New Data Format Shrinks RPKI Archives, Boosting Long-Term Routing Security Research
A new compact data representation promises to make it much easier to store and analyze the huge volume of RPKI data that helps keep internet routing safe from hijackers.
Have you ever wondered how the internet knows how to direct your data to the right place? It relies on a sprawling, ever-changing map called the Border Gateway Protocol (BGP), and like any map, it can be tricked. That’s where something called the Resource Public Key Infrastructure (RPKI) comes in. Think of it as a digital notary that verifies which networks are truly authorized to announce specific IP addresses, preventing malicious route hijacks that could redirect your traffic to fake websites.
But keeping a historical record of all those RPKI ‘certificates’ and signed objects has become a major headache. Because the system uses cryptography that constantly re-signs and re-checks itself, the data churns even when nothing really changes. As more and more networks adopt RPKI, now thousands of the roughly 80,000 network operators worldwide, the sheer volume of archive data has ballooned, making it expensive and unwieldy to store and study.
To solve this, researcher Job Snijders and his colleagues have proposed a clever fix within the Internet Engineering Task Force (IETF) standards process. Their solution, called the Canonical Cache Representation (CCR) and a companion RPKI Spool data model, strips away all the redundant churn. It repackages the essential validated information using well-established technologies like ASN.1 for binary encoding, Merkle trees for compact integrity checks, and zstd compression. The result is a dramatically smaller, more compressible archive that remains fast to process and share.
For the average internet user, this might sound like deep technical plumbing, but it has a real-world impact. A lighter, more sustainable RPKI archive means researchers and network defenders can better track routing health over time, spot anomalies, and improve the overall security of the internet’s backbone. It’s a quiet but vital piece of infrastructure that helps ensure the websites you visit really are the ones you intended to reach.
Just as RPKI protects the paths your data travels across the internet, safeguarding your own connection starts with a simple step: using an encrypted, privacy-first DNS service like AEU DNS ensures that your very first request, looking up a website’s address, is shielded from snooping and manipulation, adding a vital personal layer of defense.
How to protect yourself
- Switch your devices to use an encrypted DNS service (such as AEU DNS) to prevent your internet provider or anyone else from spying on or altering your website lookups.
- Always look for the padlock icon and ‘https://’ in your browser’s address bar—this encrypts your connection to websites, protecting you even if routing is hijacked.
- Ask your internet service provider or hosting company if they use RPKI to secure their network announcements; the more providers that adopt it, the safer the internet becomes for everyone.
- Keep all your software and devices updated, as attackers often exploit old bugs to build botnets that can be used to attack or impersonate networks.
- Consider using a reputable firewall or security suite that monitors outgoing connections for suspicious redirects, which can be a sign of a routing attack.
Source: blog.apnic.net