RPKI validates origin but not the path. BGPsec extends validation to the entire AS_PATH.
How BGPsec works: Each AS in the path signs the announcement. Receiving routers verify each signature.
What it prevents:
- Path shortening attacks (removing ASes)
- Path insertion attacks (adding ASes you didn't traverse)
Deployment challenges:
- Every router must support BGPsec
- Signatures add CPU overhead
- Can't validate through non-BGPsec ASes
Status: Standardized but rarely deployed. RPKI provides more practical near-term security.