RPKI Syncing: Delay in Relying Party Synchronization

The Resource Public Key Infrastructure (RPKI) enhances routing security by providing cryptographically verifiable objects containing the Autonomous System (AS) numbers authorized to originate IP address ranges. Relying Party (RP) software performs RPKI synchronization by downloading, validating, and processing data from RPKI Publication Points (PPs) that are then provided to the routers to decide on accepting or rejecting BGP announcements. While RPKI is gaining importance, synchronization delays can compromise BGP reactivity, causing ASes to accept outdated or invalid announcements and potentially leading to service disruptions. We study the causes of delay in RPKI synchronization by examining the key characteristics of the RPKI system, such as Route Origin Authorization (ROA) structures, RPKI operational modes, certificate chains, and the networking delays to access PPs. Our findings reveal that bundling multiple prefixes into a single ROA reduces validation delays by up to threefold. Depending on the ROA structure and publication infrastructure of delegated Certificate Authorities (CAs), they can reduce RP synchronization delays or inflate them by up to 90%. Some regions worldwide observe delays of a few milliseconds and others of several hundred milliseconds in accessing RPKI resources. Every additional 100 milliseconds of Round Trip Time (RTT) can delay the RP synchronization by up to 25 extra seconds.