<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Joe,<div><br></div><div>Great work on ROA and RPKI.</div><div><br></div><div>Like you said, it is recommended to create ROAs for the prefixes that you advertise. In other words, create minimum number of ROAs to cover the exact prefixes that you advertise to avoid “Validated Hijack”.</div><div><br></div><div><div><br><blockquote type="cite"><div>On 23 May 2024, at 3:46 PM, Joseph Goldman <joseph@goldman.id.au> wrote:</div><div><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">i.e. say we had /22 ROA, 2x /23 ROAs and 4x /24 ROAs - are currently advertising the /22 and 2x /24's, so 2x /23's and 2x /24 ROAs are 'unused' in that we are not advertising those specific resources - would that cause issues with strict validators out in the wild?</div><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div><div style="caret-color: rgb(0, 0, 0); font-family: "Segoe UI"; font-size: 16px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"> My understanding reading through the RFC's is this should not be the case. If any ROA that matches the prefix for the origin AS exists it should be valid, regardless of other ROAs signed by the same resource holder etc.</div></div></blockquote><div><br></div><div><br></div><div>In the given example, there will be no issue in terms of validation. The announcements are covered by the ROAs and are valid, so they will be accepted, doesn’t matter whether the ROA covers other prefixes or ranges that are not visible in the global routing table.</div><div><br></div><div><br></div><div>Cheers,</div><div>Abdul Awal</div></div></div></body></html>