RFC 1826
IP Authentication Header
RFC 1826: IP Authentication Header 🎀
Okay bestie, let's start with the paperwork, because the vibes begin with the title block 💅
- Group: Network Working Group
- Request for Comments: 1826
- Written by: R. Atkinson, Naval Research Laboratory
- Category: Standards Track
- Date: August 1995
- Obsoletes: the title block doesn't list any documents
- Updates: the title block doesn't list any documents
Status of this Memo 💖
This one's the official-ish bit, but it's important 🙈 This document specifies an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
ABSTRACT ✨
So here's the tea: this doc describes a way to give IPv4 and IPv6 datagrams cryptographic authentication 🔐 An Authentication Header (AH) usually gets slotted in right after the IP header and before the other information it's authenticating 🧚
1. INTRODUCTION 🦋
Okay, the Authentication Header is basically a mechanism for giving IP datagrams strong integrity and authentication 💜 It might also provide non-repudiation, depending on which cryptographic algorithm you use and how keying is done. For example, an asymmetric digital signature algorithm like RSA could provide non-repudiation ✨
Confidentiality and protection from traffic analysis are NOT on the menu here 🙈 Wait, let me be precise: they are not provided by the Authentication Header. If you want confidentiality, you should look at the IP Encapsulating Security Protocol (ESP), either instead of AH or alongside it [Atk95b]. This document also assumes you've already read the related IP Security Architecture document, which defines the overall security architecture for IP and gives you the important background for this spec [Atk95a] 📚
1.1 Overview 💅
The IP Authentication Header is all about adding authentication information to an IP datagram 🎀 This info is calculated using all of the fields in the datagram (not just the IP Header, but also other headers and the user data) that don't change in transit. Fields or options that need to change in transit, like "hop count", "time to live", "ident", "fragment offset", or "routing pointer", are treated as zero when the authentication data is calculated. This gives you way more security than IPv4 has right now, and it might be enough for lots of people 😭
Using this spec does cost something, though. Participating end systems will see higher IP protocol processing costs, and communications latency goes up too. The latency mostly comes from the sender calculating the authentication data, and the receiver calculating and comparing it for every IP datagram that has an Authentication Header. How much it costs depends on the authentication algorithm and other factors 💀
To keep the Authentication Header working without changing the whole Internet infrastructure, the authentication data rides in its own payload 🧚 Systems that aren't taking part in the authentication MAY ignore the Authentication Data. With IPv6, the Authentication Header normally goes after the Fragmentation and End-to-End headers and before the ESP and transport-layer headers. The other IP headers are what get the datagram from origin to destination. With IPv4, the Authentication Header comes right after the IPv4 header 🦋
If you use a symmetric authentication algorithm and want intermediate authentication, the nodes doing that intermediate authentication need the right keys. But having those keys means any one of those systems could forge traffic pretending to be from the legitimate sender to the legitimate receiver, or change the contents of legit traffic 🙈 Some environments still want that intermediate authentication [BCCH94]. If you use an asymmetric algorithm and the routers know the right public keys and algorithm, then the routers holding the authentication public key can check the traffic without being able to forge or modify legit traffic 🔥 Also, Path MTU Discovery MUST be used when you want intermediate authentication of the Authentication Header and you're on IPv4, because with this method you can't authenticate a fragment of a packet [MD90] [Kno93] ⭐
1.2 Requirements Terminology 🫶
In this document, the words that define how important each requirement is are usually capitalised 💅 Here they are:
- MUST
- This word or the adjective "REQUIRED" means that the item is an absolute requirement of the specification.
- SHOULD
- This word or the adjective "RECOMMENDED" means that there might be valid reasons in particular circumstances to ignore this item, but the full implications should be understood and the case carefully weighed before taking a different course.
- MAY
- This word or the adjective "OPTIONAL" means that this item is truly optional. One vendor might include it because a particular marketplace needs it or because it makes the product better, for example. Another vendor may leave the same item out.
2. KEY MANAGEMENT 🔑
Key management is a big deal in the IP security architecture 💅 But it isn't built into this spec, because there's a long history in the public literature of subtle flaws in key management algorithms and protocols 😭 The IP Authentication Header tries to decouple the key management mechanisms from the security protocol mechanisms. The only link between the key management protocol and the security protocol is the Security Parameters Index (SPI), which we'll get into below. Because of that decoupling, you can use several different key management mechanisms. Even better, the key management protocol can be changed or corrected without really messing with the security protocol implementations 🎀
The key management mechanism negotiates a bunch of parameters for each "Security Association". That includes the keys, plus other info like the authentication algorithm and mode that the communicating parties use 🧚 The key management mechanism creates and maintains a logical table with those parameters for each current security association. An implementation of the IP Authentication Header needs to read that table to figure out how to process each datagram with an Authentication Header, like which algorithm/mode and key to use for authentication 🔐
Security Associations are unidirectional 💖 A bidirectional session usually has one Security Association in each direction. For example, if a TCP session exists between systems A and B, there's normally one Security Association from A to B and a separate one from B to A. The receiver assigns the SPI value to the Security Association with that sender. The key management mechanism decides the other parameters of the Security Association. Section 4 of this document goes into detail about picking a Security Association for an outgoing packet and identifying the Security Association for an incoming packet ✨
The IP Security Architecture document covers key management in depth. It includes the key management requirements for this protocol, and it's incorporated here by reference [Atk95a] 📚
3. AUTHENTICATION HEADER SYNTAX 🧚
The Authentication Header (AH) may appear after any other headers that get examined at each hop, and before any other headers that don't get examined at an intermediate hop 💜 The IPv4 or IPv6 header right before the Authentication Header will contain the value 51 in its Next Header (or Protocol) field [STD-2] 🦋
Here are some example high-level diagrams of IP datagrams with the Authentication Header 🌸
+------------+-------------------+------------+-------+---------------+
| IPv6 Header| Hop-by-Hop/Routing| Auth Header| Others| Upper Protocol|
+------------+-------------------+------------+-------+---------------+Figure 1: IPv6 Example
With IPv6, the Authentication Header normally shows up after the IPv6 Hop-by-Hop Header and before the IPv6 Destination Options 🎀
+-------------+--------------+-------------------------------+
| IPv4 Header | Auth Header | Upper Protocol (e.g. TCP, UDP)|
+-------------+--------------+-------------------------------+Figure 2: IPv4 Example
With IPv4, the Authentication Header normally follows the main IPv4 header ✨
3.1 Authentication Header Syntax 💜
The authentication data is the output of the authentication algorithm, calculated over the entire IP datagram as described in more detail later in this document 🔐 The authentication calculation must treat the Authentication Data field itself, and all fields that are normally modified in transit (like TTL or Hop Limit), as if those fields contained all zeros. All other Authentication Header fields are included in the calculation as normal 🫶
The IP Authentication Header has the following syntax:
+---------------+---------------+---------------+---------------+
| Next Header | Length | RESERVED |
+---------------+---------------+---------------+---------------+
| Security Parameters Index |
+---------------+---------------+---------------+---------------+
| |
+ Authentication Data (variable number of 32-bit words) |
| |
+---------------+---------------+---------------+---------------+
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8Figure 3: Authentication Header syntax
To be continued in part 2 💜
3.2. Fields of the Authentication Header 🎀
okay so let's break down the fields in this header, bestie 💅
NEXT HEADER 🧚
8 bits wide. This one tells you what the next payload is, right after the Authentication Payload. The values in here come from the IP Protocol Numbers in the newest RFC from the Internet Assigned Numbers Authority (IANA) that talks about "Assigned Numbers" [STD-2]. ✨
PAYLOAD LENGTH 📏
8 bits wide. It's the length of the Authentication Data field, measured in 32-bit words. The minimum is 0 words, and that only happens in the super edge-case "null" authentication algorithm situation 💀
RESERVED 🔒
16 bits wide, and it's reserved for future use. It MUST be set to all zeros when sent 🙅♀️ The value does get counted in the Authentication Data calculation, but the recipient otherwise ignores it.
SECURITY PARAMETERS INDEX (SPI) 🗝️
This is a 32-bit pseudo-random value that identifies the security association for this datagram. SPI value 0 is reserved to mean "no security association exists," so it's basically the "nothing here" sign 🫶
The Security Parameters Index values in the range 1 through 255 are reserved for IANA to use in the future. A reserved SPI value won't normally get assigned by IANA unless the use of that exact SPI value is openly specified in an RFC. So no sneaky assignments, periodt 📜
AUTHENTICATION DATA 🧩
The length of this field is variable, but it's always a whole number of 32-bit words.
Lots of implementations need padding to other alignments, like 64-bit, because it helps performance 🚀 All implementations MUST support that padding. The Destination specifies which padding gets used on a per SPI basis. The sender picks the padding value arbitrarily, and that value is included in the Authentication Data calculation.
An implementation will normally use the combo of Destination Address and SPI to find the Security Association, which tells it the field's size and use. The field keeps the same format for every datagram with a given SPI and Destination Address pair. It's giving consistency 💖
The Authentication Data fills the field, starting right after the SPI field. If the field is longer than what's needed to hold the actual authentication data, the unused bit positions get filled with unspecified, implementation-dependent values 🌸
For more on what goes in this field, check each Authentication Transform specification 📚
3.3. Sensitivity Labeling 🏷️
As the IP Security Architecture document explains in more detail, IPv6 will normally use implicit Security Labels instead of the explicit labels that IPv4 currently uses [Ken91] [Atk95a]. It's a whole glow-up 🦋
Now, users MAY choose to carry explicit labels too. For example, IPSO labels as defined by RFC-1108 might be used with IPv4. They can be carried in addition to the implicit labels from the Authentication Header. Explicit label options could also be defined for IPv6, like using the IPv6 end-to-end options header or the IPv6 hop-by-hop options header 🧠
Implementations MAY support explicit labels alongside implicit ones, but they are not required to support explicit labels. If explicit labels are in use, then the explicit label MUST be included in the authentication calculation 🔥
4. CALCULATION OF THE AUTHENTICATION DATA ✨
The authentication data that the IP Authentication Header carries is usually calculated with a message digest algorithm (MD5 is the classic example). The digest is either encrypted, or it's keyed directly [Riv92]. Only algorithms that are believed to be cryptographically strong one-way functions should be used with the IP Authentication Header 🔐
Conventional checksums (e.g., CRC-16) aren't cryptographically strong, so they MUST NOT be used with the Authentication Header. Don't even try it, bestie 💀
When an outgoing IP packet is being processed for Authentication, the first step is for the sending system to find the right Security Association. All Security Associations are unidirectional ➡️ Picking the right one for an outgoing packet is based at least on the sending userid and the Destination Address.
With host-oriented keying, all sending userids share the same Security Association to a given destination. With user-oriented keying, different users, or even different applications of the same user, might use different Security Associations. Whichever one gets selected tells you which algorithm, algorithm mode, key, and other security properties apply to the outgoing packet 🎀
Some fields NECESSARILY get modified during transit from sender to receiver. TTL and HEADER CHECKSUM in IPv4, or Hop Limit in IPv6, are good examples. The sender doesn't know their values at the receiver with certainty. These fields still go into the authentication data calculation, but they get special treatment 🧚 For those fields, the value carried in the IP packet gets replaced by zero for the authentication calculation. Replacing the value with zero, instead of leaving the field out, keeps the alignment intact for the calculation 🫶
The sender MUST compute the authentication over the packet as that packet will appear at the receiver. This requirement exists so the sender can cover future IP optional headers that the receiver might not know about, but that the sender definitely knows about because it's including them. It also allows authentication of data that varies in transit, as long as the sender knows its final value at the receiver in advance 🔮
The sender places the calculated message digest algorithm output into the Authentication Data field within the Authentication Header. For the purposes of the Authentication Data computation, that field is considered to be filled with zeros 🌈
The IPv4 "TIME TO LIVE" and "HEADER CHECKSUM" fields are the only fields in the IPv4 base header that get special handling for the Authentication Data calculation. Fragment reassembly happens before the local IP Authentication Header implementation processes the packet. The "more" bit is cleared on reassembly, of course. So no other IPv4 header fields will vary in transit from the perspective of the IP Authentication Header implementation ✨
The "TIME TO LIVE" and "HEADER CHECKSUM" fields of the IPv4 base header MUST be set to all zeros for the Authentication Data calculation. All other IPv4 base header fields get processed normally, with their actual contents 💅
IPv4 packets can get fragmented by routers along the way, so it's important that reassembly happens before Authentication Header processing. IPv4 Implementations SHOULD use Path MTU Discovery when the IP Authentication Header is being used [MD90] 🛣️
For IPv4, not all options are openly specified in an RFC. That means this document can't list every option that might get modified during transit 🙈 The IP Security Option (IPSO) MUST be included in the Authentication Data calculation whenever it's present in an IP datagram [Ken91] 🔒
If a receiving system doesn't recognise an IPv4 option that's present in the packet, that option is included in the Authentication Data calculation. So any IPv4 packet with an option that changes during transit in a way the sender can't predict, and that the receiver doesn't recognise, will fail the authentication check and get dropped by the receiver 💀
The IPv6 "HOP LIMIT" field is the only field in the IPv6 base header that gets special handling for the Authentication Data calculation. Its value is zero for that calculation. All other fields in the base IPv6 header MUST be included in the Authentication Data calculation, using the normal procedures 💖
Every IPv6 "OPTION TYPE" value contains a bit that MUST be used to decide whether that option's data gets included in the Authentication Data calculation. That's the third-highest-order bit of the IPv6 OPTION TYPE field. If the bit is zero, the corresponding option is included in the calculation. If the bit is one, the corresponding option gets replaced by all zero bits of the same length as the option for the calculation 🦋
The IPv6 Routing Header "Type 0" rearranges the address fields within the packet during transit from source to destination. That's not a problem, though, because the contents of the packet as it'll appear at the receiver are known to the sender and to all intermediate hops. So the IPv6 Routing Header "Type 0" is included in the Authentication Data calculation using the normal procedure 🧚
When a packet with an IP Authentication Header arrives, the receiver first uses the Destination Address and SPI value to find the correct Security Association. Then the receiver independently checks that the Authentication Data field and the received data packet are consistent. Again, the Authentication Data field is assumed to be zero for the sole purpose of that computation 🔍
Exactly how that check happens depends on the algorithm. If the authentication algorithm says the datagram is valid, it gets accepted 🎉 If the algorithm finds that the data and the Authentication Header don't match, the receiver SHOULD discard the received IP datagram as invalid. It MUST also record the authentication failure in the system log or audit log 📝
If a failure like that happens, the recorded log data MUST include the SPI value, the date/time received, the clear-text Sending Address, the clear-text Destination Address, and (if it exists) the clear-text Flow ID. The log data MAY also include other information about the failed packet 🫶
5. CONFORMANCE REQUIREMENTS 📜
Implementations that claim conformance or compliance with this specification MUST fully implement the header described here. They MUST support manual key distribution for use with this option. They MUST comply with all requirements of the "Security Architecture for the Internet Protocol" [Atk95a], and MUST support the use of keyed MD5 as described in the companion document entitled "IP Authentication using Keyed MD5" [MS95] 💅 Implementations MAY also implement other authentication algorithms 🌟
Implementors should consult the most recent version of the "IAB Official Standards" RFC for further guidance on the status of this document 👑
6. SECURITY CONSIDERATIONS 🔐✨
okay bestie, this is the section where the authors get very serious about what this whole thing can and can't do 😭🫶 so grab your snack and let's go.
This entire RFC is about an authentication mechanism for IP. It is NOT a panacea 💀 for the million security issues an internetwork can have. BUT it is a really useful piece for building a secure internetwork, so it's giving "important building block" energy 🧱💖.
Users need to understand that the security this spec gives you depends COMPLETELY on a bunch of things 👀. It depends on how strong the cryptographic algorithm is, how strong the key is, whether the algorithm was implemented correctly, how safe the key management mechanism and its implementation are, and whether the IP Authentication Header and IP implementations are correct on every participating system. If any of those assumptions don't hold, then little to no real security is provided to the user 😭. Implementors are encouraged to use high assurance methods to develop all of the security relevant parts of their products 🔥.
Users who care about confidentiality should consider using the IP Encapsulating Security Payload (ESP) instead of this spec, or in conjunction with it [Atk95b] 🎀. Users who want protection from traffic analysis might consider appropriate link encryption 🦋. Describing and specifying link encryption is out of scope for this note [VK83] 🙈. Users combining the IP Authentication Header with the IP Encapsulating Security Payload should check the ESP specification for details 📖.
One particular issue is ICMP 🙃. Sometimes a packet that causes an error to be reported back via ICMP is so big that it doesn't entirely fit inside the returned ICMP message 😭. In that case, the receiver of the ICMP message might not be able to independently authenticate the returned portion. So the host receiving that ICMP message could either trust an unauthenticated ICMP message, which might create a security problem, or not trust it and therefore not react appropriately to a legitimate ICMP message that should have been reacted to 💀. It isn't clear this can be fully resolved when packets are the same size as or larger than the minimum IP MTU 🤷♀️. Similar complications show up if an encrypted packet causes an ICMP error message to be sent and that packet gets truncated 🫠.
Active attacks are now widely known to exist on the Internet [CER95] 🚨. Because of that, unauthenticated source routing is a significant security risk, whether it's unidirectional (receive-only) or has replies following the original received source route 😱. The only way around that risk is to authenticate all received source routed packets with the IP Authentication Header or some other cryptologic mechanism ✅. It's noteworthy that the attacks described in [CER95] include a subset of the ones described in [Bel89] 👀.
The use of IP tunneling with AH creates multiple pairs of endpoints that might perform AH processing 🌈. So implementers and administrators should carefully think about how tunneling affects the authenticity of received tunneled packets 🧐💜.
ACKNOWLEDGEMENTS 🫶🌸
Okay shoutout time 📣💖. This document benefited hugely from work done by Bill Simpson, Perry Metzger, and Phil Karn, who made general the approach the author originally defined for SIP, SIPP, and finally IPv6 🙌✨.
The basic concept here is mostly derived from the SNMPv2 Security Protocol work described in [GM93] 🧠. Steve Bellovin, Steve Deering, Frank Kastenholz, Dave Mihelcic, and Hilarie Orman gave thoughtful critiques of early versions of this note 💅. And Francis Dupont discovered and pointed out the ICMP security issue in low IP MTU links that's noted just above 🦋🔥.
REFERENCES 📚💜
[Atk95a] Atkinson, R., "Security Architecture for the Internet Protocol", RFC 1825, NRL, August 1995.
[Atk95b] Atkinson, R., "IP Encapsulating Security Payload", RFC 1827, NRL, August 1995.
[Bel89] Steven M. Bellovin, "Security Problems in the TCP/IP Protocol Suite", ACM Computer Communications Review, Vol. 19, No. 2, March 1989.
[BCCH94] Braden, R., Clark, D., Crocker, S., and C. Huitema, "Report of IAB Workshop on Security in the Internet Architecture", RFC 1636, USC/Information Sciences Institute, MIT, Trusted Information Systems, INRIA, June 1994, pp. 21-34.
[CER95] Computer Emergency Response Team (CERT), "IP Spoofing Attacks and Hijacked Terminal Connections", CA-95:01, January 1995. Available via anonymous ftp from info.cert.org in /pub/cert_advisories.
[GM93] Galvin J., and K. McCloghrie, "Security Protocols for version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1446, Trusted Information Systems, Hughes LAN Systems, April 1993.
[Hin94] Bob Hinden (Editor), Internet Protocol version 6 (IPv6) Specification, Work in Progress, October 1994.
[Ken91] Kent, S., "US DoD Security Options for the Internet Protocol", RFC 1108, BBN Communications, November 1991.
[Kno93] Knowles, Stev, "IESG Advice from Experience with Path MTU Discovery", RFC 1435, FTP Software, March 1993.
[MS95] Metzger, P., and W. Simpson, "IP Authentication with Keyed MD5", RFC 1828, Piermont, Daydreamer, August 1995.
[MD90] Mogul, J., and S. Deering, "Path MTU Discovery", RFC 1191, DECWRL, Stanford University, November 1990.
[STD-2] Reynolds, J., and J. Postel, "Assigned Numbers", STD 2, RFC 1700, USC/Information Sciences Institute, October 1994.
[Riv92] Rivest, R., "MD5 Digest Algorithm", RFC 1321, MIT and RSA Data Security, Inc., April 1992.
[VK83] V.L. Voydock & S.T. Kent, "Security Mechanisms in High-level Networks", ACM Computing Surveys, Vol. 15, No. 2, June 1983.
DISCLAIMER ⚠️💅
The views and specification here are those of the author and are not necessarily those of his employer 🙃. The Naval Research Laboratory has not passed judgement on the merits, if any, of this work 🤷♀️. The author and his employer specifically disclaim responsibility for any problems arising from correct or incorrect implementation or use of this specification 💀.
AUTHOR INFORMATION 🎀
Randall Atkinson Information Technology Division Naval Research Laboratory Washington, DC 20375-5320 USA
Phone: (202) 767-2389 Fax: (202) 404-8590 EMail: atkinson@itd.nrl.navy.mil 💌🦋
📦 where this page comes from
- ietf: rfc1826 1995-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms