RPKI：虽不完美但已足够好
RPKI: Not Perfect But Good Enough
AI总结：
本文首次全面评估RPKI作为生产级技术的成熟度，发现其实现仍存在软件漏洞、规范不一致等安全挑战，并提出了改进韧性及指导安全部署的建议。
摘要：
资源公钥基础设施（RPKI）协议被标准化以为互联网路由增加密码学安全性。如今已有超过50%的互联网资源受RPKI保护，该协议已对互联网流量的重要部分产生影响。除了日益广泛的采用外，RPKI也引起了越来越多的政治关注。白宫在2024年9月4日的《增强互联网路由安全路线图》中指出，RPKI是用于保障域间路由安全的成熟且现成的技术。该路线图将RPKI广泛采用的主要障碍归因于缺乏理解、缺乏优先级考虑以及行政壁垒。本研究首次全面评估了RPKI作为可行生产级技术的成熟度。我们发现，当前的RPKI实现仍缺乏生产级的韧性，并受到软件漏洞、规范不一致和运营挑战的困扰，引发了重大的安全担忧。部署环境缺乏在生产环境中全面实施严格RPKI验证的经验，且在故障开启的测试模式下运行。我们提供了改进RPKI韧性的建议，并指导利益相关者保护其部署免受新兴威胁。我们在当前RPKI规范和实现中发现的众多问题不可避免地引出了一个问题：RPKI是否足够稳定以符合白宫路线图所列的期望？诚然，它并不完美，但它足够好吗？正如我们将探讨的，答案因视角而异。
英文摘要：
The Resource Public Key Infrastructure (RPKI) protocol was standardized to add cryptographic security to Internet routing. With over 50% of Internet resources protected with RPKI today, the protocol already impacts significant parts of Internet traffic. In addition to its growing adoption, there is also increasing political interest in RPKI. The White House indicated in its Roadmap to Enhance Internet Routing Security, on 4 September 2024, that RPKI is a mature and readily available technology for securing inter-domain routing. The Roadmap attributes the main obstacles towards wide adoption of RPKI to a lack of understanding, lack of prioritization, and administrative barriers. This work presents the first comprehensive study of the maturity of RPKI as a viable production-grade technology. We find that current RPKI implementations still lack production-grade resilience and are plagued by software vulnerabilities, inconsistent specifications, and operational challenges, raising significant security concerns. The deployments lack experience with full-fledged strict RPKI-validation in production environments and operate in fail-open test mode. We provide recommendations to improve RPKI resilience and guide stakeholders in securing their deployments against emerging threats. The numerous issues we have discovered with the current RPKI specifications and implementations inevitably lead to the question: Is RPKI sufficiently stable to align with the expectations outlined in the White House roadmap? Certainly, it is not perfect, but is it good enough? The answer, as we will explore, varies depending on one's viewpoint.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
