Summary

  • AFRINIC’s 4 November 2019 publication of AFPUB-2019-GEN-006-DRAFT01 proposed turning one registry classification—unallocated address space—into signed AS0 route-origin information.
  • The strongest case for the proposal was practical: a correctly scoped AS0 ROA could give operators an authenticated warning about ordinary origins from genuinely unallocated space, reducing dependence on separate, potentially stale manual lists.
  • The risk followed the same chain as the benefit. If the registry classification was wrong, or if the AS0 object remained available when the space entered legitimate use, relying operators could classify an ordinary origin as Invalid and apply their own rejection, de-preference, monitoring, or other policy.
  • The ROA itself would not delete a BGP route, and an Invalid result would not be a legal judgment. Operational effects would arise only when individual networks chose how to use the validation result.
  • A defensible design therefore required exact scope, visible provenance and change history, conflict checks, withdrawal coordinated before legitimate use, urgent correction, independent validator observation, and preserved operator choice.
  • The publication record proves that Draft 1 was proposed. It does not prove adoption, consensus, ratification, implementation, operational issuance, a routing incident, holder harm, or a measured security benefit.

A warning signed against the ledger

The institutional act on 4 November 2019 was easy to state but harder to bound. AFRINIC published AFPUB-2019-GEN-006-DRAFT01, the first proposal in this series, under which AFRINIC would originate AS0 ROAs for address space recorded as unallocated in its service data. One status in a private technical ledger would become the basis for a cryptographically signed routing-security assertion. The signal would say, in technical effect, that the covered space and its more-specifics were not expected to have an ordinary routable origin.

That was not a route withdrawal command. It was not a finding that somebody had acted unlawfully, not proof of ownership, and not a public judgment about a dispute. It was information for route-origin validation. A validator could evaluate the signed object within the relevant certificate chain and produce a validation state. An operator could then decide whether an Invalid result should lead to rejection, de-preference, an alert, an investigation, or no immediate routing change. The proposal’s practical reach therefore depended on two forms of participation: AFRINIC’s publication of the object and each relying network’s local policy.

This distinction matters because the word “invalid” can mislead readers outside routing operations. In this setting it is a technical classification. It does not mean that an address holder is legally invalid, that a route has been confiscated, or that an announcement disappears everywhere. The RPKI object supplies an input. Networks remain the decision-makers that turn the input into operational conduct, and they can do so differently. One network might only watch. Another might prefer other routes. A third might reject the affected announcement.

The consequences can therefore be uneven even when validators observe the same underlying signed assertion.

The attraction of the proposal came from coherence. If AFRINIC’s records accurately showed that a block was unallocated, then an ordinary public origin from that space was unexpected. The registry already maintained the classification on which such a warning would rest. Expressing that state through RPKI could let operators receive authenticated information through the same general validation system used for positive route-origin information. It could be more reliable than asking each network to assemble and refresh an independent list of unallocated resources whose provenance and update discipline might vary.

But coherence is not infallibility. A signed negative assertion is stronger than a note in an internal database precisely because it can travel. Validators retrieve it; operators may rely on it; local policies can alter route selection. The institutional question begins at the moment a ledger entry becomes portable evidence. If the source record is wrong, if a legitimate status change is not coordinated with withdrawal, or if corrected repository state is not visible to relying parties, the same mechanism that authenticated a useful warning can authenticate a stale one.

Draft 1 therefore deserves to be read through its reversibility problem. Publication was only one side of the design. Withdrawal was the other. A system that can make a negative assertion quickly but cannot reliably retire it before legitimate use does not merely contain a clerical inconvenience. It exports uncertainty to networks that did not create the registry entry, did not control publication timing, and still bear the customer and uptime consequences of acting on the signal.

The strongest case for AS0

Any serious assessment should begin with the best version of the proposal rather than with a caricature. Address space that is genuinely unallocated is not expected to be originated by an ordinary public ASN. A route observed from such space can be an event worth investigating. If the relevant allocation state is accurate, an AS0 ROA can communicate a narrow negative fact in authenticated form: no ordinary origin is expected for the covered prefix and more-specifics.

That can lower an operator’s monitoring cost. Without a common signed signal, networks may depend on manually obtained lists, local scripts, periodic exports, or other records whose freshness and provenance they must assess for themselves. Different operators may hold different versions of the supposed truth. A registry-originated object can reduce that fragmentation by linking the signal to the service data maintained for the relevant address space and making it available to validators through an established trust chain.

The benefit is not that AS0 “enforces” conservation. Its value lies in authenticated warning. The object can tell a relying party that the observed ordinary origin conflicts with the signed expectation. The operator still has to interpret that conflict in context and decide what to do. That local discretion is not a defect to eliminate; it is one of the safeguards that prevents a bookkeeping service from becoming a universal routing decision-maker.

AFRINIC was a plausible publisher for this narrow service because it maintained the allocation status on which the signal would be based. That proposition does not require treating AFRINIC as the owner of number resources or as an authority over the networks in its service region. It requires only a more modest institutional description: the registry can keep technically relevant records, authenticate the state it maintains, publish a scoped security assertion, and correct its own service output.

The benign case also helps reveal what accuracy must mean. It is not enough for the database to be broadly reliable or for most AS0 objects to be right. The consequence attaches to particular address space at particular moments. The relevant record must be accurate for the exact scope covered by the signed object. Publication must correspond to the declared source state. Legitimate transitions must be anticipated. Withdrawal and replacement must be observable. A warning whose value comes from specificity also needs specific controls.

Nor does the benign case prove that Draft 1 achieved those controls in operation. The documentary record establishes publication of the proposal, not its adoption or implementation. There is no verified operational issuance, affected prefix, prevented misorigination, false positive, or routing outcome in the available evidence. The useful question is one of institutional design: given the legitimate security objective, what conditions would make the warning trustworthy without allowing a private classification error to acquire disproportionate routing leverage?

The answer is not to deny the security problem. Genuinely unallocated space should not ordinarily appear with a normal public origin. Operators benefit from timely, authenticated evidence about such contradictions. The answer is to constrain the path from record to consequence. A narrow signal can be useful if it remains observational, auditable, reversible, and subordinate to operator choice. Its legitimacy is measured by the quality of the service and the boundedness of the assertion, not by an enlarged claim of institutional power.