RPKI – The required cryptographic upgrade to BGP routing
One of the things Cloudflare describes is their CT log for the RPKI, Cirrus.<p>I can see why they did that, CT was a huge benefit for the Web PKI and many of the things we did to the Web PKI are things they&#x27;d like to see happen for RPKI - more people using it, better technical compliance by issuers, more eyeballs on the problems, CT probably helped with some of those.<p>But the Web PKI is a vast sprawling mess. CT was necessary _because_ of that mess, we know we can&#x27;t stop it being a mess, so we needed technology that could cope. The RPKI is neither vast, nor sprawling, nor especially messy.<p>A big part of what drove improvements to the Web PKI was the effort by people with the power to get things changed. In the case of the Web PKI that&#x27;s Mozilla, the Mozilla community (since Mozilla is a charity) and to a lesser extent the big commercial vendors, Microsoft, Apple, Google, Oracle. CT was a _tool_ these players could use as part of that work, but on its own it didn&#x27;t get the job done.<p>But in RPKI there isn&#x27;t really an equivalent. Companies like Cloudflare don&#x27;t have anywhere near the clout to get this done. Even the backbone providers don&#x27;t. And if we&#x27;re to expect the RIRs to fix it, they don&#x27;t need any help getting insight on issuers when they themselves are the issuers.<p>So, Cirrus isn&#x27;t hurting anything, but I hope its creators had very limited expectations and expended minimal resources getting it up, because I doubt it&#x27;s a major part of the solution to our problems either.