<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On 20 Sep 2022, at 2:29 PM, Randy Bush <<a href="mailto:randy@psg.com" class="">randy@psg.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">
<blockquote type="cite" class="">Does another barrier to entry make sense?<br class="">
</blockquote>
<br class="">
ROV's ROA creation is a barrier to entry in north america, as discussed<br class="">
in another thread or see<br class="">
<br class="">
<a href="https://scholarship.law.upenn.edu/faculty_scholarship/2035/" class="">https://scholarship.law.upenn.edu/faculty_scholarship/2035/</a></div>
</div>
</blockquote>
<br class="">
</div>
<div class="">Randy - </div>
<div class=""><br class="">
</div>
<div class="">I’d agreed in principle with the statement that "ROA creation is a barrier to entry in north america” –</div>
<div class="">as ARIN both started later with its RPKI service development and in some places has taken different </div>
<div class="">approaches due to liability concerns in the highly litigious US environment in which we operate. </div>
<div class=""><br class="">
</div>
<div class="">Noting such, it is also worth pointing out that in the three years since publication of the You/Wishnick</div>
<div class="">(UPenn) report, ARIN has made several significant changes in order to make our RPKI services more</div>
<div class="">usable both by those issuing ROAs as well as relying parties (e.g., integrating the RPKI service into </div>
<div class="">ARIN Online, adding support for hybrid ROA distribution model, allowing parties that wish to redistribute </div>
<div class="">ARIN RPKI repository to do so under agreement, allowing RPKI validator packages to distribute ARIN’s </div>
<div class="">TAL and use simple click acceptance of the RPA, and most recently issuing an update to the ARIN </div>
<div class="">RSA/LRSA which strikes much of the language in section 7 that gave pause to some organizations </div>
<div class="">during their legal review. These changes occurred after discussions & feedback from this community, </div>
<div class="">including in 2019 inviting Professor Yoo present his findings during the ARIN 43 meeting – </div>
<div class=""><<a href="https://www.arin.net/blog/2019/04/09/arin-43-day-2-daily-recap/" class="">https://www.arin.net/blog/2019/04/09/arin-43-day-2-daily-recap/</a>></div>
<div class=""><br class="">
</div>
<div class="">ARIN still has quite a bit to go with RPKI: we’ve only recently been doing focused training on RPKI </div>
<div class="">deployment; our RPKI user interface has colorful artifacts due to the requirement that organizations </div>
<div class="">externally digitally sign their ROA requests, and we lack any interface support for cross RPKI, IRR </div>
<div class="">& routing state reconciliation. Addressing these items is now underway and should help growth of </div>
<div class="">RPKI in the region, but I note that it is not holding back some organizations – ARIN has already seen </div>
<div class="">significant RPKI growth in 2021 and 2022. Just this year (January through the end of August) we have </div>
<div class="">gone from 2,334 to 2,931 orgs deploying RPKI and published ROAs going from 41,648 to 55,418. </div>
<div class=""><br class="">
</div>
<div class="">We have substantial IPv4 address space in the ARIN region and therefore quite a long way to go</div>
<div class="">before our ROA coverage as a percentage is comparable to other regions, but the surge in RPKI </div>
<div class="">deployment over the last two years already has the total of ARIN IPv4 space covered by ROAs </div>
<div class="">comparable to that of the RIPE region in absolute terms; see [1] below. I don’t dispute that “ROA </div>
<div class="">creation is a barrier to entry in north america” (and remains so until ARIN addresses some of the</div>
<div class="">remaining issues) but also believe that the characterization in the three year old report is not as </div>
<div class="">timely / valid as when first issued, as since that time there has been a noticeable surge in RPKI</div>
<div class="">deployment in the region.</div>
<div class=""><br class="">
</div>
<div class="">Thanks!</div>
<div class="">/John</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">John Curran</div>
<div class="">President and CEO</div>
<div class="">American Registry for Internet Numbers</div>
<div class=""><br class="">
</div>
<div class="">[1] <<a href="https://certification-stats.ripe.net/" class="">https://certification-stats.ripe.net</a>></div>
<div class=""><br class="">
</div>
<div class=""><img apple-inline="yes" id="15E553C1-5E87-4A0F-BDB0-3A13BF780150" width="311" height="240" src="cid:0B31B960-BD1A-4907-97DC-DBBE2078304C" class=""></div>
<div class=""><br class="">
</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
</body>
</html>