Security Considerations for Transient Numeric Identifiers Employed in Network Protocols
draft-gont-numeric-ids-sec-considerations-06
| Document | Type | Active Internet-Draft (individual in sec area) | |
|---|---|---|---|
| Authors | Fernando Gont , Ivan Arce | ||
| Last updated | 2021-01-04 (latest revision 2020-12-05) | ||
| Stream | Internent Engineering Task Force (IETF) | ||
| Intended RFC status | Best Current Practice | ||
| Formats | plain text pdf htmlized (tools) htmlized bibtex | ||
| Reviews | |||
| Stream | WG state | (None) | |
| Document shepherd | No shepherd assigned | ||
| IESG | IESG state | Waiting for Writeup | |
| Action Holders |
(None)
|
||
| Consensus Boilerplate | Unknown | ||
| Telechat date | |||
| Responsible AD | Benjamin Kaduk | ||
| Send notices to | (None) | ||
| IANA | IANA review state | IANA OK - No Actions Needed | |
Network Working Group F. Gont
Internet-Draft SI6 Networks
Updates: 3552 (if approved) I. Arce
Intended status: Best Current Practice Quarkslab
Expires: June 8, 2021 December 5, 2020
Security Considerations for Transient Numeric Identifiers Employed in
Network Protocols
draft-gont-numeric-ids-sec-considerations-06
Abstract
Poor selection of transient numerical identifiers in protocols such
as the TCP/IP suite has historically led to a number of attacks on
implementations, ranging from Denial of Service (DoS) to data
injection and information leakage that can be exploited by pervasive
monitoring. To prevent such flaws in future protocols and
implementations, this document updates RFC 3552, requiring future
RFCs to contain analysis of the security and privacy properties of
any transient numeric identifiers specified by the protocol.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on June 8, 2021.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
Gont & Arce Expires June 8, 2021 [Page 1]
Internet-Draft Security Considerations for IDs December 2020
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Issues with the Specification of Transient Identifiers . . . 4
4. Common Flaws in the Generation of Transient Identifiers . . . 5
5. Security and Privacy Requirements for Identifiers . . . . . . 6
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
7. Security Considerations . . . . . . . . . . . . . . . . . . . 7
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 7
9.1. Normative References . . . . . . . . . . . . . . . . . . 7
9.2. Informative References . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9
1. Introduction
Network protocols employ a variety of transient numeric identifiers
for different protocol entities, ranging from DNS Transaction IDs
(TxIDs) to transport protocol numbers (e.g. TCP ports) or IPv6
Interface Identifiers (IIDs). These identifiers usually have
specific properties that must be satisfied such that they do not
result in negative interoperability implications (e.g., uniqueness
during a specified period of time), and an associated failure
severity when such properties not met.
The TCP/IP protocol suite alone has been subject to variety of
attacks on its numerical identifiers over the past 30 years or more,
with effects ranging from Denial of Service (DoS) or data injection,
to information leakage that could be exploited for pervasive
monitoring [RFC7258]. The root of these issues has been, in many
cases, the poor selection of identifiers in such protocols, usually
as a result of insufficient or misleading specifications. While it
is generally trivial to identify an algorithm that can satisfy the
interoperability requirements for a given identifier, there exists
practical evidence [I-D.irtf-pearg-numeric-ids-history] that doing so
without negatively affecting the security and/or privacy properties
of the aforementioned protocols is prone to error.
For example, implementations have been subject to security and/or
privacy issues resulting from:
Show full document text