What is ROA?

A ROA (Route Origin Authorization) is a signed RPKI object stating which AS may originate a prefix in BGP, and up to what prefix length.

A ROA contains an origin AS number and one or more prefixes, each with an optional maxLength. For example, a ROA might say that AS64500 may originate 203.0.113.0/24 with maxLength 24. It is signed with the resource certificate the RIR issued to the address holder, so anyone can verify it chains back to a trust anchor in the RPKI. Most holders create ROAs in their RIR's web portal (hosted RPKI). Validators fetch all published ROAs, check their signatures and reduce them to Validated ROA Payloads: (prefix, maxLength, origin AS) tuples that routers use for Route Origin Validation. A route is valid if a VRP covers it with the same origin and the route's prefix length is no longer than its maxLength, invalid if VRPs cover it but none match, and not found if nothing covers it.

Creating ROAs is one of the most useful routing-security steps a network can take, and also one of the easiest to get wrong. Every prefix you announce, IPv4 and IPv6, needs a matching ROA for every AS that originates it, including DDoS scrubbing providers or customers using your space. A ROA for a /22 doesn't authorise the /24s inside it unless maxLength allows them, so announcing a more-specific can make it invalid and dropped by networks that filter invalids. Setting maxLength looser than you need is the opposite mistake: it lets an attacker announce a more-specific with your AS forged as the origin and still validate. A ROA for AS0 says "this space should not be routed at all". The RPKI and Route Origin Validation lesson builds safe ROAs and validates real routes against them.