Summary

  • Resolution 202201.673 ratified AFPUB-2019-GEN-006-DRAFT03 in January 2022, accepting a mandate for AFRINIC’s own systems to create and publish AS0 ROAs over address inventory within the proposal’s unallocated and unassigned categories.
  • “AS0” expresses negative route-origin intent, but the institutional action is affirmative: select prefixes from an authoritative inventory state, authorise signing, publish verifiable objects, withdraw them before allocation or assignment, and correct mistakes.
  • A validator may classify a conflicting ordinary origin as RPKI Invalid, but that is a technical result, not legal invalidity. Each network still decides whether to monitor, de-preference, reject or ignore the signal.
  • The strongest case for the service is straightforward: address space recorded as unused can attract unauthorised announcements, and a signed statement that no ordinary origin is expected may reduce that opportunity. Its credibility depends on accuracy, narrow scope, rapid withdrawal and public auditability.
  • The sealed historical record proves proposal text and Board ratification. It does not prove delegation, code, key use, publication of any production object, validator observation, route rejection, outage, loss, false positive or measured security gain.
  • A legitimate implementation would produce a minimum publication receipt binding the policy version, inventory snapshot, derivation rule, signer authorisation, object set, repository location, exclusions, withdrawal condition, correction deadline, successor history and an explicit operator-discretion notice.

The act inside the resolution

The important verb in Resolution 202201.673 is not merely ratify. It is publish. AFRINIC’s Board ratified AFPUB-2019-GEN-006-DRAFT03 in January 2022. The named proposal directed AFRINIC to create and publish RPKI AS0 ROAs covering unallocated and unassigned IPv4 and IPv6 address space for which AFRINIC was the current administrator. In operational terms, the Board accepted a job for the registry’s own inventory, certification keys and publication systems.

That job begins with a table, not a route. AFRINIC would have to take an authoritative inventory snapshot, distinguish the resource states that fall within the policy from those that do not, derive a set of covering prefixes, authorise a signing operation, generate the objects and place them in a repository that validators could inspect. When a resource was about to be allocated or assigned, the covering object would have to be revoked and removed first. If the inventory or derived set were wrong, the publication would need correction.

The word “negative” can obscure what happened. An AS0 ROA communicates negative origin intent: no ordinary autonomous system is expected to originate the covered address space. Yet producing that statement is an affirmative exercise of a private technical service. Someone selects data, applies a derivation rule, uses controlled keys, creates signed objects and publishes them. The signed assertion may then travel far beyond the institution that made it. That is why provenance and reversibility are not administrative extras. They are the basis on which the assertion can be trusted.

What the signal can—and cannot—do

A Route Origin Authorisation is signed information connecting an address prefix to expected origin behaviour. A validator compares a route announcement with the relevant signed material it can retrieve. If an ordinary origin conflicts with a covering AS0 ROA, route-origin validation can classify that announcement as RPKI Invalid. The capital letter matters because it names a technical validation state. It does not declare that the route, operator, holder or use is unlawful.

Nor does publication configure a router. A network that observes the state can log it, investigate it, lower a route’s preference, reject it or leave its treatment unchanged. RFC guidance preserves that local policy decision. Resolution 202201.673 did not reach into independent networks, and a network’s decision not to act on the signal is not an offence. The sequence remains: AFRINIC publishes; a validator observes and calculates; an operator decides.

The benign security case deserves to be made without euphemism. Address inventory recorded as unallocated or unassigned can be attractive to parties making unauthorised announcements. A signed AS0 object can give networks a verifiable indication that no ordinary origin is expected for the covered space. That may reduce ambiguity and shorten investigations. It may also make some unauthorised announcements less useful where operators choose policy that responds to the signal.

But the same mechanism gives an inventory error a cryptographic amplifier. If space has changed state and a covering object remains, a legitimate ordinary origin may appear Invalid to validators. Operators, rather than AFRINIC, would bear much of the immediate diligence and continuity cost. The resolution record before us proves no such false positive, just as it proves no security benefit. The point is structural: the potential benefit and the potential error arise from the same signed publication path.

A narrow institutional licence

AFRINIC is a private member-based technical bookkeeper and coordinator. It can maintain registry information and operate bounded certification services. Its Board can commit those internal systems to a properly scoped publication rule. Nothing in ratification turns AFRINIC into Africa’s legislature, regulator, police force or court. Community consensus may recommend a technical practice; it does not transfer sovereignty or ownership. Cryptographic force is not public authority.

This boundary clarifies rather than weakens the resolution. AFRINIC did not need sovereign power to publish a security assertion about inventory in its administrative records. It needed accurate records, a legitimate internal authorisation, disciplined key use, a narrow rule and a correction path. The object would be persuasive to the extent that independent parties could verify its provenance and decide voluntarily how to use it.

The historical states must therefore be kept separate. A proposal was written. Consensus preceded ratification. The Board ratified the proposal. Delegation, inventory selection, derivation, signing, repository publication, validator observation and routing response would each be a later and separately provable state. Official Board and policy records establish the ratification and the proposal’s direction. They do not establish that any production AS0 object was later created or acted upon.

The minimum controls

The publication mandate is defensible only if the word “unused” is treated as shorthand, never as a loose category. The operational input must be the exact unallocated and unassigned states defined by the policy, with exclusions, reservations, pending changes and holder-created objects reconciled. Prefix derivation should be deterministic: two competent reviewers given the same versioned inventory and rules should obtain the same set.

Authorisation and signing should be separated. Withdrawal must precede allocation or assignment, not follow it after a grace period that leaves a valid holder under an obsolete negative-origin statement. Reclaimed resources should enter the set only after reclamation is final. Corrections need a deadline, an accountable service and a successor history that lets observers see which objects replaced which. Independent measurement should distinguish publication from observation and observation from routing response.

The appropriate endpoint is a publication receipt. For every object set, it should bind the ratified policy version, inventory snapshot, derivation rules, signer authorisation, resulting object set, repository location, exclusions, withdrawal condition, correction deadline, successor history and operator-discretion notice. Such a receipt would let a member, validator operator or network engineer verify what AFRINIC asserted and why. It would preserve the useful security function without mistaking a private bookkeeper for a sovereign or a signed signal for a penalty.