RPKI Validator

Purpose & User Intent: The Routinator RPki Validator addresses the need for verifiable route-origin data by validating ROAs against published RPKI data. It serves network operators, ISPs, IXPs, data centers, and security teams who manage BGP policy and trust anchors. When verifying origin integrity or auditing ROA coverage, the tool provides deterministic results that support risk reduction and policy confidence.
Core Logic & Features: It ingests ROA data from live sources or caches, performs ASN-to-prefix matching with maximum length checks, and reports a per-input validity state (valid, unknown, invalid). Required capabilities include ROA parsing, CIDR matching, and cryptographic verification of ROA signatures; optional capabilities include offline mode, delta updates, batch processing, and exportable reports.
Inputs & Outputs: Inputs include a ROA data source, target prefix, origin ASN, validation mode, and a timestamp for data evaluation. Outputs report validity, matched ROAs, and a confidence score, with detailed notes on mismatches.
Algorithms & Calculations: For each input, the validator seeks a ROA that covers the prefix with a matching ASN. Valid if an ROA exists with asn == input ASN and max_length >= prefix length; unknown if no covering ROA is found; invalid if the prefix length exceeds the ROA's max_length or ASN mismatch occurs. Time-sensitivity and clock skew are handled via the data_time parameter.
Assumptions & Exclusions: Assumes ROA data is current and authoritative; does not simulate real routing behavior or analyze non-RPKI sources.