
/16