What is BGPsec?

BGPsec (BGP Path Security) is a BGP extension in which every AS signs the AS path, so receivers can verify the route's real path.

Standardised in RFC 8205, it replaces the ordinary AS_PATH with a BGPsec_Path attribute. When a router sends a route to an eBGP neighbour, it adds a signature covering the prefix, the previous signatures and the AS it is sending to. The signing keys belong to routers and are certified through the RPKI, so a receiver can check each hop's signature back to the origin. Route Origin Validation only checks who originated a prefix; BGPsec also proves the path wasn't forged or shortened along the way. Support is negotiated as a capability when the session opens, and towards a neighbour that doesn't speak BGPsec the router falls back to a plain AS_PATH.

The catch is deployment. The protection only holds if every AS on the path signs, and one non-participating network breaks the chain. Signing and verifying every update costs much more CPU than ordinary BGP, signed routes can't be aggregated, and routers need key management. As a result it has seen essentially no production use on the internet. Operators today combine ROV with filtering, and the effort to protect the path has largely moved to ASPA, which records each AS's providers in the RPKI and can catch many forged paths and route leaks without per-hop signatures. Expect to meet BGPsec mainly in discussions of routing security, not in router configs. The RPKI and Route Origin Validation lesson covers what origin validation can and can't stop, and where ASPA fits.