RFC 1108
U.S. Department of Defense Security Options for the Internet Protocol
RFC 1108: U.S. Department of Defense Security Options for the Internet Protocol 🎀 Part 1 of 5 💖
- Who wrote it: S. Kent, from BBN Communications ✨
- Series: Network Working Group 🌸
- Category: IAB standards track protocol 🦋
- Date: November 1991 🍓
- Obsoletes: RFC 1038 🙈 (that's the "Revised IP Security Option" from January 1988)
- Updates: nothing listed in the header 🫶
Status of this Memo 🌸
Okay so this RFC is an IAB standards track protocol for the whole Internet community, and it's literally asking people for discussion and suggestions on how to make it better 🫶. If you want the current standardization state and status of this protocol, check the current edition of the "IAB Official Protocol Standards" 📜. Distribution of this memo is unlimited, so share it with everyone 💅.
Abstract 🦋
This RFC lays out the U.S. Department of Defense Basic Security Option, plus the top-level overview of the Extended Security Option, both for use with the Internet Protocol 🔐. It also obsoletes RFC 1038 "Revised IP Security Option", which is dated January 1988 ⏳.
1. DoD Security Options Defined ✨
Two internet protocol options are defined for use on Department of Defense (DoD) common user data networks. Here's the lineup 👑:
CF CLASS # TYPE LENGTH DESCRIPTION
1 0 2 130 var. DoD Basic Security: Used to carry the
classification level and protection
authority flags.
1 0 5 133 var. DoD Extended Security: Used to carry
additional security information as
required by registered authorities.CF = Copy on Fragmentation 🧩
2. DoD Basic Security Option 💜
Main character alert: this option says which U.S. classification level a datagram needs to be protected at, and which protection authorities' rules apply to each datagram 👑.
End systems and intermediate systems of an internet use this option to:
- a. Send the common security labels that computer security models need, from source to destination, in a network standard representation 📦
- b. Check that the datagram is valid to transmit from the source and to deliver to the destination ✅
- c. Make sure the route the datagram takes is protected to the level that every protection authority listed on the datagram requires. To pull this off in a general Internet environment, interior and exterior gateway protocols MUST be augmented to include security label information for routing control 🛣️
The DoD Basic Security option MUST be copied on fragmentation 🧩. It shows up at most once in a datagram 🙅. Some security systems want it to be the first option if the IP header carries more than one, but that's not a generic requirement from this spec 🤷.
Here's the format 🖼️:
+------------+------------+------------+-------------//----------+
| 10000010 | XXXXXXXX | SSSSSSSS | AAAAAAA[1] AAAAAAA0 |
| | | | [0] |
+------------+------------+------------+-------------//----------+
TYPE = 130 LENGTH CLASSIFICATION PROTECTION
LEVEL AUTHORITY
FLAGS
FIGURE 1. DoD BASIC SECURITY OPTION FORMAT2.1. Type 🎀
The value 130 identifies this as the DoD Basic Security Option 💖.
2.2. Length 🌷
The length is variable 📏. The minimum length is 3 octets, counting the Type and Length fields too. The Protection Authority field MAY be absent, which is why 3 is the floor 🙈. A length indication of less than 3 octets SHOULD result in error processing as described in Section 2.8.1 ❌.
2.3. Classification Level 👑
Field Length: One Octet
This field says which (U.S.) classification level the datagram MUST be protected at. The information in the datagram MUST be protected at this level 🔒. The field is encoded the way Table 1 shows, and the order of values in that table defines the ordering for comparison purposes 📊. The bit string values were chosen to get a minimum Hamming distance of four (4) between any two valid values 💪. This specific assignment of classification level names to values was defined for compatibility with security devices that were already developed and deployed 🛠️.
Reserved values in the table MUST be treated as invalid until they're assigned to named classification levels in a successor to this document 🚫. A datagram with a value for this field that's either not in the table or listed as "reserved" is in error, and MUST be processed according to the "out-of-range" procedures defined in section 2.8.1 🚨.
A classification level value from the Basic Security Option in a datagram MAY be checked for equality against any of the (assigned) values in Table 1 by performing a simple bit string comparison 🔍. However, because the classification level encodings are sparse, range checks involving a value from this field MUST NOT be performed based solely on arithmetic comparisons, since those would encompass invalid and or unassigned values within the range 🙅♀️. How ordered comparisons get performed for this field within a system is a local matter, as long as it meets the requirements set forth in this paragraph 💅.
Table 1. Classification Level Encodings
Value Name
00000001 - (Reserved 4)
00111101 - Top Secret
01011010 - Secret
10010110 - Confidential
01100110 - (Reserved 3)
11001100 - (Reserved 2)
10101011 - Unclassified
11110001 - (Reserved 1)Okay so this is the part where the Protection Authority Flags get real, bestie 🎀 Pay attention, because these bits are literally the gatekeepers for who gets to say how your data is protected 🔐✨
2.4. Protection Authority Flags 👑
Field Length: Variable 🦋
This field tells you which National Access Programs or Special Access Programs set the protection rules for sending and processing the info inside the datagram 💌 Quick but IMPORTANT tea: protection authority flags are NOT the same thing as accreditation authorities, even though they look kinda similar 🙈 To keep everything consistent and interoperable across DoD common user data networks, anyone who needs a new Protection Authority Flag should submit the request to DISA DISDB, Washington, D.C. 20305-2000, for review and approval 💅 Get that approval BEFORE you design, develop, or deploy anything that uses new flags, no skipping this step 🫶 Once new flags get approved and assigned, they'll be published along with the values above in the Assigned Numbers RFC, edited by the Internet Assigned Numbers Authority (IANA) 📚🌸
a. Field Length 🍓
This field is variable in length. The low-order bit (Bit 7) of each octet is set to "0" if it's the final octet in the field, or "1" if there are more octets coming 🧚 At the start, only one octet is needed (since there are fewer than seven authorities defined), so the final bit of the first octet is "0" 💖 BUT minimally compliant implementations MUST be able to process a protection authority field of at least 2 octets (that's up to 14 protection authorities, periodt) 🔥 Implementations that existed before this RFC was issued, and that process fewer protection authorities than specified here, will be considered minimally compliant as long as they process the flags in accordance with the RFC 🌈 This field MUST be a minimally encoded representation, meaning no trailing all-zero octets should be emitted 💜 If the length of this field, as indicated by this extensible encoding, doesn't match the length field for the option, the datagram is in error and the procedure in Section 2.8.1 MUST be followed 🙅♀️ (Figure 2 shows how much each bit matters within an octet, so peep that below ✨)
0 1 2 3 4 5 6 7
+---+---+---+---+---+---+---+---+
High-order | | | | | | | | | Low-order
+---+---+---+---+---+---+---+---+
Figure 2. Significance of Bitsb. Source Flags 🎀
The first seven bits (Bits 0 through 6) in each octet are flags, and each flag is tied to an authority 🦋 Protection Authority flags that are currently assigned are listed in Table 2, and Table 3 gives you a point of contact for each authority in Table 2 📞 A bit corresponding to an authority is "1" if the datagram should be protected under that authority's rules 💅 You can have more than one flag set in a single instance of this option if the data should be protected under rules from multiple authorities, which is so iconic 👑 No "unassigned" bits in this or any other octet of the Protection Authority Field SHALL be considered valid Protection Authority flags until they're assigned and the assignments are published in the Assigned Numbers RFC 🌸 So a datagram with flags set on unassigned bits in this field for this option is in error and MUST be processed according to the "out-of-range" procedures defined in section 2.8.1 🚨
Two protection authority flag fields can be checked for equality (=) with simple bit string matching 💜 No relative ordering between two protection authority flag fields is defined, so don't go looking for one 🙅♀️ Because these flags represent protection authorities, security models such as Bell-LaPadula do NOT apply to interpreting this field 🧚 However, the symbol "=<" refers to set inclusion when you compare a protection authority flag field to a set of such fields 🍓 How you actually run these tests inside a system is a local matter, as long as it follows the requirements in this paragraph ✨
Table 2 - Protection Authority Bit Assignments
BIT
NUMBER AUTHORITY
0 GENSER
1 SIOP-ESI
2 SCI
3 NSA
4 DOE
5, 6 Unassigned
7 Field Termination Indicator Table 3 - Protection Authority Points of Contact
AUTHORITY POINT OF CONTACT
GENSER Designated Approving Authority
per DOD 5200.28
SIOP-ESI Department of Defense
Organization of the
Joint Chiefs of Staff
Attn: J6
Washington, DC 20318-6000
SCI Director of Central Intelligence
Attn: Chairman, Information
Handling Committee, Intelligence
Community Staff
Washington, D.C. 20505
NSA National Security Agency
9800 Savage Road
Attn: T03
Ft. Meade, MD 20755-6000
DOE Department of Energy
Attn: DP343.2
Washington, DC 205452.5. System Security Configuration Parameters ✨
Okay bestie, so using the Basic Security Option (BSO) means your system config MUST include the parameters below 🔐. They're critical for processing the BSO safely, so they MUST be protected from unauthorized changes 🙅♀️. Also, compliant implementations MUST let a minimum of 14 Protection Authority flags be set independently in any parameter with Protection Authority flag fields (matching the field size from Section 2.4) 💅.
a. SYSTEM-LEVEL-MAX is the highest Classification Level (see Table 1) that can show up in the classification level field of the BSO on any datagram the system transmits or receives 👑.
b. SYSTEM-LEVEL-MIN is the lowest Classification Level (see Table 1) that can show up in the classification level field of the BSO on any datagram the system transmits 🌸.
c. SYSTEM-AUTHORITY-IN is a set where every member is a Protection Authority flag field 🧚. It lists all the Protection Authority flag fields that can appear in the Protection Authority field of the BSO on any datagram this system receives. A compliant implementation MUST be capable of representing at least 256 distinct Protection Authority flag fields in this set (each field MUST be capable of representing 14 distinct Protection Authority flags). Each element of the enumerated set MAY be a combination of multiple protection authority flags.
Set elements that represent multiple Protection Authorities are made by ORing together the flags for each authority. So, for example, a set element for datagrams protected under NSA and SCI rules might look like "00110000", while an element for protection mandated by NSA, DOE and SIOP-ESI might look like "01011000". (These examples show 8-bit set elements, which is the minimal encoding for the Protection Authority flags defined right now. If more flags get defined beyond the first byte of the Protection Authority Field, longer encodings for set elements may be required.)
It is essential that implementations of the Internet Protocol Basic Security Option give system security managers a convenient and compact way to say which combinations of flags are allowed 💜. The details of that interface are outside the scope of this RFC. However, enumeration of bit patterns is NOT RECOMMENDED as an interface 🙈. As an alternative, one might consider a notation like COMB(GENSER,NSA,SCI)+COMB(SIOP-ESI,NSA,SCI), where "COMB" means ANY combination of the flags referenced as parameters of the COMB function is allowed, and "+" means "or".
d. SYSTEM-AUTHORITY-OUT is a set where every member is a Protection Authority flag field 🦋. It lists all the Protection Authority flag fields that can appear in the Protection Authority field of the BSO on any datagram this system transmits. A compliant implementation MUST be capable of representing at least 256 distinct Protection Authority flag fields in this set. Explicitly listing every authorized Protection Authority field flag gives you a lot of flexibility, and in particular it doesn't put set inclusion restrictions on this parameter ✨.
The following configuration parameters are defined for each network port on the system. Here, "port" can mean either a physical device interface (which may represent multiple IP addresses) or a single IP address (which may be served through multiple physical interfaces). Usually the first meaning applies, and it lines up with the "communications channel" or "I/O device" concept from the Trusted Computer Systems Evaluation Criteria (TNI). The second meaning may also be valid, depending on the local system's security capabilities 🌈. Some combinations of port parameter values only make sense if the port is "single level," meaning all data transmitted or received through it is accurately described by exactly one Classification Level and one Protection Authority Flag field 🎀.
e. PORT-LEVEL-MAX is the highest Classification Level (see Table 1) that can show up in the classification level field of the BSO on any datagram the system transmits or receives through this network port 💖.
f. PORT-LEVEL-MIN is the lowest Classification Level (see Table 1) that can show up in the classification level field of the BSO on any datagram the system transmits through this network port 🍓.
g. PORT-AUTHORITY-IN is a set where every member is a Protection Authority flag field 🧚. It lists all the Protection Authority flag fields that can appear in the Protection Authority field of the BSO on any datagram received through this port. A compliant implementation MUST be capable of representing at least 256 distinct Protection Authority flag fields in this set.
h. PORT-AUTHORITY-OUT is a set where every member is a Protection Authority flag field 🌸. It lists all the Protection Authority flag fields that can appear in the Protection Authority field of the BSO on any datagram transmitted through this port. A compliant implementation MUST be capable of representing at least 256 distinct Protection Authority flag fields in this set.
i. PORT-AUTHORITY-ERROR is a single Protection Authority flag field assigned to transmitted ICMP error messages (see Section 2.8) 🛎️. Its value is picked from the set of values that make up PORT-AUTHORITY-OUT. How a system picks the PORT-AUTHORITY-ERROR value is a local matter, subject to local security policies 🔒.
j. PORT-IMPLICIT-LABEL specifies one Classification Level and one Protection Authority flag field (which may be null) to be attached to every unlabelled datagram received through the port 🏷️. This parameter only means something if PORT-BSO-REQUIRED-RECEIVE = FALSE. Otherwise, receiving an unlabelled datagram gets you an error response 😬.
k. PORT-BSO-REQUIRED-RECEIVE is a boolean that says whether every datagram received through this network port must contain a Basic Security Option. (Heads up: it has to be "must contain" here, so this one's a MUST 💅.)
Correction bestie, the precise wording is: PORT-BSO-REQUIRED-RECEIVE is a boolean that says whether every datagram received through this network port MUST contain a Basic Security Option 🫶.
l. PORT-BSO-REQUIRED-TRANSMIT is a boolean that says whether every datagram transmitted through this network port MUST contain a Basic Security Option 📮. If this parameter is FALSE, then PORT-BSO-REQUIRED-RECEIVE SHOULD also be set to FALSE, so you don't get communication failures from asymmetric labelling constraints 🙃.
In every intermediate or end system, the following relationships MUST hold for these parameters on all network interfaces. Here, ">=" is read against the linear ordering of security levels from Section 2.3 for the "LEVEL" parameters, and as set inclusion for the "AUTHORITY" parameters 🌟.
SYSTEM-LEVEL-MAX >= PORT-LEVEL-MAX >=
PORT-LEVEL-MIN >= SYSTEM-LEVEL-MIN
SYSTEM-AUTHORITY-IN >= PORT-AUTHORITY-IN
and
SYSTEM-AUTHORITY-OUT >= PORT-AUTHORITY-OUT2.6. Configuration Considerations 🧸
Systems that don't keep data of different security classification levels separated SHOULD have only trivial ranges for the LEVEL parameters, meaning SYSTEM-LEVEL-MAX = PORT-LEVEL-MAX = PORT-LEVEL-MIN = SYSTEM-LEVEL-MIN 🙅♀️.
Systems that DO keep data of different security classification levels separated MAY have non-trivial ranges for the LEVEL parameters, e.g., SYSTEM-LEVEL-MAX >= PORT-LEVEL-MAX >= PORT-LEVEL-MIN >= SYSTEM-LEVEL-MIN 💜.
2.7. Processing the Basic Security Option 🔍
For systems that implement the Basic Security Option, the parameters PORT-BSO-REQUIRED-TRANSMIT and PORT-BSO-REQUIRED-RECEIVE are used to set the local security policy for requiring the option to be present on transmitted and received datagrams, respectively, on a per-port basis 🛡️. Each datagram transmitted or received by the system MUST be processed according to the per-port and system-wide security parameters configured for the system 💅.
Systems that only process Unclassified data MAY or may not be configured to generate the BSO on transmitted datagrams. Those systems also MAY or may not require a BSO on received datagrams. But all systems MUST be capable of accepting datagrams that contain this option, whether or not they process it 🫶.
In general, systems that process classified data MUST generate this option for transmitted datagrams 🔐. The only exception to this rule is in (dedicated or system high [DoD 5200.28]) networks, where traffic may be implicitly labelled instead of requiring each attached system to generate explicit labels 🌈. If the local security policy permits receiving datagrams without the option, each such datagram is presumed to be implicitly labelled based on the port it came in through 🦋. A per-port parameter (PORT-IMPLICIT-LABEL) specifies the label to attach to those datagrams when they're received 🏷️. Heads up: a datagram sent in response to an implicitly labelled datagram MAY, based on local policy, require an explicit Basic Security Option 👀.
2.7.1. Handling Unclassified Datagrams 🌸
If an unmarked datagram is received through a network port where PORT-BSO-REQUIRED = FALSE and PORT-IMPLICIT-LABEL = UNCLASSIFIED (NO FLAGS), the datagram SHALL be processed as though no Protection Authority Flags were set ✨. So there are two distinct, valid ways to represent Unclassified datagrams that no Protection Authority rules apply to: an unmarked datagram like the one described here, and a datagram with an explicit BSO whose Classification Level is Unclassified and which has no Protection Authority flags set 🧚.
Also, a datagram can contain a Basic Security Option where the Classification Level is Unclassified but one or more Protection Authority Field Flags ARE set. Those datagrams are explicitly different from the equivalence class above (datagrams marked Unclassified with no Protection Authority field flags set, and datagrams with no Basic Security Option at all) 🙌.
2.7.2. Input Processing ✨
okay so the second a datagram lands, a system that's compliant with this RFC has to run through these checks 💅 first up: if PORT-BSO-REQUIRED-RECEIVE = TRUE for this port, then every received datagram must contain a Basic Security Option, and if the BSO is missing, you get an ICMP error response back, as specified in Section 2.8.1. any datagram that does have a Basic Security Option gets processed the way described below. this whole algorithm assumes the IP header checksum has already been verified and that, while processing IP options, this option has been spotted 👀 the Classification Level value from the option gets nicknamed "DG-LEVEL", and the Protection Authority Flags value gets nicknamed "DG-AUTHORITY." 🎀
- Step 1. Check that
DG-LEVELis a valid security classification level, i.e., it must be one of the (non-reserved) values from Table 1. If this test fails, execute the out-of-range procedure in Section 2.8.1. 🙈 - Step 2. Check that
PORT-LEVEL-MAX >= DG-LEVEL. If this test fails, execute the out-of-range procedure specified in Section 2.8.2. 🌸 - Step 3. Check that
DG-AUTHORITY =< PORT-AUTHORITY-IN. If this test fails, execute the out-of-range procedure specified in Section 2.8.2. ✨
2.7.3. Output Processing 🔥
any system that implements the Basic Security Option has to follow one golden rule when it sends datagrams: no datagram shall be transmitted with a Basic Security Option whose value is outside the range the system is configured for. so for every datagram a system sends, this has to hold: PORT-LEVEL-MAX >= DG-LEVEL >= PORT-LEVEL-MIN and DG-AUTHORITY =< PORT-AUTHORITY-OUT. what a system does when it detects an attempt to send a datagram where these relationships don't hold is a local matter 🧚
if a port is configured to allow both labelled and unlabelled datagrams (PORT-BSO-REQUIRED-TRANSMIT = FALSE) to be transmitted, the question becomes whether a label should be affixed 🤔 since this option isn't widely implemented or used, especially on unclassified networks, this RFC recommends that the default be transmitting unlabelled datagrams. if the destination requires every datagram to be labelled on input, it'll send back an ICMP error message (see Section 2.8.1), and the originator can respond by labelling the successive packets it sends to that destination. it's giving teamwork 🫶
to make this work, a system that allows transmission of both labelled and unlabelled datagrams must keep state information (a cache) so it can associate the use of labels with specific destinations, e.g., in response to receiving an ICMP error message as specified in Section 2.8.1. this per-destination cache requirement is very much analogous to the one imposed for processing the IP source route option or for maintaining first hop routing information (RFC 1122). this RFC doesn't say which protocol module has to maintain the per-destination cache (e.g., IP vs. TCP or UDP), but security engineering constraints may dictate an IP implementation in trusted systems. it also doesn't specify a cache maintenance algorithm, though using a timer and activity flag may be appropriate 💜
2.8. Error Procedures 🌸
datagrams received with errors in the Basic Security Option, or datagrams that are out of range for the network port they came in on, should not be delivered to user processes 🙅♀️ local policy decides whether logging and/or notifying a system security officer is required when those datagrams show up. the following are the least restrictive actions this protocol permits. individual end or intermediate systems, system administrators, or protection authorities may impose stricter restrictions on responses, and in some cases may not permit any response at all to a datagram that's outside the security range of a host or system 🔒
in all cases, if the error is triggered by receipt of an ICMP, the ICMP is discarded and no response is permitted (consistent with general ICMP processing rules). 💀
2.8.1. Parameter Problem Response 🙈
if a datagram arrives with no Basic Security Option and the system security configuration parameters require the option on the network port it came in on, an ICMP Parameter Problem Missing Option (Type = 12, Code = 1) message is sent back in response. the Pointer field of the ICMP should be set to the value "130" to indicate the type of option that's missing. a Basic Security Option is included in the response datagram with Clearance Level set to PORT-LEVEL-MIN and Protection Authority Flags set to PORT-AUTHORITY-ERROR. 🍓
if a datagram arrives with a Basic Security Option that's malformed (e.g., an invalid Classification Level Protection Authority Flag field), an ICMP Parameter Problem (Type = 12, Code = 0) message is sent back in response. the pointer field is set to the malformed Basic Security Option. the Basic Security Option is included in the response datagram with Clearance Level set to PORT-LEVEL-MIN and Protection Authority Flags set to PORT-AUTHORITY-ERROR. 💅
2.8.2. Out-Of-Range Response 🦋
if a datagram arrives that's out of range for the network port it was received on, an ICMP Destination Unreachable Communication Administratively Prohibited (Type = 3, Code = 9 for net or Code = 10 for host) message is sent back in response. a Basic Security Option is included in the response datagram with Clearance Level set to PORT-LEVEL-MIN and Protection Authority Flags set to PORT-AUTHORITY-ERROR. 🚫
2.9. Trusted Intermediary Procedure 🧚
certain devices in an internet can act as intermediaries to validate that communications between two hosts are authorized 🕵️♀️ this decision is based on knowing the accredited security levels of the hosts and the values in the DoD Basic Security Option. these devices may receive IP datagrams that are in range for the intermediate device but aren't within the accredited range for either the source or the destination. in the former case, the datagram should be treated as described above for an out-of-range option. in the latter case, an ICMP Destination Unreachable Communication Administratively Prohibited (Type = 3, Code = 9 for net or Code = 10 for host) response should be sent. the security range of the network interface the reply goes out on decides whether a reply is allowed and at what level it gets sent 👑
3. DoD Extended Security Option 👑
this option lets you attach extra security labelling info, beyond what the Basic Security Option carries, to an IP datagram so registered authorities get what they need 💖 but heads up: info that isn't labelling data, or that only matters to the end systems (not intermediate ones), doesn't belong in the IP layer and shouldn't be carried in this option 🙅♀️ this option must be copied on fragmentation. unlike the Basic Option, it can show up multiple times in one datagram, as long as the overall IP header size constraints are happy 🌈
this option can only show up alongside the Basic Security Option, so every system that supports Extended Security Options also has to support the Basic Security Option 🫶 not every system that supports the Basic Security Option has to support Extended Security Options though, and support can be selective, meaning a system doesn't need to support all of them (i.e., it's totally fine to pick and choose) ✨
the top-level format looks like this 🦋
+------------+------------+------------+-------//-------+
| 10000101 | 000LLLLL | AAAAAAAA | add sec info |
+------------+------------+------------+-------//-------+
TYPE = 133 LENGTH ADDITIONAL ADDITIONAL
SECURITY INFO SECURITY
FORMAT CODE INFO
FIGURE 3. DoD EXTENDED SECURITY OPTION FORMAT3.1. Type 🎀
the value 133 identifies this as the DoD Extended Security Option 💜
3.2. Length 🍓
the length of the option, which includes the "Type" and "Length" fields, is variable. the minimum length of the option is 3 octets 📏
3.3. Additional Security Info Format Code 🧚
Length: 1 Octet
the value of the Additional Security Info Format Code identifies the syntax and semantics for a specific "Additional Security Information" field 🔥 for each Additional Security Info Format Code, an RFC will be published to specify the syntax and to give an algorithmic description of the processing required to decide whether a datagram carrying a label specified by this Format Code should be accepted or rejected. this specification must be detailed enough to let vendors build interoperable implementations, e.g., it should be comparable to the specification of the Basic Security Option provided in this RFC. however, the specification doesn't need to include a mapping from the option's syntax to human labels if that mapping would cause the specification to be distributed in a restricted way 🙈
in order to keep DoD common user data networks architecturally consistent and to maximize interoperability, each activity should submit its plans for defining and using an Additional Security Info Format Code to DISA DISDB, Washington, D.C. 20305-2000 for review and approval 📬 DISA DISDB will forward plans to the Internet Activities Board for architectural review, and if required, a cleared committee formed by the IAB will be set up for the review process. once approved, the Internet Assigned Number authority will assign an Additional Security Info Format Code to the requesting activity, at the same time the corresponding RFC gets published 🎉
Note: The bit assignments for the Protection Authority flags of the Basic Security Option have no relationship to the "Additional Security Info Format Code" of this option. 👀
3.4. Additional Security Information 💖
Length: Variable
the Additional Security Info field contains the additional security labelling information specified by the "Additional Security Info Format Code" of the Extended Security Option 🌸 the syntax and processing requirements for this field are specified by the associated RFC noted above. the minimum length of this field is zero 🦋
3.5. System Security Configuration Parameters 🔒
using the Extended Security Option requires that the intermediate or end system configuration accurately reflect the security parameters associated with communication via each network port (see Section 2.5 as a guide) 💅 internal representation of the security parameters is implementation dependent. the set of parameters needed to support processing of the Extended Security Option depends on the set of Additional Security Info Format Codes the system supports 🧠 the RFC that specifies syntax and processing rules for a registered Additional Security Info Format Code will specify the additional system security parameters required for processing an Extended Security Option relative to that Code ✨
3.6. Processing Rules 🎀
okay bestie, this is where we decide what counts as a broken datagram 💅. Any datagram with an Extended Security Option MUST also contain a Basic Security Option 😭. If you get one without the other, that's an error, no cap.
If the length in the Length field doesn't match the length from the variable length encoding of the Additional Security Info field, the datagram is in error 💀. Same deal if the Additional Security Info Format Code has a value that isn't registered 🙈. And if the Additional Security Info field has data that doesn't match the defining RFC for its Format Code, it's in error too. In any of these cases, an ICMP Parameter Problem response SHOULD be sent as per Section 2.8.1 🫶. Any extra error processing rules get spelled out in the defining RFC for that Format Code, so go check there ✨.
Now the good part. If the additional security information in the Extended Security Option says the datagram is within range for the system's security policy, it SHOULD be accepted for further processing 🦋. If not, it SHOULD be rejected, and you follow the procedure in Section 2.8.2 (with the Extended Security Option values set apropos the Additional Security Info Format Code port security parameters) 🌸.
As with the Basic Security Option, it will not be possible in a general internet environment for intermediate systems to provide routing control based on the labels in the Extended Security Option until interior and exterior gateway routing protocols are upgraded to process those labels 🧚. ngl, that's a big ask.
References
[DoD 5200.28] Department of Defense Directive 5200.28, "Security Requirements for Automated Information Systems," 21 March 1988.
Security Considerations 🔐
Okay, this part is SERIOUS, so pay attention 🚨. The focus of this RFC is defining the formats and processing conventions that support security labels for data in IP datagrams, so a bunch of security issues MUST be considered carefully when you use these options. It's not possible to cover every security consideration that affects correct implementation and use of these options, but the paragraph below highlights some of the big ones 👑.
Correct implementation and operation of the software and hardware that processes these options is essential to using them effectively 💖. Ways to build confidence in that correct implementation and operation are outside the scope of this RFC. The options themselves have no facilities to ensure the integrity of the security labels in transit (other than the IP checksum mechanism), so appropriate technology MUST be employed whenever datagrams containing these options transit "hostile" communication environments 💀. Careful, secure management of the configuration variables on each system that uses these options is essential if the options are going to provide the intended security functionality 🔒. Protect those configs like your life depends on it, because it does 😭.
Author's Address 💌
Stephen Kent
BBN Communications
150 CambridgePark Drive
Cambridge, MA 02140
Phone: (617) 873-3988
Email: kent@bbn.com📦 where this page comes from
- ietf: rfc1108 1991-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms