RFC 3257
Stream Control Transmission Protocol Applicability Statement
RFC 3257: Stream Control Transmission Protocol Applicability Statement ✨
Okay bestie, let's get into RFC 3257 🦋 It was written by L. Coene from Siemens, published in April 2002 under the Network Working Group. It's Informational, so it's guidance and context, not an Internet standard. It doesn't list anything it obsoletes or updates, so it's kinda a standalone vibe 💅
Status of this Memo 📜
This memo gives information to the Internet community. It doesn't specify an Internet standard of any kind, and it can be distributed freely with no limits 🌸
Copyright Notice ©️
The Internet Society owns the copyright here (2002), and all rights are reserved 💜
Abstract ✨
This doc is all about how SCTP can be used. It puts SCTP side by side with the two big transport protocols everyone knows, UDP and TCP, and gives some tips on when SCTP is the move and when it's not 🔥
Table of contents 🗂️
1. Introduction .................................................. 2
1.1 Terminology .................................................. 2
2 Transport protocols ............................................ 2
2.1 TCP service model ............................................ 2
2.2 SCTP service model ........................................... 3
2.3 UDP service model ............................................ 4
3 SCTP Multihoming issues ........................................ 4
4 SCTP Network Address Translators (NAT) issues [RFC2663] ........ 5
5 Security Considerations ........................................ 6
5.1 Security issues with TCP ..................................... 6
5.2 Security issues with SCTP .................................... 7
5.3 Security issues with both TCP and SCTP ....................... 8
6 References and related work .................................... 9
7 Acknowledgments ................................................ 10
Appendix A: Major functions provided by SCTP ..................... 11
Editor's Address ................................................. 12
Full Copyright Statement ......................................... 131 Introduction 👋
SCTP is a reliable transport protocol [RFC2960]. It sits alongside TCP [RFC793], RTP [RFC1889], and UDP [RFC768] to give transport-layer services to upper layer protocols and services. UDP, RTP, TCP, and SCTP are the transport-layer protocols currently on the IETF standards track 🎀 Each one has its own domain and its own set of services, and yes, there's some overlap.
By explaining the situations where each of these protocols' features fit, this document helps implementers and protocol designers pick the right one 💖
It also spotlights the SCTP services that make choosing SCTP the right call ✨ You'll find the main SCTP functions in Appendix A.
1.1 Terminology 📖
The following terms come up a lot in this work:
- Association: an SCTP connection between two endpoints.
- Transport address: a combo of an IP address and an SCTP port number.
- Upper layer: the user of the SCTP protocol. This could be an adaptation layer, a session layer protocol, or the user application directly.
- Multihoming: assigning more than one IP network interface to a single endpoint.
2 Transport protocols 🚛
2.1 TCP service model 🌊
TCP is connection-oriented, a.k.a. session-oriented. That means it needs a connection to be set up before application data gets sent, and it tears that connection down afterwards to free up system resources once the data transfer is done 🧹
TCP is currently the most widely used connection-oriented transport protocol on the Internet, so it's basically the main character 👑
For the upper layer, TCP provides these transport services:
- data reliability;
- data sequence preservation; and
- flow and congestion control.
2.2 SCTP service model 💎
SCTP is also connection-oriented, and it provides all the transport services that TCP does. So lots of Internet applications should find that either TCP or SCTP can meet their transport needs 🫶 Heads up though: for apps that care a lot about processing cost, there might be a difference in that cost between running SCTP with only one ordered stream and one address pair versus running TCP.
SCTP also has some extra tricks that TCP doesn't have. These can make SCTP the better pick for some apps and environments 🔥
- Multi-streams support:
SCTP can deliver several independent user message streams inside a single SCTP association. When it's used properly, this can help with the so-called head-of-line-blocking problem, which comes from the strict sequence delivery rule TCP puts on user data 🙈
This is especially handy for apps that need to swap several logically separate message streams between two endpoints.
- Multi-homing support:
SCTP transparently supports communication between two endpoints when one or both of them is multi-homed 🏠
SCTP keeps an eye on whether the addresses of the remote endpoint are reachable. If something fails, it can transparently fail over from the primary address to an alternate address, and the upper layer doesn't have to do anything 🦸♀️
This lets you build redundant paths between two SCTP endpoints, which is super useful for apps that want fault tolerance at the transport level 🛡️
Getting path redundancy between two SCTP endpoints usually means both endpoints need multiple interfaces with multiple addresses, and routing has to be set up properly (see Section 3) 🗺️
- Preservation of message boundaries:
SCTP keeps application message boundaries intact. This matters when your app data isn't one continuous byte stream but comes in logical chunks that the receiver handles separately 📦
TCP, on the other hand, gives you a reliable data stream with no hints about what the app might consider logical chunks 🤷♀️
- Unordered reliable message delivery:
SCTP can transport user messages that don't have an application-specified order but still need guaranteed reliable delivery 💌
Apps that want to send unordered reliable messages, or that prefer doing their own message sequencing and ordering, may find this SCTP capability useful 🧚
2.3 UDP service model 🕊️
UDP is connectionless. That means apps using UDP don't have to set up or tear down any connection 🫧
As its transport service to the upper layer, UDP only provides:
- best-effort data delivery, and
- preservation of message boundaries.
Apps that don't need reliable transfer of more than one packet's worth of data will find UDP good enough 💅 Lots of transaction-based apps are in this group.
3 SCTP Multihoming Issues 🏡
SCTP gives transport-layer support for multihoming. Multihoming can make things more robust against network failures 🌈 In some apps this can be super important, for example in signaling transport of PSTN signaling messages [RFC2719] 📞
Note that SCTP's multihoming support only covers communication between two endpoints when one or both of them has multiple IP addresses on possibly multiple network interfaces. It does NOT deal with communication ends that contain multiple endpoints (clustered endpoints) that can switch over to an alternate endpoint if the original one fails 🙅♀️
Generally, for really fault-resilient communication between two endpoints, the multihoming feature needs more than one IP network interface for each endpoint. The number of paths used is the minimum number of network interfaces used by any of the endpoints 🛣️ When an endpoint picks its source address, it needs to be careful. If the same source address is always used, the endpoint might still be stuck with the same single point of failure 😬
When an endpoint chooses a source address, it should always pick the source address that matches the IP address of the network interface the packet will go out on, subject to the binding address constraint. Put simply, the binding address constraint means the endpoint must never choose a source address that isn't part of the association. In other words, the peer endpoint has to recognize any source address used as being part of the association 🔐
The availability of the association gets a big boost when the endpoint is on a multi-homed host and has multiple addresses bound to the association endpoint 🚀
4 SCTP Network Address Translators (NAT) issues [RFC2663] 🧭
When two endpoints want to set up an SCTP association and one (or both) of them is behind a NAT (meaning it doesn't have any publicly available network addresses), the endpoint(s) behind the NAT should think about one of the following options:
- When single-homed sessions are used, no transport addresses should be sent in the INIT or INIT ACK chunk (refer to section 3.3 of RFC2960 for chunk definitions). This forces the endpoint that gets the initiation message to use the source address in the IP header as the only destination address for this association. This works through a NAT, but any multi-homing setup at the endpoint behind the NAT won't be visible to its peer, so it can't be taken advantage of. See figure 1 🖼️
+-------+ +---------+ *~~~~~~~~~~* +------+
|Host A | | NAT | * Cloud * |Host B|
| 10.2 +--|10.1|2.1 |----|--------------|---------+ 1.2 |
| | | | | * * | |
+-------+ +---------+ *~~~~~~~~~~* +------+
Fig 1: SCTP through NAT without multihomingFor multihoming, the NAT must have a public IP address for each internal IP address it represents. The host can preconfigure an IP address that the NAT can substitute. Or the NAT can have an internal Application Layer Gateway (ALG) that intelligently translates the IP addresses in the INIT and INIT ACK chunks. See Figure 2 🌟
If Network Address Port Translation is used with a multihomed SCTP endpoint, then any port translation must be applied on a per-association basis. That way, an SCTP endpoint keeps receiving the same port number for all messages within a given association 🎯
+-------+ +----------+ *~~~~~~~~~~* +------+
|Host A | | NAT | * Cloud * |Host B|
| 10.2 +---+ 10.1|5.2 +-----+ 1.1<+->3.1--+---------+ 1.2 |
| 11.2 +---+ 11.1|6.2 | | +->4.2--+---------+ 2.2 |
| | | | * * | |
+-------+ +----------+ *~~~~~~~~~* +------+
Fig 2: SCTP through NAT with multihoming(2) Another option is to use the hostname feature and DNS to resolve the addresses 🔍 The hostname is included in the INIT of the association or in the INIT ACK. The hostname must be resolved by DNS before the association is completely set up. There are special NAT and DNS issues here, so refer to RFC2694 for details 💀
5 Security Considerations 🔒
This section is a big deal, so pay attention 👀
In this section, we're going to talk through some of the relevant security issues that come up when deploying the connection-oriented transport protocols 🫣
5.1 Security issues with TCP ✨
Okay so some TCP implementations were genuinely vulnerable to blind denial of service attacks 😭. "Blind" means the attacker couldn't see most of the traffic going to or from the target host, and they still managed to cause chaos.
Here's how it went. The attacker would flood the target with a huge pile of connection establishment requests (TCP-SYN packets), often with faked IP source addresses 🎭. The attacked host would reply with SYN-ACK packets and move into the SYN-received state, which means it's reserving space for a TCB for each one. Eventually the SYN-queue fills up (the number of connections waiting to be established hits a limit), and the poor host has to start turning down new connection requests 💀.
TCP implementations can use the SYN-cookies algorithm [SYN-COOK] to lower the risk of these blind denial of service attacks 🍪. Switching to it when the SYN-queues are full still fully conforms to the TCP specification [RFC793]. The catch is that options like window scale [RFC1323] aren't possible while it's active 🙃. With the SYN-cookie mechanism, a TCB only gets created once the client sends back a valid ACK packet to the server, which means the 3-way handshake has actually been completed. No handshake, no TCB, no drama ✨.
Blind connection forgery is another possible threat to TCP 👀. If an attacker can guess valid sequence numbers, they can forge a connection. But with a secure hashsum algorithm, the likelihood of pulling this off is about 1 in 2^24 with some of the current SYN-cookie implementations. So the attacker would have to send 2^24 packets before getting one forged connection when SYN-cookies are in use. That's a lot of effort, bestie 🫶.
5.2 Security issues with SCTP 🦋
SCTP was designed with the experiences made with TCP in mind, so it's giving "learned from our mistakes" 💅. To make life hard for blind attackers (attackers who aren't man-in-the-middle) trying to inject forged SCTP datagrams into existing associations, each side of an SCTP association uses a 32 bit value called "Verification Tag" 🏷️. This tag makes sure a datagram really belongs to the existing association. So on top of having a combination of source and destination transport addresses that belong to an established association, a valid SCTP datagram also needs the correct tag to be accepted by the recipient.
Unlike TCP, using a cookie during association establishment is mandatory in SCTP 🍪. For the server, a new association is fully established after three messages (containing INIT, INIT-ACK and COOKIE-ECHO chunks) have been exchanged. The cookie is a variable length parameter that holds all the relevant data needed to initialize the TCB on the server side, plus an HMAC to secure it. This HMAC is either MD5 as per [RFC1321] or SHA-1 [SHA1], and it's computed over the cookie and a secret, server-owned key 🔐.
As specifically prescribed for SCTP implementations [RFC2960], extra resources for new associations may only be reserved if a valid COOKIE-ECHO chunk is received by a client, AND the computed HMAC for this new cookie matches the one contained in the cookie 🙌.
With SCTP, the chances of an attacker blindly forging a connection are even lower than with TCP using SYN-cookies. The attacker would have to guess the correct value for the HMAC contained in the cookie, which is lower than 1 in 2^128. For all practical purposes, that's negligible 🌌.
It should be noted that SCTP only tries to increase the availability of a network. SCTP does not contain any protocol mechanisms that are directly related to user message authentication, integrity and confidentiality functions. For such features, it depends on the IPsec protocols and architecture and/or on security features of the application protocols. 🚨
Transport Layer security (TLS) [RFC2246] using SCTP must always use in-order streams 🌊.
Right now the IPSEC working group is looking into supporting multi-homing with IPSEC protocols 👩💻. At the moment, using IPSEC means you need 2 * N * M security associations if one endpoint uses N addresses and the other uses M addresses. Yikes, that's a lot of security associations 😵💫.
5.3 Security Issues with both TCP and SCTP 🌈
It's important to note that neither TCP nor SCTP protects itself from man-in-the-middle attacks, where an established session might get hijacked. That's assuming the attacker can see the traffic from either endpoint and can inject their own packets to it 🕵️.
Also, to prevent blind connection/session setup forgery, both TCP implementations that support SYN-cookies and SCTP implementations rely on a server-known, secret key to protect the HMAC data 🔑. It must be ensured that this key is created subject to the recommendations mentioned in [RFC1750].
SCTP was designed carefully to avoid some of the problems that showed up with TCP, but it hasn't been widely deployed yet 🌱. So it's possible that new security issues will be identified that have to be addressed in further revisions of [RFC2960]. Stay tuned, bestie 👀💜.
6 References and related work 📚
[RFC2960] Stewart, R., Xie, Q., Morneault, K., Sharp, C.,
Schwarzbauer, H., Taylor, T., Rytina, I., Kalla, M.,
Zhang, L. and V. Paxson, "Stream Control Transmission
Protocol", RFC 2960, October 2000.
[RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
[RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address
Translator (NAT) Terminology and Considerations", RFC
2663, August 1999.
[RFC2694] Srisuresh, P., Tsirtsis, G., Akkiraju, P. and A.
Heffernan, "DNS extensions to Network Address Translators
(DNS_ALG)", RFC 2694, September 1999.
[RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768,
August 1980.
[RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC
793, September 1981.
[RFC2719] Ong, L., Rytina, I., Garcia, M., Schwarzbauer, H., Coene,
L., Lin, H., Juhasz, I., Holdrege, M. and C. Sharp,
"Architectural Framework for Signaling Transport", RFC
2719, October 1999.
[RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
April 1992.
[RFC1323] Jacobson, V., Braden, R. and D. Borman, "TCP Extensions
for High Performance", RFC 1323, May 1992.
[RFC1750] Eastlake, D., Crocker, S. and J. Schiller, "Randomness
Recommendations for Security", RFC 1750, December 1994.
[SHA1] NIST FIPS PUB 180-1, "Secure Hash Standard," National
Institute of Standards and Technology, U.S. Department of
Commerce, April 1995.
[SYNCOOK] Dan J. Bernstein, SYN cookies, 1997, see also
<http://cr.yp.to/syncookies.html>
[RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
RFC 2246, January 1999.
[RFC1889] Schulzrinne, H., Casner, S., Frederick, R. and V.
Jacobson, "RTP: A Transport Protocol for Real-Time
Applications", RFC 1889, January 1996.7 Acknowledgments 💖
This document was initially developed by a design team of legends: Lode Coene, John Loughney, Michel Tuexen, Randall R. Stewart, Qiaobing Xie, Matt Holdrege, Maria-Carmen Belinchon, Andreas Jungmaier, Gery Verwimp and Lyndon Ong 👑.
The authors wish to thank Renee Revis, I. Rytina, H.J. Schwarzbauer, J.P. Martin-Flatin, T. Taylor, G. Sidebottom, K. Morneault, T. George, M. Stillman, N. Makinae, S. Bradner, A. Mankin, G. Camarillo, H. Schulzrinne, R. Kantola, J. Rosenberg, R.J. Atkinson, and many others for their invaluable comments 🫶🎀.
Appendix A: Major functions provided by SCTP ✨
- Reliable Data Transfer 💌
- Multiple streams to help avoid head-of-line blocking 🌊
- Ordered and unordered data delivery on a per-stream basis 📦
- Bundling and fragmentation of user data 🧩
- TCP friendly Congestion and flow control 🚦
- Support continuous monitoring of reachability 👀
- Graceful termination of association 👋
- Support of multi-homing for added reliability 🏠
- Some protection against blind denial-of-service attacks 🛡️
- Some protection against blind masquerade attacks 🎭
8 Editor's Address 💌
Lode Coene
Siemens Atea
Atealaan 34
B-2200 Herentals
Belgium
Phone: +32-14-252081
EMail: lode.coene@siemens.atea.be9. Full Copyright Statement 🌸
Copyright (C) The Internet Society (2002). All Rights Reserved. 💜
This document and translations of it may be copied and furnished to others. Derivative works that comment on or otherwise explain it, or assist in its implementation, may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations. The exceptions are: needing it for developing Internet standards, in which case the procedures for copyrights defined in the Internet Standards process must be followed, or translating it into languages other than English 🌍.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns ♾️.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 🙏.
Acknowledgement 🫶
Funding for the RFC Editor function is currently provided by the Internet Society 💅✨.
📦 where this page comes from
- ietf: rfc3257 2002-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms