Do RPKI Updates Affect the Internet's Stability?

The Resource Public Key Infrastructure (RPKI) has become the Internet’s primary defense against route hijacks and origin misconfigurations. It is a cryptographic framework designed to secure the Border Gateway Protocol (BGP), which Internet Service Providers (ISPs) rely on to exchange routing information through updates.

This framework allows operators to issue certificates called Route Origin Authorizations (ROAs) that authorize Autonomous Systems (ASes) to announce their prefixes. Operators can then configure their routers to allow authorized ASes and filter unauthorized ASes, a process called Route Origin Validation (ROV).

Every time an RPKI authorization changes, routers performing ROV may need to reconsider routing decisions. Those decisions can trigger new BGP updates, potentially adding load on the control plane. As RPKI adoption continues to grow, understanding this effect becomes increasingly important.

Our study examined eleven years of RPKI deployment history to quantify how many BGP updates are actually associated with RPKI-related activity and whether this volume poses a threat to Internet stability.

RPKI Is Growing Fast

One of the clearest results of the study is the remarkable growth of RPKI activity over time.

Figure 1 shows the evolution of changes recorded in the RIPE Archive between 2014 and 2025. The number of ROA additions, expirations, and revocations has increased dramatically over the past decade, reflecting both broader RPKI adoption and the increasing amount of address space being protected. Large spikes often correspond to major operational events such as certificate authority migrations.

The trend clearly shows that the RPKI ecosystem is growing, becoming more active, and increasingly operationally significant each year.

Why RPKI Is Not a Significant Source of BGP Noise

The central question of the study was whether this growth translates into a substantial increase in BGP update activity. To answer this question, we compare the number of updates registered by all RIPE RIS collectors during time windows with RPKI validation changes with the total number of updates collected outside these windows. Our measurements thus result in an overestimation of the total volume.

The answer is reassuring: across the entire measurement period, RPKI-related updates consistently accounted for less than 1% of all observed BGP updates.

Figure 2 show that while the percentage of RPKI-related updates has increased over time—as expected given growing adoption—the overall contribution remains extremely small compared with the vast volume of routing updates continuously exchanged across the Internet.

The picture becomes even clearer when looking at normal operating conditions. Outside a small number of exceptional peaks, the proportion of updates associated with RPKI events remains below 0.2% of total BGP updates. This is the noise introduced by a single chatty AS at the bottom of the BGP Instability Report ranking in July.

This said, there is indeed a visible upward trend. The volume of RPKI-related updates roughly doubled during the most recent observation period. However, that growth mirrors the expansion of RPKI deployment itself and remains negligible when compared with overall BGP activity.

What This Means for the Internet

These findings suggest that RPKI is not harmful to Internet stability. Instead, the observed increase in RPKI-related updates appears to be a natural consequence of the deployment of a security system that is steadily becoming an essential component of Internet routing.

Readers interested in the methodology, datasets, and detailed analyses can find the complete results in our paper.

Samuele Quinzi is a PhD student in computer science at Università degli Studi Roma Tre and a researcher at UCLouvain.