What is RPKI?

RPKI stands for Resource Public Key Infrastructure. RPKI proves the association between specific IP address blocks or Autonomous System Numbers (ASNs) and the holders of those Internet number resources.

What is ARIN?

ARIN is the American Registry for Internet Numbers – the organization responsible for the management and distribution of Internet number resources such as Internet Protocol (IP) addresses and Autonomous System Numbers (ASNs) in several regions, including Canada.

What is Hosted RPKI?

Hosted Resource Public Key Infrastructure (RPKI) is an infrastructure in which ARIN hosts a Certificate Authority (CA) and signs all Route Origin Authorizations (ROAs) for resources within the ARIN region.

What is a Registration Services Agreement (RSA)?

An RSA is an agreement between your organization and ARIN regarding your IP address space and any ASNs you have. The RSA has undergone multiple version updates to enhance the power of the resource holder and to make use of Hosted RPKI.

What is a Legacy Registration Services Agreement (LSRA)?

An LRSA is a legacy agreement between your organization and ARIN regarding your IP address space and any ASNs you have. The current RSA Version 13.0 and LRSA Version 5.0 are a unified and single document. The RSA/LRSA has undergone multiple version updates to enhance the power of the resource holder and to make use of Hosted RPKI.

What is a legacy number resource?

A legacy number resource is an IPv4 address or Autonomous System Number (ASN) that was originally issued to the current registrant by an Internet Registry (InterNIC or its predecessors) prior to the inception of ARIN on December 22, 1997.

Is having a signed LRSA by the end of 2023 the only requirement to qualify for the Legacy Fee Cap?

Yes. Any new legacy resources brought under an LRSA as of January 1, 2024 onwards will fall under the standard Registration Services Plan fees. The opportunity to take advantage of the Legacy Fee Cap will expire January 1, 2024. All organizations with active LRSAs entered prior to January 1, 2024, will continue to have their fees limited. Any new legacy resources brought under an LRSA after January 1, 2024 will fall under the standard Registration Services Plan fees.

Can I review the ARIN Registration Services Agreement (RSA/LRSA) before beginning the registration process?

Yes. The standard ARIN RSA can be found here for review by an organization or their legal department. This agreement was released September 12, 2022, and is a combined RSA version 13.0/LRSA version 5.0.

Can I review the ARIN Registration Services Agreement (RSA/LRSA) before beginning the registration process?

Yes. The standard ARIN RSA can be found here for review by an organization or their legal department. This agreement was released September 12, 2022, and is a combined RSA version 13.0/LRSA version 5.0.

Can I see who has already signed an RSA agreement?

How do I create a RSA?

Inform ARIN that you are looking to participate in RPKI as you create your RSA. You may contact the Registration Services Help Desk at 1-703-227-0660 or by submitting an “Ask ARIN” ticket via your ARIN Online account to initiate creation of a RSA/LRSA.

What is an ROA?

A Route Origin Authorization (ROA) is a key component of RPKI where the legitimate IP resource holder makes a certifiable statement about which network Autonomous System (AS) should originate an IP prefix(es). ROAs may only be generated for Internet Number Resources listed on your resource certificate.

What is a Route Origin Validation (ROV)?

ROV is a security mechanism that allows you to verify the authenticity and accuracy of BGP announcements. ROV relies on data in RPKI.

What is a Resource Certificate?

An RPKI Resource Certificate identifies the IP resources that can be used when creating a ROA.

Does ARIN have plans to require resource holders to use RPKI?

There is no ARIN policy that requires the use of RPKI. RPKI is an opt-in feature with ARIN. However, a growing number of service providers require you to make Route Origin Authorizations (ROAs) for your resources before finalizing a business agreement (e.g., TELCO Systems, BYOIP).

What is the lifespan of an RPKI certificate?

At ARIN, RPKI Resource Certificates are set with a two-year lifespan, and they auto-renew after one year, resetting the two-year lifespan.

RPKI ROAs are created with a 90-day lifespan. They auto-renew after 80 days, resetting the 90-day lifespan.

Are there any practical examples for specific vendors on how to use RPKI?

Given the number of different routing platforms that could be used, we recommend looking at the vendor documentation for the equipment you have installed in your network for RPKI-specific configuration instructions.

Can I tell if an IP prefix route is under RPKI via Whois?

No, ARIN’s Whois does not show if statements have been made about IP resources in RPKI. Aside from running an RPKI validator, free third-party tools are available online that show the state of routing announcements or whether ROAs have been created for prefixes.

Is there a gateway router configuration template for configuring RPKI (Hosted and Hybrid)?

Given the number of different routing platforms that could be used, we recommend looking at the vendor documentation for the equipment you have installed in your network for RPKI-specific configuration instructions.

Only network operators that perform, or plan to perform Route Origin Validation (ROV) need RPKI-specific configurations to be applied to their routers. These operators typically provide transit for their downstream customers and announce routes to multiple other transit provider networks. If your network does provide route advertisements on behalf of other organizations, you do not need RPKI-specific configurations on your routers.

What if our organization does not have a public Autonomous System Number (ASN) assigned?

If your organization doesn’t have a public ASN assigned, your routing announcements are being handled by your upstream provider (your NREN Partner, for example). You can sign up for Hosted RPKI services and create ROAs for your IP resources using your provider’s ASN as the Origin AS.

What are the steps to complete the registration and use RPKI?

First, you must ascertain whether you own your IP space:

If YES, you will need to confirm direct allocation on the ARIN website.

If NO, check with your provider and confirm how they are addressing RPKI.

NOTE: If you do not own your ASN, work with your NREN Partner to determine the solution.

The application process for LRSA can be found here.

How can I find out if my organization’s IP space is “Directly Allocated” or “Reassigned or Reallocated?”

“Directly Allocated” refers to IP resources that ARIN has assigned specifically to your organization. On the other hand, “Reassigned or Reallocated” denotes IP resources you have obtained from an ISP.

To confirm if your IP resources are a direct allocation, log in to your ARIN Online account.

How can I determine what resources are not currently under agreement, and which are eligible as legacy resources?

• Log in to your account
• On the user dashboard, under ‘Account Snapshot,’ select Networks.

If any of your networks are not covered by an agreement, they will be highlighted in yellow.

• To limit the search to networks not under agreement, check the box in the search window and select the search button.
• Select the Ask ARIN link in the notes field below to begin the process to sign an agreement for any networks not covered.

How do I find out if my organization is currently under an RSA/LRSA?

• Log in to your ARIN Online account. On the user dashboard, under ‘Account Snapshot,’ select Organization Identifiers.
• Select the org ID you want to check for your agreement status.
• Scroll down the Organization Record page and look for the table labeled ‘Active Registration Services Agreement (RSA) Info’ to confirm your contract type, revision number and the date signed.
• If there is no active RSA Info table on the page, you do not have a signed agreement.

OR

• From the User Dashboard, select Organization Identifiers.
• Select Org ID link to check agreement status.
• On the Organization records page, in the org info, look for the membership status.
• If your organization is identified as a General Member or Service Member, you are under contract. If you are identified as Ineligible, you organization is not under agreement.

Why should I get an RSA signed this year?

There are two reasons to get your RSA signed as soon as possible:

1. There is a significant fee increase coming at the end of 2023.
2. It is a prerequisite for RPKI.

How do I access my ARIN account?

For any questions regarding your account, contact ARIN here.

You will need to ensure your registration is up to date.

How do I find out who is registered as the IP address space/ASNs Point of Contact at ARIN?

• Log in to your ARIN account. On the user dashboard, under ‘Account Snapshot,’ select Point of Contact Records

OR

• From an Internet browser navigate to arin.net and perform search for your IP address.
• Select Point of Contact Records

My RSA is signed. What’s next?

Confirm that you can manage RPKI. Once confirmed, review how to configure the hosted RPKI here.

There is also additional information and background on RPKI here.

How do I create an ROA?

Please note this could negatively affect your production network. Proceed with caution, and if you are not sure what to do, reach out to your NREN Partner for guidance. Visit ARIN’s website and follow the steps outlined here.

I have multiple network blocks listed in ARIN, what do I sign?

Create an ROA matching each route you are advertising.

How long does it take for new ROA to be published?

It can take up to an hour for the ROA to be created.

How do I confirm my RPKI status?

You can use either a public Looking Glass tool or one provided by your NREN Partner to confirm your status. The results of the tool will indicate your RPKI status as either Valid, Invalid, and Unknown as shown here:

What is a TAL?

ARIN’s Trust Anchor Locator (TAL) is a file that contains both the location of ARIN’s Resource Public Key Infrastructure (RPKI) repository and ARIN’s public key, which is used to cryptographically verify that ARIN has signed the artifacts within ARIN’s RPKI repository. The TAL is used with an RPKI Validator to verify the certificates and ROAs within ARIN’s RPKI repository. This validated information can then be used to make routing decisions in your network.

Should I be concerned about TALs?

No, TALs are used by ARIN, not individual organizations.

Who do I contact for guidance regarding RPKI, RSA, and/or ROA?

Your regional NREN Partner will be able to provide guidance on these topics.