What are RPKI and ROA, and what does a ROA authorize?

• A. RPKI binds prefixes to a specific origin AS; a ROA authorizes a particular AS to originate a given prefix.
• B. RPKI encrypts BGP updates end-to-end; a ROA signs the path to the destination.
• C. RPKI is a hardware security module; ROA is a routing policy.
• D. RPKI validates TTLs; ROA validates AS numbers.

Answer: (C)

RPKI is a PKI-based framework that cryptographically binds IP prefixes to the autonomous systems that originate them. The key artifact is the Route Origin Authorisation, a signed statement that allows a specific AS to originate a given prefix (and it can specify a maximum prefix length). Validators pull ROAs from trusted repositories, and routers use that data to determine whether a BGP route is valid, invalid, or unknown based on whether its origin matches a ROA. This mechanism helps prevent misoriginations and prefix hijacks by ensuring only authorized origins can announce a prefix. ROAs do not encrypt BGP updates or sign the path; they authorize the origin only. They are not hardware devices but signed objects used within the RPKI framework. In short, RPKI provides the trust framework, and a ROA explicitly authorizes a particular AS to originate a specific prefix (within the allowed length).