Krill is software for managing RPKI resources, including certificate issuance, route authorisations and publication to an RPKI repository. It is used by network operators to create and maintain the signed objects that route validators use when checking BGP origin data.
What Krill Does in RPKI Operations
Krill is not just a repository utility, it sits in the control plane for RPKI resource management. It issues certificates, creates route authorisations, and publishes signed objects that validators later use to check whether BGP origin data is authorised.
Why Krill Matters for Route Origin Validation
RPKI works because there is a signed chain of trust from a resource holder to the objects that describe which ASNs may originate which prefixes. Krill helps operators maintain that chain, so the main security value is reducing the chance that a validator accepts unauthorised origin data.
That matters because BGP itself does not authenticate origin claims. If the RPKI artefacts are missing, stale, or incorrectly published, relying parties may lose the ability to validate routes cleanly, which can create operational uncertainty and weaken route-hijack resistance.
Certificates, Authorisations, and Repository Publication
Krill’s three core functions map to the practical lifecycle of RPKI administration: certificate issuance establishes delegated authority, route authorisations define the permitted origin state, and repository publication makes the signed objects available to validators. Each step must stay consistent, because a break in one part of the chain can invalidate the others.
In practice, the integrity of the published repository is as important as the signing process itself. If publication is delayed, incomplete, or tampered with, downstream validators may see outdated or inconsistent state even when the operator believes the configuration is correct.
Operational Security Considerations for RPKI Resource Management
Krill is typically run by network operators as an authoritative system for routing security metadata, so its protection is part of the trust boundary around Internet routing. That makes access control, configuration discipline, and careful handling of signing material central to safe operation.
Because RPKI artefacts are security-critical and externally consumed, mistakes can become visible outside the organisation quickly. A bad publication can affect route acceptance, while a compromised management environment can undermine the authenticity of objects that validators depend on.
How Krill Fits Into the Wider Routing Trust Chain
Krill supports the administrative side of RPKI, but its effectiveness depends on the wider ecosystem: the operator’s inventory of resources, correct certificate relationships, repository availability, and the behaviour of relying-party validators. In other words, Krill helps produce trust material, but trust is only realised when the rest of the routing ecosystem consumes it correctly.
For practitioners, the key question is whether the signed data being published still matches the intended routing policy and resource holdings. That is why RPKI systems are best understood as part of routing governance, not as a one-time setup task.
Risk and Threat Considerations
Krill introduces risk because it handles the authoritative objects that define who may originate routes. If its publication workflow is disrupted, misconfigured, or compromised, the result can be invalid attestations, loss of validator confidence, or exposure to route hijacking and accidental route withdrawal.
Failure mechanism: A stale certificate, incorrect authorisation, or compromised publication path can break the signed trust chain or cause validators to consume incorrect routing state.
Impact: Organisations may lose routing integrity, create avoidable outages, or weaken protection against unauthorised BGP origin announcements.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-57 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Krill manages signing and authentication material that controls trusted publication |
| AC-6 — Least Privilege | Krill administers sensitive routing authority and should be tightly scoped | |
| Recommendation — Protect RPKI signing material with lifecycle controls and rotate it on exposure or role change. Restrict Krill administration to the minimum roles needed to issue and publish RPKI objects. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions and Authorizations | Krill depends on controlled authorization for certificate issuance and repository publication |
| Recommendation — Map Krill administration and publication actions to explicit authorised roles and review them regularly. | ||
| CIS Controls v8 | 5 — Account Management | Krill governance depends on managing privileged administrative access to a security-critical service |
| Recommendation — Limit who can administer Krill and remove access promptly when responsibility changes. | ||
| NIST SP 800-57 | Key Management | Krill relies on cryptographic signing and lifecycle handling of keys and certificates |
| Recommendation — Apply formal key lifecycle rules to the cryptographic material that underpins Krill publications. | ||
Practitioner Guidance
Why practitioners should care: Krill is part of the trust infrastructure for Internet routing, so it should be treated like a security-sensitive control service rather than a routine admin tool. Operators should care about configuration accuracy, publication reliability, and the protection of the system that can change routing authority.
What to watch for: Treat unexpected changes in published objects, missing repository updates, or mismatches between intended policy and signed output as operational incidents. In RPKI, small administrative errors can have network-wide consequences if they alter what validators see.
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org