Why can multiple ASNs have ROAs for the same prefix in RPKI?

Question

I am trying to understand RPKI better and I am looking at some raw data dumps. My initial understanding of RPKI was that it would help identify and authenticate "the one" ASN that is authorized to announce a specific prefix. But looking at raw data from https://console.rpki-client.org/, I can see that there the are often multiple ASNs that have an authorization to announce a prefix (via a valid ROA).

Example: https://rpki.cloudflare.com/?view=validator&validateRoute=57578_45.131.68.0%2F22

At first I thought these might be different ASNs of the same business entity, but that does not seem to be case the for the examples where I checked this.

I would like to understand what is the background of this or the underlying logic behind this? And is there any further structure to this, as in, is any of the ASNs preferred in any way if two different ASNs announce the same prefix? Looking at the data the only differentiation that might make sense is the duration of the validity of the records, maybe the one with the longest validity is preferred if one would need to decide between two ASNs?

Thanks a lot!

Answer 1

The obvious answer is: because the BGP specification allows it. There is no requirement that a single ASN advertises a specific prefix, your assumption that there can be only one ASN originating a prefix is wrong.

There are a number of common use cases for creating ROAs for originating prefixes from different ASNs:

1. BGP any cast allows a prefix to be announced by multiple ASNs at the same time. The best path will win. This is for example done with many of the root DNS servers.
2. When transferring prefixes from one network to another, you don’t want to haven to deal with updates and cache timeouts for ROAs, so you make sure the ROAs for the new ASN are present before it starts announcing the prefix, so the transition is as smooth as possible, without having to disable RPKI.
3. Some anti DDoS solutions work by advertising the prefix under attack from their ASN, drawing traffic to their scrubbing center. To do this, you need to have valid ROAs for the scrubbing center’s ASN as well as for the network advertising the prefix in peace time.

Answer 2

Anycast can be a valid use case requiring origination of the same prefix from multiple ASNs. ROAs would then provide protection against hijacking by listing the valid ASNs which can originate a given prefix.

Answer 3

It looks like Cloudflare tool is malfunctionning (not displaying some valid ROA I know, and displaying what you linked). You can use the RIPE tool instead.

An ROA is supposed to be unique.