Hi all, I'm writing the working group to initiate some conversation about a long-standing point of confusion in the RPKI ecosystem: the ROA MaxLength field. What is the ROA MaxLength field? ================================ The data format profile of RPKI ROAs allows an operator to specify the following fields: * 1 (one) Origin AS * one or more IPv4 or IPv6 prefixes * for each IP prefix, a so-called 'MaxLength' value Operators are allowed to create multiple ROAs with different Origin ASNs covering the same prefix, folks can mix-and-match as needed. The "MaxLength" feature essentially is a macro function (a 'shortcut'): when you create a ROA with the following parameters: Prefix: 2001:67c:208c::/48 MaxLength: 50 Origin AS: 15562 The above Prefix + Maxlength has the exact same meaning as: Prefix: 2001:67c:208c::/48 or 2001:67c:208c::/49 or 2001:067c:208c:8000::/49 or 2001:67c:208c::/50 or 2001:67c:208c:4000::/50 or 2001:67c:208c:8000::/50 or 2001:67c:208c:c000::/50 Origin AS: 15562 The confusion & an UX experiment proposal ========================================= I suspect that many people think that "xxx/48 maxlength 50" means "the /48, AND the four individual /50s" (mentally skipping over the intermediate /49s). Going back as far as 2011 [1] - the concept of "MaxLength" appeared less than straight-forward, the quest for a good 'default setting' seems a challenge. My experience at NTT taught me that encouraging customers to create IRR "route:" or "route6:" objects that *exactly* match what people intend to announce in the BGP plane, greatly simpifies things. Just register what you want to announce, nothing more, nothing less. A proposal for UX experiment: would it be beneficial to HIDE the 'maxlength' field (for some period of time) in the RPKI ROA management system hosted by RIPE NCC? If the option isn't there, it can't confuse people. Wouldn't it be better to encourage people to create ROAs that align one-to-one with BGP announcements? (keep in mind: IRR route/route6 objects don't have the notion of maxlength). Or an enhancement: a button "also create ROAs for all /24s and /48s, but not the intermediate prefix lengths". This saves people a lot of clicking if they want to prepare for maximum de-aggregation. Is MaxLength used in the wild? ============================== Only 15% of Validated ROA Payloads (VRPs) under the RIPE NCC Trust Anchor have the MaxLength field set to something other than the aggregate Prefix Length. I'm not entirely convinced that accommodating the 15% is worth the hassle of explaining what the heck MaxLength is. Removing MaxLength from the UI does not in any way impact anyone's ability to create as many ROAs as they deem fit, it just forces people to be precise! :-) Thoughts? Kind regards, Job [1]: https://labs.ripe.net/author/alexband/using-the-maximum-length-option-in-roa...