RFC 1022

High-level Entity Management Protocol (HEMP)

📅 published October 1987, from ietf

THE HIGH-LEVEL ENTITY MANAGEMENT PROTOCOL (HEMP) 🦋

okay bestie, this is RFC 1022 and it's giving networking main character energy 💅 It's from the Network Working Group, written by C. Partridge (BBN/NNSC) and G. Trewitt (Stanford), dated October 1987 📅 The header doesn't list a category, and it doesn't say what it obsoletes or updates, so we're going off what's actually on the page 🫶

STATUS OF THIS MEMO ✨

so we're presenting an application protocol for managing network entities like hosts, gateways and front-end machines 🖥️ It's a component of the High-Level Entity Management System (HEMS) described in RFC-1021, so Readers MAY want to consult RFC-1021 while reading this one 📖 This memo also assumes you already know the ISO data encoding standard, ASN.1 🤓 Distribution of this memo is unlimited 💜

PROTOCOL OVERVIEW 🎀

the High-Level Entity Management Protocol (HEMP) gives you an encapsulation system and a set of services for communication between applications and managed entities 🦋 HEMP is an application protocol that leans on existing transport protocols to deliver HEMP messages to their destination(s) 🚚

it's targeted at management interactions between applications and entities, and it's believed to be suitable for both monitoring and control interactions 👀

HEMP gives you what the authors believe are the three essential features of a management protocol 👑:

a standard encapsulation scheme for all interactions 📦
an authentication facility that can be used both to verify messages and limit access to managed systems 🔐
the ability to encrypt messages to protect sensitive information 🫣

we'll get into each of these in the sections below 💖

PROTOCOL OPERATION 🌸

HEMP is designed to support messages, where a message is an arbitrarily long sequence of octets ✨

five types of messages are currently defined: request, event, reply, and protocol error, and application error messages. Reply, protocol error and application error messages are only sent in reaction to a request message, and they're collectively called responses 💅

two types of interaction are envisioned 🫶:

a message exchange between an application and an entity managed by that application
unsolicited messages from an entity to the management centers responsible for managing it

when an application wants to retrieve information from an entity, or give it instructions, it sends a request message to the entity 📨 The entity replies with a response: a reply message if the request was valid, or an error message if the request was invalid (e.g., failed authentication) 🙅‍♀️ It's expected there will only be one response to a request message, although the protocol does not preclude multiple responses to a single request 🤷‍♀️

protocol error messages are generated if errors are found while processing the HEMP encapsulation of the message 🧁 The possible protocol error messages are described later in this document. Non-HEMP errors (like errors during processing of the contents of the message) are application errors 🧠 The existence of application error messages does not preclude the possibility that a reply will have an error message in it 📝 It's expected that the processing agent on the entity MAY have already started sending a reply message before an error in a request message is discovered 😭 So application errors found during processing MAY show up in the reply message instead of a separate application error message 💀

in certain situations, like on secure networks, returning error messages MAY be considered undesirable 🙈 So entities are not REQUIRED to send error messages, although on "friendly" networks, the use of error messages is encouraged 🌈

event messages are unsolicited notices sent by an entity to an address, which is expected to correspond to one or more management centers. (A single address MAY correspond to a multicast address, and thus reach multiple hosts 🦋) Event messages are typically used to let entities alert management centers about important changes in their state, like when an interface goes down or the entity runs out of network buffers 🚨

STANDARD MESSAGE FORMAT 🧚

every HEMP message is put in the general form shown in Figure 1 🎀

                     +-------------------------------+
                     :           leader              :
                     +-------------------------------+
                     :       encryption section      :
                     +-------------------------------+
                     :    reply encryption section   :
                     +-------------------------------+
                     :     authentication section    :
                     +-------------------------------+
                     :          common header        :
                     +-------------------------------+
                     :              data             :
                     +-------------------------------+

Figure 1: General Form of HEMP Messages

each message has five components 🧩 (the original spells out six items, so here they are as written):

the leader, which is simply the ASN.1 tag and message length 🏷️
the encryption section, which provides whatever information the receiver MAY require to decrypt the message 🔓
the reply encryption section, in which the requesting application MAY specify the type of encryption to use in the reply 🪄
the authentication section, which allows the receiver to authenticate the message 🛂
the common header, which identifies the message type, the HEMP version, and the message id 🪪
the data section 📦

all four sections following the leader are also ASN.1 encoded. The ASN.1 format of the message is shown in Figure 2 🤓

          HempMessage ::= [0] IMPLICIT SEQUENCE {
              [0] IMPLICIT EncryptSection OPTIONAL,
              [1] IMPLICIT ReplyEncryptSection OPTIONAL,
              [2] IMPLICIT AuthenticateSection OPTIONAL,
              [3] IMPLICIT CommonHeader,
              [4] IMPLICIT Data }

Figure 2: ASN.1 Format of HEMP Messages

the ordering of the sections is significant!! 🚨 The encryption section comes first so that all succeeding sections (which MAY contain sensitive information) MAY be encrypted 🔐 The authentication section comes before the header so that messages which fail authentication can be discarded without header processing 🗑️ It's giving efficiency and security at the same time 😤

THE ENCRYPTION SECTION 🔐

Need For Encryption

encryption MUST be supported in any management scheme 🫶 A certain amount of monitoring information is potentially sensitive. For example, imagine an entity maintains a traffic matrix, which shows the number of packets it sent to other entities. A traffic matrix like that can reveal communication patterns in an organization (like a corporation or a government agency) 👀 Organizations concerned with privacy MAY wish to employ encryption to protect this kind of information 🛡️ Access control makes sure only people entitled to request the data can retrieve it, but it doesn't protect against eavesdroppers reading the messages. Encryption protects against eavesdropping 🕵️‍♀️

encryption in HEMP does not protect against traffic analysis. It's expected that HEMP interactions will have distinct signatures, so a party that can observe traffic patterns MAY guess at the sort of interactions being performed, even if the data being sent is encrypted 😬 Organizations concerned with security at this level SHOULD additionally consider link-level encryption 💜

Format of the Encryption Section

the encryption section contains any data REQUIRED to decrypt the message. The ASN.1 format of this section is shown in Figure 3 🧾

          EncryptSection :: = IMPLICIT SEQUENCE {
                encryptType INTEGER,
                encryptData ANY
          }

Figure 3: ASN.1 Format of Encryption Section

if the section is omitted, then no decryption is REQUIRED 🙌 If the section is present, then the encryptType field contains a number defining the encryption method in use, and encryptData contains whatever data (like a key) the receiver MUST have to decrypt the remainder of the message using the type of encryption specified 🔑

currently no encryption types are assigned 🥲

if the message has been encrypted, data is encrypted starting with the first octet after the encryption section 🎀

THE REPLY ENCRYPTION SECTION 🦋

Need for Reply Encryption

the reasons for encrypting messages have already been discussed, so we're not going back there 🙃

the reply encryption section lets management agents request that responses be encrypted even though the requests are not encrypted, or that responses be encrypted with a different key, or even a different scheme from the one used to encrypt the request 🪄 A good example is a public key encryption system, where the requesting application needs to pass its public key to the processing agent 🗝️

Format of the Reply Encryption Section

the reply encryption section contains any data REQUIRED to encrypt the reply message. The ASN.1 format of this section is shown in Figure 4 🧠

          ReplyEncryptSection :: = IMPLICIT SEQUENCE {
                replyEncryptType INTEGER,
                replyEncryptData ANY
          }

Figure 4: ASN.1 Format of Reply Encryption Section

if the section is omitted, then the reply SHOULD be encrypted in the manner specified by the encryption section ✨ If the section is present, then the replyEncryptType field contains a number defining the encryption method to use, and replyEncryptData contains whatever data (like a key) the receiver MUST have to encrypt the reply message 🔑

if the reply encryption section is present, then the reply message MUST contain an appropriate encryption section, which indicates that the encryption method requested in the reply encryption section is in use. The reply message SHOULD be encrypted starting with the first octet after the encryption section 📜

if the reply encryption method requested is not supported by the entity, the entity MAY not send a reply 🙈 It MAY, at the discretion of the implementor, send a protocol error message 🧁 (See below for descriptions of protocol error messages.)

currently no encryption types are assigned 🥲

THE AUTHENTICATION SECTION 🛂

Need for Authentication

Okay so sometimes an app needs to check one of two things, or both: that a message really came from the entity it says it came from, and/or that whoever sent it is allowed to make a monitoring request in the first place 🕵️. Picture this: an entity sends an event message to a monitoring center saying a trunk link is unstable. Before the monitoring folks reroute traffic around the bad link (or send someone out for a service call), it would be nice to confirm the event actually came from that entity and not from some prankster 🙈. That's what authentication is for. It lets entities authenticate their event messages, and it's giving security 🔐.

Another use of the authentication section is access control 👑. Requests take up processing time on the entity. When the entity is a critical node, like a gateway, we want to limit requests to authorized applications. So we can use the authentication section to make sure only specially authenticated applications get to request processing time.

Also, worth noting: in some cases the encryption method may also implicitly authenticate a message 🦋. In those situations, the authentication section SHOULD still be present, but it uses a type code that says authentication was provided by the encryption method.

Format of the Authentication Section

The authentication section holds whatever data the receiver needs to authenticate the message 💖. The ASN.1 format of this section is shown in Figure 5.

         AuthenticateSection :: = IMPLICIT SEQUENCE {
                authenticateType INTEGER,
                authenticateData ANY
               }

Figure 5: ASN.1 Format of Authentication Section

If the section is omitted, the message is not authenticated. If the section is present, then authenticateType tells you what kind of authentication was used, and authenticateData carries the authenticating data 🎀.

This memo defines two types of authentication: a password scheme, and authentication by encryption method 🌸. For the password scheme, the AuthenticateSection looks like Figure 6.

         AuthenticateSection :: = IMPLICIT SEQUENCE {
                authenticateType INTEGER { password(1) },
                authenticateData OCTETSTRING
          }

Figure 6: ASN.1 Format of Password Authentication Section

For the password scheme, authenticateType is 1, and the password is an octet string of any length 🔑. This scheme validates requests sent to an entity. When a request comes in, the entity checks the password against the entity-specific password assigned to it. If the passwords match, the request is accepted for processing. Lowkey, it's a slightly more powerful password scheme than the one currently used for monitoring on the Internet ✨.

For authentication by encryption, the AuthenticateSection has the format shown in Figure 7.

         AuthenticateSection :: = IMPLICIT SEQUENCE {
                authenticateType INTEGER { encryption(2) },
                authenticateData NULL
          }

Figure 7: ASN.1 Format of Encryption Authentication Section

This section just says that authentication was implicit in the encryption method 🧚. Recipients of these messages SHOULD confirm that the encryption method really does provide authentication.

No other authentication types are defined right now 💅.

If a message fails authentication, it SHOULD be discarded 🚫. If the authentication type on the message is unknown, or the section is omitted, the message MAY be discarded or processed, at the discretion of the implementation. It is RECOMMENDED that requests with unknown authentication types be logged as potential intrusions, but not processed 👀.

THE COMMON HEADER ✨

The common header holds the generic info about the message, like the protocol version number and the type of request 📋. The ASN.1 format of the common header is shown in Figure 8.

           CommonHeader ::= IMPLICIT SEQUENCE {
               link IMPLICIT INTEGER,
               messageType IMPLICIT INTEGER,
               messageId IMPLICIT INTEGER,
               resourceId ANY
           }

Figure 8: ASN.1 Format of Common Header

link tells you which version of HEMS is in use 🌈.

messageType is a value saying whether the message is a request (0), reply (1), event (2), protocol error (3) or application error (4) message 💜.

messageId is a unique bit identifier. It gets set in the request message and echoed back in the response, so applications can match each response to its request 🎯. Applications SHOULD choose messageIds so that a substantial period of time passes before a messageId gets re-used by a particular application (even across machine crashes) ⏳.

Event messages use the messageId field too, to show the number of the current event message 🔔. By comparing messageId fields from lost events, event values may be detected. The event messageId SHOULD be reset to 0 on every reboot. By convention, the event message with messageId of 0 SHOULD always be a "reboot" event 🔄. (Facilities SHOULD be provided in the event message definition so that entities able to store messageIds across reboots can send the highest messageId reached before the reboot 💾.)

resourceId is defined for ISO compatibility. It matches the resource ID that the Common Management Information Protocol uses to identify the relevant ISO resource 🧩.

DATA SECTION

The data section holds the message-specific data 🍓. The format of the data section is shown in Figure 9.

                   Data ::= ANY

Figure 9: ASN.1 Format of Data Section

The contents of the data section are application specific. Except for protocol error messages, they're outside the scope of this memo 🙃.

TRANSPORT PROTOCOL

There's been a LOT of debate about the right transport protocol to use under HEMP 😭. Part of the problem is that HEMP is used for two different kinds of interactions: request-response exchanges and event messages. Request-response interactions can involve arbitrary amounts of data going both ways, and they are believed to need a reliable transport mechanism. Event messages are typically small and don't need to be reliably delivered 📦.

Public opinion seems to lean toward running HEMP over a transaction protocol (see RFC-955 for a general discussion) 💭. The problem is the community is still experimenting with transaction protocols, and lots of groups want to implement HEMP now. So this memo defines two transport protocols for use with HEMP 🫶.

Groups who want to use an implementation of HEMP and the HEMS in the near future SHOULD use a combination of the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) under HEMP. TCP SHOULD be used for all request-response interactions, and UDP SHOULD be used to send event messages. Using UDP to support the request-response interactions is strongly discouraged 🚨.

More forward-looking groups are encouraged to implement HEMP over a transaction protocol. In particular, experiments are planned with the Versatile Message Transaction Protocol (VMTP) 🔮.

PROTOCOL ERROR MESSAGES

Protocol error messages are so tightly tied to the definition of HEMP that it made sense to define the contents of the data section for them in this memo, even though the data section is usually considered application specific 💅.

The data section of every protocol error message has the same format, shown in Figure 10. That format was picked to agree with the error message format and ASN.1 type used for language processing errors in RFC-1024. The error codes were chosen so they don't overlap 🌷.

           ProtocolError ::= [APPLICATION 0] implicit sequence {
               protoErrorCode INTEGER,
               protoErrorOffset INTEGER,
               protoErrorDescribed IA5String,
           }

Figure 10: Data Section For Protocol Error Messages

protoErrorCode is a number that specifies the particular type of error encountered. The defined codes are:

0 - reserved <not used>
1 - ASN.1 format error. Some error has been encountered in parsing the message. Examples are an unknown type or a violation of the ASN.1 syntax.
2 - Wrong HEMP version number. The version number in the common header is invalid. This may be an indication of possible network intrusion, and it SHOULD be logged at sites concerned with security 🕵️‍♀️.
3 - Authentication error. Authentication has failed. This error code is defined for completeness, but implementations are strongly discouraged from using it 🙅‍♀️. Returning authentication failure information may aid intruders in cracking the authentication system. It is RECOMMENDED that authentication errors be logged as possible security problems 🔒.
4 - ReplyEncryption type not supported. The entity does not support the encryption method requested in the ReplyEncryption section.
5 - Decryption failed. The entity could not decrypt the encrypted message. This means the entity could not read the CommonHeader to find the messageId for the reply. In this case, the messageId field SHOULD be set to 0 🫠.
6 - Application Failed. Some application failure made it impossible to process the message 💀.

The protoErrorOffset is the number of the octet where the error was discovered. The first octet in the message is octet number 0 🔢.

The protoErrorDescribed field is a string that describes the particular error. It's expected to give a more detailed description of the error encountered 📝.

APPENDIX OF TYPES

This section lists all the ASN.1 types defined in this document 📚.

HEMP Types

          HempMessage ::= [0] IMPLICIT SEQUENCE {
              [0] IMPLICIT EncryptSection OPTIONAL,
              [1] IMPLICIT ReplyEncryptSection OPTIONAL,
              [2] IMPLICIT AuthenticateSection OPTIONAL,
              [3] IMPLICIT CommonHeader,
              [4] IMPLICIT Data }

       EncryptSection :: = IMPLICIT SEQUENCE {
           encryptType INTEGER,
           encryptData ANY
       }

       ReplyEncryptSection :: = IMPLICIT SEQUENCE {
           replyEncryptType INTEGER,
           replyEncryptData ANY
       }


       AuthenticateSection :: = IMPLICIT SEQUENCE {
           authenticateType INTEGER,
           authenticateData ANY
       }


       CommonHeader ::= IMPLICIT SEQUENCE {
           link IMPLICIT INTEGER,
           messageType IMPLICIT INTEGER {
               request(0), reply(1), event(2),
               protocol error (3), application error(4)
           }
           messageId IMPLICIT INTEGER,
           resourceId ANY
       }

       Data ::= ANY

Protocol Error Types

       ProtocolError ::= [APPLICATION 0] implicit sequence {
           protoErrorCode INTEGER,
           protoErrorOffset INTEGER,
           protoErrorDescribed OCTETSTRING
       }

References ✨

okay so this one's short but lowkey important 💅 the big reference is ISO Standard ASN.1 (Abstract Syntax Notation 1), and it's split into two parts:

International Standard 8824 -- Specification (meaning, notation) 📜
International Standard 8825 -- Encoding Rules (representation) 🎀

the other one is the current VMTP specification, which you can get from David Cheriton of Stanford University 🦋 that's the whole reference list, bestie, no cap 🫶

📦 where this page comes from

ietf: rfc1022 1987-10
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms