RPKI Validator

The validator analyzes RPKI data to verify ROA objects and route-origin authorization. It ingests ROA data from files, URIs, or archived repositories, then validates each ROA against a configured trust anchor using RFC-aligned rules. It reports per-prefix status (valid, invalid, not-found) and notes misconfigurations such as missing ROAs for a prefix or an overly restrictive max_length. The tool supports multiple sources for comparative audits and can present views for specific time windows, enabling operators to verify changes before deployment and to support security reviews by researchers.
Conceptually, the tool normalizes IPv4 and IPv6 prefixes, parses ROA objects, and applies origin validation logic. It checks that the originating AS matches an ROA's permitted AS set and that the prefix length does not exceed the ROA's max_length. It also validates the ROA's cryptographic signatures against a trusted TA list, tracks the validation state across sources, and can export results in machine-readable JSON or CSV. The implementation emphasizes deterministic behavior, reproducible results, and auditable traces suitable for incident investigations and compliance reporting.
Audience and differentiators: The validator is designed for operators, IXPs, and researchers who need an independent, standards-based view of ROA coverage. Its multi-source support, historical views, and export options distinguish it from ad-hoc checks, enabling efficient audits and change management. Use cases include pre-deployment verification, ROA lifecycle audits, and post-incident investigations into routing anomalies.