RFC 3634

Key Distribution Center (KDC) Server Address Sub-option for the Dynamic Host Configuration Protocol (DHCP) CableLabs Client Configuration (CCC) Option 🎀

RFC 3634 · Network Working Group · Category: Standards Track · December 2003 📅

Okay bestie, the header is giving: this is a Standards Track doc, dated December 2003, and it's from the Network Working Group. Four authors worked on it: K. Luehrs (CableLabs), R. Woundy (Comcast Cable), J. Bevilacqua (YAS Corporation), and N. Davoust (YAS Corporation). It doesn't obsolete or update anything, since the header doesn't list any RFCs it replaces or changes. 💖

---

Status of This Memo 📜

So this doc is an Internet standards track protocol spec for the Internet community, and it's asking everyone for discussion and suggestions for improvements 🫶 For where this protocol stands in the standardization process, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share away! 🌈

Copyright Notice ©️

Copyright (C) The Internet Society (2003). All Rights Reserved. 💜

Abstract ✨

This doc defines a brand new sub-option for the CableLabs Client Configuration (CCC) Dynamic Host Configuration Protocol (DHCP) option code. Its whole job is carrying the network addresses of Key Distribution Center (KDC) servers 🔑

1. Introduction 🦋

Okay so the CCC DHCP option code that gives the KDC server address is going to be needed for CableHome-compliant residential gateways. These gateways are set up to use Kerberos for authentication, which is the first step in building a secure SNMPv3 link between the Portal Service (PS) logical element [2,3] in the residential gateways and the SNMP entity in the cable operator's data network. Main character energy 👑

The CCC DHCP option code is there to handle the specific needs of CableLabs client devices during their configuration processes, and this doc proposes a sub-option for it. 🍓

Configuring a class of CableLabs client devices described in [2] and [3] will need a DHCP sub-option that gives the client the network address of a KDC server in the cable operator's data network. 🧚

Now, the devices assumed in [2] and [3] are NOT the same as the devices considered in [1]. The [1] devices do a DNS lookup of the Kerberos Realm name to find the KDC server network address, which is a totally different vibe 💅

So this document proposes a sub-option of the CCC DHCP option code for CableLabs client devices. The sub-option encodes an identifier for the network address of each of one or more Key Distribution Center servers that the CableLabs client device exchanges security information with ✨

The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT" and "MAY" in this document are to be interpreted as described in BCP 14, RFC 2119 [4]. Those caps words are important, so read them carefully 🙈

2. Key Distribution Center IP Address Sub-option 🌸

CableHome specifications will define the Key Distribution Center network address encoding as a sub-option of the CCC DHCP Option code. This field will tell the client device the network address of one or more Key Distribution Center servers 🫶

The KDC Server Address sub-option encoding will follow the format of an IPv4 address. The minimum length for this option is 4 octets, and the length MUST always be a multiple of 4. 🔥 If multiple KDC Servers are listed, they MUST be listed in decreasing order of priority. Iconic. 👑

Here's the format of the KDC Server Address sub-option of the CCC option code:

 SubOpt  Len      Address 1               Address 2
+------+-----+-----+-----+-----+-----+-----+-----+--
|  10  |  n  |  a1 |  a2 |  a3 |  a4 |  a1 |  a2 |  ...
+------+-----+-----+-----+-----+-----+-----+-----+--

3. Security Considerations 💀

Okay, this part is SERIOUS bestie, so pay attention 🚨 This document depends on the DHCP protocol [5] for authentication and security. In other words, it doesn't give you any security beyond what DHCP is (or will be) providing. Potential attack exposures in the DHCP protocol are covered in section 7 of the DHCP protocol specification [5] and in Authentication for DHCP Messages [6].

The CCC option can be used to misdirect network traffic. It does this by handing a CableLabs client device incorrect DHCP server addresses, incorrect provisioning server addresses, and incorrect Kerberos realm names. That misdirection can lead to several threat scenarios 😭 First up, a Denial of Service (DoS) attack can happen if the address information is simply invalid. Second, a man-in-the-middle attack can be set up by giving addresses to a potential snooper. And third, a malicious service provider can steal customers from the customer's selected service provider by changing the Kerberos realm designation. Not it. 🙅‍♀️

Good news though: these threats are mitigated by a few factors 🛡️

Inside the cable delivery architecture required by CableLabs' PacketCable, DOCSIS, and CableHome specifications, the DHCP client connects to a network through a cable modem and the Cable Modem Termination System (CMTS). The CMTS is explicitly configured with a set of DHCP servers that DHCP requests get forwarded to. Plus, a correctly configured CMTS will only allow downstream traffic from specific IP addresses/ ranges. Fr fr 💅

Now, say server addresses were successfully spoofed to the point that a malicious client device could contact a KDC. The client device still must present valid certificates to the KDC before it gets service enabled. Because certificate validation takes a lot of computational overhead, this situation could be a DoS opportunity 😬

A malicious service provider (even one with certificates) could still redirect a customer away from the customer's selected service provider. It's assumed that every service provider allowed onto an access provider's network is a trusted entity that will cooperate to keep the peace. If a service provider is caught redirecting customers, this should be handled as an administrative matter between the access provider and the service provider. 🫠

Another safeguard service providers can use to limit their exposure to their KDC server(s) is to set up their network so the KDC(s) live on a separate subnetwork. Smart. 🧠

Service providers can also protect their KDC server(s) by putting a firewall in front of the KDC(s). The firewall only allows the connections needed for the current provisioning processes. The IP temporary addresses given to the client devices by the DHCP server could be sent directly from the DHCP server to the firewall, opening a hole for Kerberos messages only for those particular IP addresses for a short period of time. If this is used, it would be recommended that service providers authenticate their DHCP server to the KDC as well. That could be done with password authentication rather than a digital certificate, because the DHCP server is co-located with the KDC. 🔐

Last but not least, Kerberos requires mutual client-server authentication 🤝 So the client device must authenticate itself with its digital certificate, and the KDC is required to authenticate itself to the client device. If a hacker tries to redirect the client device by swapping the service provider-configured KDC Server Address sub- option with another IP address, it's not likely to be a valid service provider's KDC server, so authentication will fail. Bye bye, hacker 👋🦋

Acknowledgement 🌸

okay bestie, this is the last little bit of RFC 3634 and it's a sweet one 🫶 It's just a thank-you note! Funding for the RFC Editor function is currently provided by the Internet Society. So basically, the people keeping the RFC library running get their paychecks (or their budget, anyway) from the Internet Society 💅 It's giving "behind-the-scenes crew gets a shoutout" energy ✨

---

And that's a wrap on RFC 3634! 🎀 It was a whole journey, bestie, and you made it through the entire thing 😭👑 Major main character energy. ✨