RFC 1038
Draft revised IP security option
RFC 1038: Draft Revised IP Security Option 🎀 (Part 1)
Okay bestie, the title block first because it's giving main character energy 💅
So this is RFC 1038, the Draft Revised IP Security Option ✨. It's from the Network Working Group 🧚 and written by M. St. Johns of the IETF 💖, dated January 1988 🍓. It's a pre-publication draft, and its status is informational since it's provided for informational purposes only 🦋. The header doesn't list anything it obsoletes or updates, so no drama there 💅.
Status of this Memo 📜
Okay so this is a pre-publication draft of the revised Internet Protocol Security Option 💅 It reflects the version the Protocol Standards Steering Group approved, and it's here for info only 🫶. The final version will come from Navy Publications, and it SHOULD NOT differ from this document in any major fashion 🙈.
This is getting published as a change to MIL-STD 1777, "Internet Protocol" 🌈. Distribution of this memo is unlimited 🦋.
9.3.13.1 Internet Options Defined 🌸
Okay, the list of internet options is literally a menu 🍽️. Here's the whole thing, every single row:
CLASS NUMBER LENGTH DESCRIPTION
_____ ______ ______ ___________
0 00000 - End of Option list: This option occupies
only 1 octet; it has no length octet.
0 00001 - No Operation: This option occupies only 1
octet; it has no length octet.
0 00010 var. Basic Security: Used to carry security
level and accrediting authority flags.
0 00011 var. Loose Source Routing: Used to route the
datagram based on information supplied by
the source.
0 00101 var. Extended Security: Used to carry additional
security information as required by
registered authorities.
0 01001 var. Strict Source Routing: Used to route the
datagram based on information supplied by
the source.
0 00111 var. Record Route: Used to trace the route a
datagram takes.
0 01000 4 Stream ID: Used to carry the stream
identifier.
2 00100 var. Internet Timestamp: Used to accumulate
timing information in transit.9.3.15.3 DoD Basic Security 🛡️
Option type: 130, Option length: variable; minimum length: 4 💜
So this option tells the internet which U.S. security level a datagram needs to be protected at 🔐, plus which accrediting authorities' protection rules apply to each datagram 🎀. Accredited trusted components of an internet use it to:
- a. Validate the datagram as appropriate for transmission from the source. ✅
- b. Guarantee that the route taken by the datagram (including the destination) is protected to the level required by all indicated accrediting authorities. 🛤️
- c. Supply common label information required by computer security models. 🏷️
Heads up bestie: this option MUST be copied on fragmentation 🚨 It also shows up at most once in a datagram 🙅
Here's the format of this option:
+--------------+-----------+-------------+-------------//----------+
| 10000010 | XXXXXXXX | SSSSSSSS | AAAAAAA[1] AAAAAAA0 |
| | | | [0] |
+--------------+-----------+-------------+-------------//----------+
TYPE = 130 LENGTH CLASSIFICATION PROTECTION
VARIABLE PROTECTION AUTHORITY
LEVEL FLAGS
FIGURE 10-A. SECURITY OPTION FORMAT9.3.15.3.1 Length 📏
The length of the option is variable 🌈 The minimum length option is 4.
9.3.15.3.2 Classification Protection Level 🔐
This field tells you the U.S. classification level the datagram SHOULD be protected at. The information in the datagram SHOULD be assumed to be at this level until and unless it gets regraded following the procedures of all indicated protecting authorities 🙃. This field picks one of the four U.S. classification levels, and it's encoded like this:
11011110 - Top Secret
10101101 - Secret
01111010 - Confidential
01010101 - Unclassified9.3.15.3.3 Protection Authorities Flags 🚩
This field shows the National Access Program(s) with accrediting authority whose rules apply to protecting the datagram 💜.
- a. Field Length: This field is variable in length. The low-order bit (
Bit 7) of each octet is encoded aszeroif it's the final octet in the field, or asoneif there are more octets coming. Right now only one octet is needed for this field (because there are fewer than seven authorities), and the final bit of the first octet is coded aszero. - b. Source Flags: The first seven bits (
Bits 0 through 6) in each octet are source flags, and each one is associated with an authority as indicated below. The bit corresponding to an authority isoneif the datagram is to be protected in accordance with the rules of that authority 🧃.
9.3.15.3.4 Usage Rules 🧠
Using this option means a host has to know two things 🤓 1) the classification level, or levels, it's permitted to operate at, and 2) the protection authorities responsible for its certification. How a host figures that out is implementation dependent. The rules for different types of hosts are below.
9.3.15.3.4.1 Unclassified Hosts, including gateways 🌷
- a. Output: Unclassified hosts MAY either use or not use the option. If it is used, the classification level MUST be unclassified, bit 0 of the accreditation field (
GENSER) MUST be one, and all other bits of the accreditation field MUST be 0. Using the option is allowed, but it is RECOMMENDED that unclassified hosts who want to maximize interoperability with existing non-compliant implementations not use the option 🤝. - b. Input: Unclassified hosts SHOULD accept for further processing IP datagrams without the option. If the option is present on an incoming IP datagram, the datagram is only accepted for further processing if the classification level is unclassified, bit 0 of the accreditation field (
GENSER) is one, and all other bits of the accreditation field are zero. Otherwise, the out-of-range procedure is followed 🚧.
9.3.15.3.4.2 Hosts accredited in the Dedicated, System-High, or Compartmented Modes at a classification level higher than unclassified 🏛️
- a. Output. The use of the option is mandatory. The classification level SHOULD be the dedicated level for dedicated hosts, and the system-high level for system-high and compartmented hosts. The accrediting authority flags SHOULD be
onefor all authorities which have accredited the hosts, andzerofor all other authorities. - b. Input. If 1) the option is present, 2) the classification level matches the host classification level, and 3) the accrediting authority flags for all accrediting authorities of the receiving host are
one, and all others arezero, the IP datagram SHOULD be accepted for further processing. Otherwise, the out-of-range procedure is followed.
9.3.15.3.4.3 Hosts accredited in the Multi-Level or Controlled Mode for network transmission 🌐
- a. Output. The use of the option is mandatory. The classification level of an IP datagram SHOULD be within the range of levels for which the host is accredited. The protection authorities flags SHOULD be
onefor all authorities under whose rules the datagram SHOULD be protected. - b. Input. In the specific case where a multi-level or controlled host is accredited to directly interface with an unclassified environment, the host MAY accept IP datagrams without a basic security option. Such datagrams SHOULD be assumed to be implicitly labelled unclassified,
GENSER, and SHOULD be so labelled explicitly if they are later output. In all other cases, the IP datagrams SHOULD have the basic security option on input, and the out-of-range procedure SHOULD be followed if it is not.
There are two cases to think about when the option is present 🧐 In the first, the system environment lets the values in the option be trusted as correct for some range of values. In the second, the values can't be trusted to be correct. For each multi-level or controlled host, every input channel for IP datagrams MUST be considered and classed appropriately. If a channel does have a trusted range, then both the classification level and the protection authorities values get checked to make sure they fall within that range and within the range of accredited values for the receiving host. If they're within both ranges, the IP datagram is accepted for further processing; otherwise the out-of-range procedure is followed. If the label can't be trusted, then the receiving host MUST possess some accredited means of knowing what the correct marking SHOULD be (for example, a trusted channel to a system-high host at a known level). On receipt of an IP datagram, the host compares the actual values in the option to the correct values. If they match, the datagram is accepted for further processing; otherwise, the out-of-range procedure is followed.
9.3.15.3.4.4 Out-Of-Range Procedure 🚧
If an IP datagram comes in that doesn't meet the input requirements, then:
- a) The data field SHOULD be overwritten with ones.
- b) If the problem is a missing REQUIRED Basic or Extended security option, an ICMP
parameter problemmessage is sent to the originating host with thecodefield set to1(one) to indicatemissing required option, and thepointerfield set to the option type of the missing option. Otherwise, an ICMPparameter problemmessage is sent to the originating host with thecodefield set to0(zero), and with thepointerfield pointing to the position of the out-of-range security option. - c) If the receiving host has an interface to a local security officer or equivalent, the problem SHOULD be identified across that interface in an appropriate way.
9.3.15.3.4.5 Trusted Intermediary Procedure 🤝
Certain devices in the internet MAY act as intermediaries to validate that communications between two hosts are authorized. They do this based on a mix of knowledge about the hosts and the values in the IP security option. These devices MAY receive IP datagrams that are in range for the intermediate device, but are either not within the acceptable range for the sender, or for the ultimate receiver. In the former case, the datagram SHOULD be treated as described above for an out-of-range option. In the latter case, a destination unreachable ICMP message SHOULD be sent, with the code value of 10 (ten), indicating Communication with Destination Host Administratively Prohibited 🚫.
9.3.15.4 DoD Extended Security Option ✨
okay bestie, this is the Extended Security Option 🎀 and it's the sequel to the Basic one. It lets extra security info, beyond what the Basic Security Option already carries, ride along inside an IP datagram 💖 so registered authorities get the details they need.
If an authority needs this option for a specific system, it must be specified explicitly in any Request for Proposal 📝. Otherwise it's not required 🙅. This option must be copied on fragmentation 🧩, and it may appear multiple times within a single datagram 👯.
Here's the option header 👀:
Option type: 133 Option length: variableAnd here's the format 💅:
+------------+-------------+-------------+--------//-------+
| 10000101 | 000LLLLL | AAAAAAAA | add sec info |
+------------+-------------+-------------+--------//-------+
type = 133 LENGTH = Var. ADDITIONAL ADDITIONAL
SECURITY SECURITY
INFO INFO
AUTHORITY
CODEFIGURE 10-B.
9.3.15.4.1 Additional Security Info Authority Code.
Length check: length = 8 bits 📏
The values of this field are assigned by DCA Code R130, Washington, D.C. 20305-2000 🏛️. Each value corresponds to a requestor who, once assigned, becomes the authority for the remainder of the option definition for that value 👑. Main character energy, fr fr 💜.
9.3.15.4.2 Additional Security Information.
Length check: length - variable 🌸
This field carries whatever additional security information the authority specifies 🔐. The bits break down like this 🦋:
BIT
NUMBER AUTHORITY
0 GENSER
1 SIOP
2 DSCCS-SPINTCOM
3 DSCCS-CRITICOM
4-7 UnassignedAnd here's who's who, with the annex that describes each one's current coding 🧚:
AUTHORITY SOURCE OF ANNEX DESCRIBING
CURRENT CODING OF ADDITIONAL
SECURITY INFORMATION
GENSER
National Access Program, less SIOP Defense Communications
Agency
ATTN: Code R130
Washington, DC 20305
SIOP
National Access Program Department of Defense
Organization of the
Joint Chiefs of Staff
Attn: J6T
Washington, DC
DSCCS-SPINTCOM
National Access Program Defense Intelligence Agency
Attn: DSE4
Bolling AFB, MD
DSCCS-CRITICOM
National Access Program National Security Agency
9800 Savage Road
Attn: T03
Ft. Meade, MD 20755-6000📦 where this page comes from
- ietf: rfc1038 1988-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms