Summary

  • Draft 3’s new rule was a meaningful restraint: AFRINIC should not turn a resource under reclamation into an AS0 assertion until the reclamation process has ended.
  • That sequencing matters because a registry entry can become signed routing evidence, a validator can classify a conflicting ordinary origin as Invalid, and individual networks can then impose different reachability consequences.
  • A correct AS0 object can give willing operators useful, authenticated warning about space that is genuinely unavailable for ordinary origin; the danger lies in signing an unfinished or disputed administrative claim.
  • The proposal did not define a public, reproducible test of finality, leaving unanswered questions about conflict isolation, challenge, correction timing and independent observation.
  • The proportionate answer is neither to forbid negative security metadata nor to elevate AFRINIC into an authority over holders and networks. It is to require a narrow, versioned finality record and preserve local operator choice.

The sentence that made finality matter

The most important word in the third version of AFRINIC’s AS0 proposal is not “authority”, “invalid” or even “reclaimed”. It is “end”. On 19 April 2021, Haitham El-Nakhal and Yazid Akanho submitted Version 3 of AFPUB-2019-GEN-006. The official revision history described its change as “Consideration on recovered resources”. The substantive addition said AFRINIC should add reclaimed resources only at the end of the reclamation process. In a document concerned with signed routing information, that apparently modest timing rule carries more institutional weight than its length suggests.

The sentence distinguishes an action in progress from a state ready to be represented to others. Reclamation is a process. Reclaimed is a conclusion. The first may involve notices, investigation, incomplete returns, competing accounts or administrative work that has not run its course. Those are examples of what a process could contain, not assertions that any such event occurred in connection with this proposal. The second is the ledger state on which the proposed automated creation of an AS0 Route Origin Authorization would rely.

By requiring the process to end first, Draft 3 implicitly recognised that starting recovery does not make the result true.

That distinction matters because an AS0 object is not merely another line in a private registry database. It is a signed statement designed for circulation through the Resource Public Key Infrastructure. The proposal covered unallocated and unassigned IPv4 and IPv6 space for which AFRINIC was the current administrator. It also preserved the separate ability of a resource holder to create AS0 ROAs for resources under that holder’s own account or administration. These are different voices. One expresses a holder’s negative origin intent for its resources.

The other expresses what AFRINIC’s inventory records say about space not allocated or assigned to a member. Draft 3’s recovered-resource sentence governs when the registry may place a previously different resource state into the latter category.

AS 0 has a specific technical meaning. It is not an ordinary BGP origin. An AS0 ROA communicates that a covered prefix is not expected to appear with an ordinary public origin. When a validator receives a relevant signed object and compares it with an observed announcement, the result can be Valid, Invalid or NotFound under route-origin validation. A conflicting ordinary origin under an AS0 object can be classified as Invalid. But that technical classification does not itself withdraw the announcement, erase it from BGP, determine who owns anything or compel a network to reject it. The relying network decides what to do next.

The Draft 3 sentence therefore sits at the start of a sequence with consequences far beyond the database field it governs. AFRINIC records that a prefix has reached a particular state. Its systems may then create and publish a signed object. Validators that choose the relevant trust path retrieve and process that object. Networks use the resulting classification according to their own routing policies: some may log it, some may de-prefer it, some may reject it and some may make no route change. An error at the first step does not mechanically produce one universal outcome, but it can propagate into many independent decisions.

“At the end” is the proposed brake on that propagation. It prevents, at least in principle, the signing system from treating a provisional administrative position as a completed condition. Suppose, as a test of the rule rather than a claim about any actual prefix, that a reclamation notice has been sent but facts remain unresolved. Suppose an internal investigation has begun, a return has been recorded incompletely, or two accounts of the resource state remain in conflict. None of those circumstances is necessarily equivalent to an ended reclamation.

If automation were to treat one as final, the registry would not simply be recording its work in progress. It would be distributing a negative assertion that other networks might act upon.

That is the false-positive boundary. A prefix can correctly appear in an AS0 set when the underlying state is accurate: genuinely unallocated, genuinely unassigned or finally reclaimed. It can appear there incorrectly when the publication system runs ahead of the state it is supposed to describe. The technical signature would still verify. The repository could still distribute it correctly. Validators could still calculate Invalid correctly. Operators could still apply their chosen policies correctly. Yet the overall outcome could be wrong because the signed premise at the beginning of the chain was premature.

This is why cryptographic correctness cannot substitute for institutional accuracy. A signature establishes a relationship between an object and a credentialed publisher. It helps a relying party determine that the object was issued within the relevant certification structure and has not been altered unnoticed. It does not prove that the private factual judgment encoded in the object was complete, fair or uncontested. If the registry state is wrong, cryptography can distribute a wrong statement with exceptional integrity.

The stronger the technical assurance around transmission, the more important the discipline governing the source state becomes.

The benign case for AFRINIC-generated AS0 objects is nevertheless strong. Space accurately recorded as unallocated, unassigned or finally reclaimed is not expected to have an ordinary public origin. A machine-readable, signed warning can give willing networks authenticated evidence of that expectation. It can reduce their dependence on manually assembled bogon lists that may become stale, differ across operators or lack a clear chain of responsibility. A registry is well placed to describe the inventory state it maintains, provided it describes that state narrowly and accurately.

Draft 3’s finality sentence strengthens this benign case rather than obstructing it. A security signal becomes more credible when its publisher refuses to use it during an unfinished recovery process. Waiting is not bureaucratic weakness here. It is an admission that operationally consequential metadata should trail a settled record, not help settle it. The rule says, in effect, that the negative assertion must be an output of completed bookkeeping, not leverage within the bookkeeping process.

That restraint also protects the distinction between description and punishment. AFRINIC is a private, member-based technical registry and coordinator. Its legitimate functions include maintaining unique-number records, administering a bounded certification service and publishing precise information about the state of resources in that service. It is not a sovereign, legislature, regulator, police force, prosecutor, punisher, confiscator or public-law court. An AS0 object cannot enlarge that institutional character.

If publication occurs before reclamation truly ends, however, the object can look and feel punitive to a network whose announcement is affected, even though the registry possesses no punitive power.

The proposal’s statement that only AFRINIC had the “authority” to create these ROAs for address space not yet allocated or assigned to members must be read in that confined sense. It refers to technical-administrative ability inside AFRINIC’s own certification and publication service. It does not establish title to a prefix, jurisdiction over a holder, power to decide a private conflict or control over the policies of a network that consumes validation data.

The same word becomes dangerous if it slides from “which credentialed publisher can issue this object?” to “which institution may conclusively determine rights for everyone?” Draft 3 supports the first proposition, not the second.

The official staff assessment gives the timing rule an operational setting. It interpreted unallocated and unassigned inventory by reference to available and reserved space in the extended delegated statistics file. It discussed upgrades to the inventory system, automation for current and incoming inventory, changes to issuance timing, updated internal controls and monitoring. New IANA or PTI prefixes would receive AS0 ROAs immediately, while returned or reclaimed prefixes would enter through the inventory process. This is not a purely rhetorical proposal: the contemplated design connected ledger classifications to automated publication.

Automation makes a clear finality boundary more important, not less. A person reading a contested file may hesitate, ask a question or notice that an apparent status conflicts with surrounding evidence. An automated rule executes the state it is given. It can apply the same decision across current inventory and future additions, consistently and at scale. Consistency is valuable when the classification is sound. When the classification is provisional, consistency accelerates the wrong thing. Draft 3 correctly placed an end condition before the automated transition, but it did not explain what evidence would satisfy that condition.

The public text leaves “the end” as an assertion rather than a reproducible result. It does not specify a public test for completed reclamation. It does not say how a conflicting claim would be represented, which conflicts would prevent publication, what an urgent challenge would look like, how quickly a mistaken object should be withdrawn, how external observers could confirm correction, or what record would connect the final ledger change to the published AS0 object. This is a criticism of what the public proposal defines, not a claim that no private note, internal procedure or additional record existed.

The distinction is essential to evidence discipline. The record establishes that Draft 3 was published, identifies its authors and date, preserves the broader AS0 design and adds the recovered-resource rule. It establishes what staff said implementation would require. It does not establish that the proposal was implemented, that any production AS0 object was created, that an operator adopted the feed, or that any prefix was wrongly classified. There is no evidenced false positive, rejected route, outage, holder loss or measured security gain before us.

The analysis concerns the design boundary created by the sentence, not a retrospective claim about an incident.

Seen this way, the addition is both precise and incomplete. It is precise because it tells the signing system not to jump from the beginning of reclamation to negative publication. It is incomplete because the reader cannot reproduce the judgment that reclamation has ended. A good boundary needs both a rule and an inspectable crossing. Draft 3 provided the rule. It did not provide the receipt.

The missing receipt should not be confused with a demand for a public court inside the registry. The question is narrower: what did the private publisher rely on before it changed a security-relevant state and signed the result? A suitable record would identify the affected prefix, the prior state, the trigger for change, the evidence reviewed, any unresolved conflicts, the bounded internal actor responsible for the transition, the effective time and the route for challenge. It would then connect that state change to publication, repository observation, any later withdrawal and the correction history.

Such a record would make the word “end” useful to parties who cannot see AFRINIC’s internal systems. An operator seeing an Invalid result cannot ordinarily infer whether the underlying prefix was never allocated, was returned cleanly, or entered the set after a recovery process. A holder questioning the state cannot diagnose the timing from a cryptographic object alone. An independent observer cannot compare the ledger transition with repository behaviour unless both are timestamped and linked. The receipt supplies context that the signed object was never designed to carry.

This is the central achievement of Draft 3’s sentence: it reveals that negative routing evidence is only as legitimate as the transition that precedes it. The line between “under reclamation” and “reclamation ended” is the line between an unsettled private process and a publishable resource state. Preserving that line allows AFRINIC to be useful without pretending to be sovereign. Making the crossing visible would allow others to trust the signal without surrendering judgment to the publisher.