RPKI adoption critical for quantum-safe internet routing

The internet’s foundational routing system remains exposed to daily hijacks and misconfigurations, creating a structural weakness that could undermine even quantum-resistant encryption, according to a recent technical assessment. While industry attention focuses on post-quantum cryptography (PQC) to counter future quantum computing threats, the Border Gateway Protocol (BGP) continues to operate without built-in authentication, leaving global traffic vulnerable to redirection and interception. This gap has prompted calls for immediate action on routing security as a prerequisite for any quantum-safe transition.

The routing security gap

BGP, the protocol that connects autonomous systems (ASes) across the internet, was designed in an era of mutual trust and lacks native mechanisms to verify route announcements. Any entity controlling an AS number can falsely claim ownership of IP address blocks, leading to traffic hijacking, service disruptions, or large-scale surveillance. The Resource Public Key Infrastructure (RPKI) was developed to address this flaw by allowing IP resource holders to cryptographically certify which ASes are authorized to announce specific address spaces. However, adoption remains uneven, with many operators treating RPKI as optional rather than essential infrastructure.

Despite years of advocacy by RIRs and early adopters, global coverage of Validated ROA Payloads (VRPs) remains incomplete. Some operators resist deployment due to perceived complexity or a belief that existing systems are sufficient. This inertia leaves the internet’s routing layer exposed to both accidental misconfigurations and deliberate attacks, which could escalate as quantum computing advances.

Quantum threats to the trust chain

The impending arrival of large-scale quantum computers poses an existential risk to current cryptographic systems, including RSA and Elliptic Curve Cryptography (ECC). These algorithms underpin not only transport-layer security (e.g., TLS) but also the RPKI trust architecture itself. If quantum attackers compromise RIR certificates, they could forge Route Origin Authorizations (ROAs), enabling "lawful" BGP hijacks with catastrophic consequences. Such attacks could disrupt communications for entire nations or industries, bypassing even the strongest application-layer encryption.

The interplay between routing security and quantum readiness creates a dual challenge. Post-quantum cryptography alone cannot protect data if the underlying path is compromised. Conversely, RPKI’s reliance on traditional public-key cryptography means its trust chain is vulnerable to quantum attacks unless modernized. This interdependence demands a coordinated approach to both routing security and cryptographic agility.

Engineering and policy hurdles

Integrating post-quantum cryptography into RPKI presents technical trade-offs. Candidate PQC algorithms often require larger public keys and signatures, straining the limited memory and processing power of BGP routers. Hybrid modes—supporting both traditional and post-quantum signatures—are seen as a transitional solution, but their implementation requires standardization and hardware upgrades. The Internet Engineering Task Force (IETF) and equipment manufacturers must address these challenges to ensure smooth coexistence during the transition.

Policy frameworks have historically overlooked routing security, focusing instead on endpoint protection and data encryption. Governments and international bodies are now urged to integrate RPKI and PQC roadmaps into national digital resilience strategies. Mandates, procurement policies, and regulatory incentives could accelerate adoption among internet service providers (ISPs) and enterprises, while R&D investments are needed to address technical bottlenecks.

A strategic imperative

The convergence of routing security and quantum defense represents a critical juncture for internet infrastructure. Delaying RPKI deployment until quantum threats materialize risks leaving the internet’s core vulnerable to both immediate and long-term attacks. Operators and policymakers must treat routing security as a foundational requirement, not an optional enhancement, to ensure the internet’s trustworthiness in an era of evolving threats.