to advertise. Maximum prefix length The maximum prefix length is an optional field. When not defined, the AS is only authorised to advertise exactly the prefix specified. Any more specific announcement of the prefix will be considered invalid. This is a way to enforce aggregation and prevent hijacking through the announcement of a more specific prefix. When present, this specifies the length of the most specific IP prefix that the AS is authorised to advertise. For example, if the IP address prefix is and the maximum length is 22, the AS is authorised to advertise any prefix under , as long as it is no more specific than . So, in this example, the AS would be authorised to advertise , or , but not . RPKI route announcement validity When a ROA is created for a certain combination of origin AS and prefix, this will have an effect on the RPKI validity of one or more route announcements. They can be: VALID The route announcement is covered by at least one ROA INVALID The prefix is announced from an unauthorised AS. This means: There is a ROA for this prefix for another AS, but no ROA authorising this AS; or This could be a hijacking attempt The announcement is more specific than is allowed by the maximum length set in a ROA that matches the prefix and AS UNKNOWN The prefix in this announcement is not covered (or only partially covered) by an existing ROA Note that invalid BGP updates may also be due to incorrectly configured ROAs. Management There are open source tools available to run the certificate authority and manage the resource certificate and child objects such as ROAs. In addition, the RIRs have a hosted RPKI platform available in their member portals. This allows LIRs to choose to rely on a hosted system, or run their own software. Publication The system does not use a single repository publication point to publish RPKI objects. Instead, the RPKI repository system consists of multiple distributed and delegated repository publication points. Each repository publication point is associated with one or more RPKI certificates' publication points. In practice this means that when running a certificate authority, an LIR can either publish all cryptographic material themselves, or they can rely on a third party for publication. When an LIR chooses to use the hosted system provided by the RIR, in principle publication