The Resource Public Key Infrastructure (RPKI) has firmly established itself as the Internet’s primary line of defense against Border Gateway Protocol (BGP) route hijacks. By allowing network operators to cryptographically authorize specific Autonomous Systems (ASes) to originate designated IP prefixes, RPKI helps mitigate a vast range of accidental leaks, configuration errors, and malicious hijacking attempts. Yet, as its adoption accelerates globally, a lingering technical concern has persisted among network engineers and researchers: could the routine management of RPKI data itself become a destabilizing force for core Internet routing?
Every time a Route Origin Authorization (ROA) is created, modified, revoked, or allowed to expire, routers performing Route Origin Validation (ROV) must reconsider their routing choices. Those updated calculations can subsequently propagate through the global BGP ecosystem, generating additional update messages. In essence, RPKI introduces an entirely distinct class of cryptographic and administrative events capable of triggering dynamic routing shifts across the global network.
To determine whether this growing administrative overhead poses a measurable threat to internet stability, a team of researchers recently analyzed more than 11 years of comprehensive RPKI and BGP historical data. Their objective was to quantify precisely how much routing activity can be directly attributed to RPKI-related operational events over time. The findings offer significant reassurance to network operators worldwide, demonstrating that RPKI’s vital security guarantees are currently achieved with a remarkably minor impact on overall routing stability.
RPKI is Growing Fast Across the Global Internet Ecosystem
To accurately contextualize the study, researchers first examined how dramatically the RPKI ecosystem has evolved over the past decade. The evolution of RPKI changes observed between 2014 and 2025 illustrates a continuous upward trajectory. Throughout this period, the sheer volume of ROA creations, expirations, and revocations has scaled significantly across both IPv4 and IPv6 address spaces.
This persistent growth reflects the steady, widespread adoption of RPKI by network operators, alongside a growing percentage of global address space protected by cryptographic ROAs. Furthermore, regulatory initiatives, government guidelines, and aggressive industry best practices have successfully propelled deployment rates across enterprise, transit, and consumer networks alike.
The direct implication of this expansion appears straightforward at first glance. If every administrative RPKI modification possesses the theoretical potential to trigger downstream routing updates, then a rapidly multiplying number of RPKI events could theoretically translate into a compounding volume of BGP network activity. The core motivation driving the 11-year study was to investigate whether this resulting BGP activity remains negligible or whether it has grown to become operationally significant.
Building an 11-Year RPKI Time Machine
Measuring the precise operational impact of RPKI on BGP routing is considerably more challenging than it might initially appear to outside observers. The research required overcoming two major technical hurdles.
The primary obstacle involved identifying the exact temporal moments when RPKI changes can actually influence active routing paths. A ROA creation or revocation does not automatically guarantee an immediate routing change. The decisive factor is whether the specific set of cryptographic authorizations visible to validating routers actually changes. Researchers define these critical instances as RPKI events. A formal RPKI event occurs whenever a validated routing payload (VRP) becomes newly available or disappears from repositories, potentially altering validation states, influencing local routing decisions, and thereby prompting one or more BGP announcements.
The secondary obstacle centered on historical visibility. While observing recent RPKI activity in granular detail is feasible using modern tooling, capturing a comparable, high-fidelity view spanning over a decade required painstakingly reconstructing historical events from deep archival data.
To resolve these complexities, the research team engineered a specialized methodology combining historical RPKI records with extensive BGP update measurements. This custom framework essentially functioned as an 11-year RPKI time machine, allowing investigators to track how the downstream routing impact of RPKI has shifted from the early days of protocol deployment through to the modern era.
RIPE Archive and Flutter Data Validation
The empirical investigation relied heavily upon two complementary, high-resolution RPKI data sources to ensure robust and verifiable findings.
By cross-referencing historical data preserved within the RIPE Archive with modern real-time streaming data provided by Flutter, the investigators were able to bridge historical gaps and validate their analytical model. When researchers compared the volume of RPKI-related BGP updates identified using archive-derived historical events against those observed via live Flutter events during a substantial overlap period from May 2024 to August 2025, the results displayed striking alignment for both IPv4 and IPv6 networks.
This close correlation strongly suggested that the archive-based methodology provides a reliable, highly accurate estimation of historical RPKI-induced routing activity. Consequently, the research team possessed the necessary validation to confidently extend their analytical depth far beyond the limited temporal window covered by contemporary real-time telemetry tools.
RPKI is Not a Harmful Source of BGP Noise
The definitive conclusion of the 11-year study offers overwhelmingly positive news for the future of global internet infrastructure. When analyzing the fraction of all observed BGP updates associated with RPKI events over time, researchers discovered that while the relative proportion is indeed increasing, it remains exceptionally small when stacked against the massive total volume of routine BGP activity.
Even when utilizing aggressive analytical methodologies designed intentionally to overestimate the count of RPKI-induced updates, the observed contribution consistently remained well below one percent of total BGP update traffic.
At the same time, the data undeniably reveals a clear upward trend. As increasingly large portions of global address space become secured by cryptographic ROAs and a greater number of transit networks enforce strict Route Origin Validation, the absolute volume of RPKI-related routing activity naturally scales upward as well. This proportional growth is readily visible across both historical archive records and recent real-time measurements.
Nevertheless, the central takeaway remains clear. While the curve is ascending in tandem with global adoption, the absolute contribution of RPKI changes to overall BGP noise remains remarkably minor.
What Network Operators Should Focus On
From a pragmatic, day-to-day operational perspective, these empirical results offer deeply reassuring insights for network engineers considering or expanding their RPKI deployments.
First, the research provides robust, large-scale evidence that RPKI is not currently acting as a significant or disruptive source of unnecessary BGP noise. Although individual RPKI events can technically prompt localized routing updates, the cumulative volume of this traffic remains negligible on a global scale.
Second, the findings strongly imply that network operators should not view routing stability concerns as a legitimate barrier to adopting RPKI and Route Origin Validation. Provided that ROAs are managed with care and standard operational best practices are rigorously followed, the additional routing overhead introduced by cryptographic validation appears exceptionally small.
However, researchers emphasize that the operational monitoring story is far from complete. Because the accumulation of RPKI-related updates directly tracks the overall growth of global RPKI deployment, both metrics will continue to evolve. As ROV becomes a near-universal standard across autonomous systems, the operational footprint of RPKI will continue to be monitored by the research community. For now, after scrutinizing more than a decade of empirical measurements, the internet community can take comfort in knowing that RPKI’s vital security benefits are being successfully realized with a remarkably minimal cost to global routing stability.
Readers interested in diving deeper into the specific mathematical methodology, underlying datasets, and granular statistical analyses can access the complete published paper through academic channels. Samuele, a PhD student at Roma3 University whose research centers on interdomain routing instabilities, AS-level policies, and the operational measurement of RPKI, contributed to these findings.
Leave a Reply