The BGPSEC theory is there but not sure if we can make a workable system.
On the other hand, verify is cheaper. My crappy laptop will do ~320k RSA-2048 verifications per second...
350 per core per second... you are way off at 100k/s.
If there is such a thing I'd really like to see setup to get it running / try it out myself as well.
do note there are ways to cache ssl data so connections are resumed / avoid handshake again for same user
60k/second across 24 cores, admittedly on very fast hardware (though not using all the cores that hardware has). Pretty much the same number on 16 cores.
In general, telling someone they're "way off" about performance and citing 6 year old benchmarks isn't a winning plan.
In any case, it's immaterial to what we're discussing. My slow laptop could verify all the signatures for a busy day of updates in a couple seconds, and it's clearly -possible- to put a big fraction of this horsepower in a router.
Apologize for the 'way off', its reach-able.
And agree its immaterial to signature checks, but since it was brought up...
Either way, there is probably something holding routers back from reaching that, would be fun to speculate.
How many internet routes change per second?
How many dollars per second would pay for enough CPU's to sign every changed route? I'd bet less than one... I'd guess 1000x less than one...
We both know there are still garbagey nets out there using ARM32, MIPS and who knows what else out there for control plane processing. Only the big guys are gonna upgrade to support this.
kern.version: JUNOS 18.XXX.X #0: XXXX-XX-XX 03:28:10 UTC builder@svl-junos-p001:/volume/build/junos/18.X/release/18.XXX.X/obj/powerpc/junos/bsd/kernels/JUNIPER-PPC/kernel
There certainly are some routers that use x86 based CPUs, but they're embedded versions which you'd be unlikely to use on a PC.
The first namely being that nobody is going to do that unless they have too much time on their hands and don't actually run a real network. "Just loading routes" into a router is not really that straightforward.
Raptor sells desktops with IBM POWER9 CPUs – https://www.raptorcs.com/content/base/products.html – they are expensive, and the same amount of money would buy you a much more powerful x86 system, but they exist.
This isn't as damaging as being able to advertise a smaller prefix because it won't send all traffic to you. It will just send from routers where your path is shorter than the original.
To actually prevent hijacking via path shortening attacks like this, you need a full BGPSEC implementation https://en.wikipedia.org/wiki/BGPsec which is a much higher barrier than RPKI because the crypto operations jump 1 or 2 orders of magnitude (signing every re-advertised route rather than just originated routes).
So RPKI gets the cert infra in place, but it doesn't really fully solve the problem.