RFC 3078

Microsoft Point-To-Point Encryption (MPPE) Protocol

📅 published March 2001, from ietf

Status of This Memo ✨

okay so this part is basically the disclaimer 🎀 It's info for the Internet community, not an Internet standard of any kind, and distribution is unlimited. Totally shareable, bestie 💅

Copyright (C) The Internet Society (2001). All Rights Reserved.

Abstract 🦋

okay so PPP (Point-to-Point Protocol) is the standard way to send multi-protocol datagrams over point-to-point links 🚀 Then there's the PPP Compression Control Protocol, which lets you negotiate and use compression over PPP-encapsulated links.

This doc is about Microsoft Point to Point Encryption (MPPE), which is how you make PPP-encapsulated packets more confidential 🔐 It's giving privacy glow-up.

Specification of Requirements 🌸

so the key words "MAY", "MUST", "MUST NOT", optional, recommended, "SHOULD", and "SHOULD NOT" get interpreted as described in [5]. Just keep that in mind as you read, because the caps are doing real work here 🫶

1. Introduction ✨

okay so MPPE is a way of representing PPP packets in an encrypted form. It's literally the whole vibe 🧚

MPPE uses the RSA RC4 [3] algorithm for data confidentiality. The length of the session key used to initialize the encryption tables can be negotiated 🔑 Right now MPPE supports 40-bit and 128-bit session keys.

MPPE session keys change frequently 🔄 How often depends on the options you negotiated, and it could be every packet. Iconic, honestly 🔥

MPPE is negotiated within option 18 [4] in the Compression Control Protocol 💜

2. Configuration Option Format 🎀

Description

The CCP Configuration Option is what negotiates MPPE on the link ✨ By default (so if MPPE negotiation isn't even attempted), no encryption is used 🙈 But if MPPE negotiation is attempted and it fails, the link SHOULD be terminated 💀

Here's a summary of the CCP Configuration Option format. The fields go left to right 🌈

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Type     |    Length     |        Supported Bits         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |        Supported Bits         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type

It's 18 🎀

Length

It's 6 🎀

Supported Bits

This field is 4 octets, most significant octet first 🍓

      3                   2                   1
    1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |             |H|                               |M|S|L|D|     |C|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

the 'C' bit is used by MPPC [4], and this memo doesn't go into it further 🙃 The 'D' bit is obsolete 🥀 Some older peers might still try to negotiate it, but it SHOULD NOT be accepted. If the 'L' bit is set (that's 0x20 in the least significant octet), the sender wants to negotiate 40-bit session keys. If the 'S' bit is set (0x40 in the least significant octet), the sender wants 128-bit session keys 🔥 If the 'M' bit is set (0x80 in the least significant octet), the sender wants 56-bit session keys. If the 'H' bit is set (0x01 in the most significant octet), the sender wants to negotiate stateless mode, where the session key changes after each packet is sent (see section 10, below) ✨ In the rest of the doc, the 'S', 'M' and 'L' bits get called "encryption options" collectively 💅

All other bits are reserved and MUST be set to 0. Non-negotiable, bestie 🔒

2.1. Option Negotiation 🦋

MPPE options get negotiated as described in [2]. The negotiation initiator SHOULD request all of the options it supports 🫶 The responder SHOULD NAK with a single encryption option. Stateless mode can always be negotiated, though, independent of and in addition to an encryption option 🧚 If the responder supports more than one encryption option from the set the initiator asked for, the option it picks SHOULD be the "strongest" one offered 💪 Informally, the MPPE encryption options rank like this:

   STRONGEST
      128-bit encryption ('S' bit set)
      56-bit  encryption ('M' bit set)
      40-bit  encryption ('L' bit set)
   WEAKEST

this ranking takes into account how generally accepted the cipher's strength is 🧠

The initiator SHOULD then either send another request with the same option(s) as the responder's NAK, or cancel the negotiation and drop the connection 🙅‍♀️

3. MPPE Packets 🌸

okay so before any MPPE packets get sent, PPP MUST reach the Network-Layer Protocol phase, and the CCP Control Protocol MUST reach the Opened state 🚦

Exactly one MPPE datagram gets encapsulated in the PPP Information field 🎀 The PPP Protocol field says type 0x00FD for all encrypted datagrams 🔐

The maximum length of an MPPE datagram sent over a PPP link is the same as the maximum length of the Information field of a PPP encapsulated packet 📏

Only packets with PPP Protocol numbers from 0x0021 to 0x00FA get encrypted 🙈 Everything else doesn't go through the MPPE processor and gets sent with its original PPP Protocol number.

Padding

It's recommended that padding not be used with MPPE 🙃 If the sender does use padding, it MUST negotiate the Self-Describing-Padding Configuration option [10] during the LCP phase and use self-describing pads 🧾

Reliability and Sequencing

MPPE doesn't need a reliable link 💅 Instead, it relies on a 12-bit coherency count in each packet to keep the encryption tables in sync 🔄 If stateless mode hasn't been negotiated and the coherency count in a received packet doesn't match the expected count, the receiver MUST send a CCP Reset-Request packet to resync the RC4 tables 🚨

MPPE expects packets to arrive in sequence 📬

MPPE MAY be used over a reliable link, as described in "PPP Reliable Transmission" [6]. Honestly though, that usually just adds unnecessary overhead, since only the coherency count is needed 🙄

Data Expansion

MPPE doesn't expand or compress data 🫧 The number of octets going into and coming out of the MPPE processor is the same.

3.1. Packet Format 🧚

Here's a summary of the MPPE packet format. Fields go left to right 🌈

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |          PPP Protocol         |A|B|C|D|    Coherency Count    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      Encrypted Data...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

PPP Protocol

The PPP Protocol field is described in the Point-to-Point Protocol Encapsulation [1] 📖

When MPPE gets successfully negotiated by the PPP Compression Control Protocol, the value of this field is 0x00FD ✨ This value MAY be compressed when Protocol-Field-Compression is negotiated.

Bit A

This bit says the encryption tables were initialized before this packet was generated 🧊 The receiver MUST re-initialize its tables with the current session key before decrypting this packet. This bit is called the FLUSHED bit in this doc 🚿 If the stateless option has been negotiated, this bit MUST be set on every encrypted packet 🔁 Also, MPPC and MPPE both recognize the FLUSHED bit, so if stateless is negotiated, it applies to both MPPC and MPPE 👯‍♀️

Bit B

This bit doesn't mean anything in MPPE 🤷‍♀️

Bit C

This bit doesn't mean anything in MPPE either 🤷‍♀️

Bit D

Setting this bit to 1 means the packet is encrypted 🔐 Setting it to 0 means the packet is not encrypted.

Coherency Count

The coherency count makes sure packets are sent in the right order and that none got dropped 🧮 It's a monotonically increasing counter that goes up by 1 for each packet sent. When it hits 4095 (0x0FFF), it resets to 0 🔁

Encrypted Data

The encrypted data starts with the protocol field 🧁 For example, with an IP packet (0x0021 followed by an IP header), the MPPE processor encrypts the protocol field first and then encrypts the IP header.

If the packet has header compression, the MPPE processor is applied AFTER header compression is done, and it MUST be applied to the compressed header too 🗜️ For example, if a packet had protocol type 0x002D (for a compressed TCP/IP header), the MPPE processor would encrypt 0x002D first, then encrypt the compressed Van-Jacobson TCP/IP header 💫

Implementation Note

If both MPPE and MPPC are negotiated on the same link, the sender MUST invoke the MPPE processor after the MPPC processor, and the receiver MUST invoke the MPPE processor before the MPPC processor 🧩 This order is super important, so don't skip it, bestie 😭

4. Initial Session Keys 🗝️

In the current implementation, initial session keys are derived from peer credentials. Other derivation methods are possible though 🌷 For example, some authentication methods (like Kerberos [8] and TLS [9]) produce session keys as a side effect of authentication, and those keys may be used by MPPE in the future 👀 That's why the techniques for deriving initial MPPE session keys are described in separate documents 📚

5. Initializing RC4 Using a Session Key 🌈

Once an initial session key has been derived, the RC4 context gets initialized like this:

   rc4_key(RC4Key, Length_Of_Key, Initial_Session_Key)

6. Encrypting Data 🔐

Once it's initialized, data gets encrypted with the following function, then sent with the CCP and MPPE headers 📦

   EncryptedData = rc4(RC4Key, Length_Of_Data, Data)

7. Changing Keys 🦋

7.1. Stateless Mode Key Changes 💜

If stateless encryption has been negotiated, the session key changes every time the coherency count changes, which means on every packet 🔄 In stateless mode, the sender MUST change its key before encrypting and transmitting each packet, and the receiver MUST change its key after receiving each packet but before decrypting it (see "Synchronization," below) 🫶

7.2. Stateful Mode Key Changes ✨

okay bestie, so if stateful encryption got negotiated, the sender MUST change its key before encrypting and sending any packet where the low order octet of the coherency count equals 0xFF (that's the "flag" packet 🚩). And the receiver MUST change its key after receiving it, but before decrypting it, a "flag" packet (see "Synchronization" below) 🔑✨

7.3. The MPPE Key Change Algorithm 🧮

here's the method for changing keys, no cap it's kinda chef's kiss 💅

/*
 * SessionKeyLength is 8 for 40-bit keys, 16 for 128-bit keys.
 *
 * SessionKey is the same as StartKey in the first call for
 * a given session.
 */

void
GetNewKeyFromSHA(
IN  unsigned char *StartKey,
IN  unsigned char *SessionKey,
IN  unsigned long SessionKeyLength
OUT unsigned char *InterimKey )
{
   unsigned char  Digest[20];

   ZeroMemory(Digest, 20);
   /*
    * SHAInit(), SHAUpdate() and SHAFinal()
    * are an implementation of the Secure
    * Hash Algorithm [7]
    */

   SHAInit(Context);
   SHAUpdate(Context, StartKey, SessionKeyLength);
   SHAUpdate(Context, SHApad1, 40);
   SHAUpdate(Context, SessionKey, SessionKeyLength);
   SHAUpdate(Context, SHApad2, 40);
   SHAFinal(Context, Digest);

   MoveMemory(InterimKey, Digest, SessionKeyLength);
}

next up, the RC4 tables get re-initialized using the brand new interim key 🌸

rc4_key(RC4Key, Length_Of_Key, InterimKey)

then the interim key gets encrypted using the new tables to make a new session key 🦋

SessionKey = rc4(RC4Key, Length_Of_Key, InterimKey)

for 40-bit session keys, the most significant three octets of the new session key are now set to 0xD1, 0x26 and 0x9E respectively. for 56-bit keys, the most significant octet is set to 0xD1 🎀

last step, the RC4 tables get re-initialized using the new session key 👑

rc4_key(RC4Key, Length_Of_Key, SessionKey)

8. Synchronization 🔄

packets can get lost in transfer, it happens 😭 so the next sections explain synchronization for both the stateless and stateful cases 🫶

8.1. Stateless Synchronization 🌈

if stateless encryption got negotiated and the coherency count in the received packet (C1) is greater than the coherency count in the last packet previously received (C2), the receiver MUST perform N = C1 - C2 key changes before decrypting the packet. that's so its session key stays in sync with the sender's session key 💜 Normally N is just 1, but if some packets in between got lost, N can be bigger than 1. for example, if C1 = 5 and C2 = 02 then N = 3 key changes are required 🧚

since the FLUSHED bit is set on every packet when stateless encryption was negotiated, sending CCP Reset-Request packets is not required for synchronization ✨

8.2. Stateful Synchronization 🍓

if stateful encryption got negotiated, the sender MUST change its key before encrypting and transmitting any packet where the low order octet of the coherency count equals 0xFF (the "flag" packet), and the receiver MUST change its key after receiving it, but before decrypting it. BUT the "flag" packet might get lost 😱 if that happens, the low order octet of the coherency count in the received packet will be less than the one in the last packet previously received. in that case, the receiver MUST perform a key change before decrypting the newly received packet (because the sender already changed its key before sending that packet), and then send a CCP Reset-Request packet (see below) 🙈

it's possible that 256 or more consecutive packets could be lost. the receiver SHOULD detect this condition and perform the number of key changes needed to resync with the sender 💅

if packet loss gets detected while using stateful encryption, the receiver MUST drop the packet and send a CCP Reset-Request packet without data. after sending that CCP Reset-Request packet, the receiver SHOULD silently discard all packets until a packet comes in with the FLUSHED bit set. when a packet with the FLUSHED bit set arrives, the receiver MUST set its coherency count to the one in that packet and re-initialize its RC4 tables using the current session key:

rc4_key(RC4Key, Length_Of_Key, SessionKey)

when the sender receives a CCP Reset-Request packet, it MUST re-initialize its own RC4 tables using the same method and set the FLUSHED bit in the next packet it sends. so synchronization gets achieved without a CCP Reset-Ack packet 🦋👑

9. Security Considerations 💀

okay this section is serious, so read it carefully bestie 🥺

because of the way the RC4 tables get reinitialized during stateful synchronization, it's possible that two packets could be encrypted using the same key. for this reason, the stateful mode SHOULD NOT be used in lossy network environments (for example, layer two tunnels on the Internet) ⚠️

since the MPPE negotiation is not integrity protected, an active attacker could change the strength of the keys in use by modifying the Supported Bits field of the CCP Configuration Option packet. the effects of this attack can be minimized through appropriate peer configuration, however 🔐

Peers MUST NOT transmit user data until the MPPE negotiation is complete. no sending your secrets before the handshake is done, periodt 🛑

it's possible that an active attacker could modify the coherency count of a packet, causing the peers to lose synchronization 😵

an active denial-of-service attack could be mounted by methodically inverting the value of the 'D' bit in the MPPE packet header 💀

10. References 📚

  • [1] Simpson, W., Editor, "The Point-to-Point Protocol (PPP)", STD 51, RFC 1661, July 1994.
  • [2] Rand, D., "The PPP Compression Control Protocol (CCP)", RFC 1962, June 1996.
  • [3] RC4 is a proprietary encryption algorithm available under license from RSA Data Security Inc. For licensing information, contact:
RSA Data Security, Inc.
100 Marine Parkway
Redwood City, CA 94065-1031
  • [4] Pall, G., "Microsoft Point-to-Point Compression (MPPC) Protocol", RFC 2118, March 1997.
  • [5] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [6] Rand, D., "PPP Reliable Transmission", RFC 1663, July 1994.
  • [7] "Secure Hash Standard", Federal Information Processing Standards Publication 180-1, National Institute of Standards and Technology, April 1995.
  • [8] Kohl, J. and C. Neuman "The Kerberos Network Authentication System (V5)", RFC 1510, September 1993.
  • [9] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", RFC 2246, January 1999.
  • [10] Simpson, W., Editor, "PPP LCP Extensions", RFC 1570, January 1994.

11. Acknowledgements 🫶

Anthony Bell, Richard B. Ward, Terence Spies and Thomas Dimitri, all of Microsoft Corporation, significantly contributed to the design and development of MPPE. the MPPE glow-up is because of them 👑

additional thanks to Robert Friend, Joe Davies, Jody Terrill, Archie Cobbs, Mark Deuser, and Jeff Haag, for useful feedback 💖

12. Authors' Addresses 📮

questions about this memo can be directed to:

Gurdeep Singh Pall
Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052
USA

Phone: +1 425 882 8080
Fax:   +1 425 936 7329
EMail: gurdeep@microsoft.com
Glen Zorn
cisco Systems
500 108th Avenue N.E.
Suite 500
Bellevue, Washington 98004
USA

Phone: +1 425 438 8218
Fax:   +1 425 438 1848
EMail: gwz@cisco.com

Copyright (C) The Internet Society (2001). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌷

Funding for the RFC Editor function is currently provided by the Internet Society 💜

📦 where this page comes from