RFC 4543
The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH
The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH 🦋
RFC 4543 ✨ is a Standards Track doc from the Network Working Group, dated May 2006. It's written by D. McGrew (Cisco Systems, Inc. 💖) and J. Viega (McAfee, Inc. 🫶). The title block doesn't list any "Obsoletes" or "Updates" line, so there's nothing it replaces or changes. 🌸
Status of This Memo 📜
Okay so this part is basically the paperwork 💅. It says this is an Internet standards track protocol for the Internet community, and it wants your feedback and ideas for making it better 🫶. If you want to know where this protocol stands officially, check the current "Internet Official Protocol Standards" (STD 1) document. And the memo can be distributed as much as people want 🌈.
Copyright Notice
Copyright (C) The Internet Society (2006). 🔥
Abstract ✨
This memo explains how the Advanced Encryption Standard (AES) Galois Message Authentication Code (GMAC) can be used to prove where data came from (data origin authentication) 🔐. It does not hide the data, though, so there's no confidentiality here. It plugs into the IPsec Encapsulating Security Payload (ESP) and Authentication Header (AH) 🦋. GMAC is built on the Galois/Counter Mode (GCM) of operation. It's fast enough for hardware doing 10 gigabits per second and up, and it also works really nicely in software 💜.
Table of Contents 🗂️
1. Introduction ....................................................2
1.1. Conventions Used in This Document ..........................3
2. AES-GMAC ........................................................3
3. The Use of AES-GMAC in ESP ......................................3
3.1. Initialization Vector ......................................4
3.2. Nonce Format ...............................................4
3.3. AAD Construction ...........................................5
3.4. Integrity Check Value (ICV) ................................6
3.5. Differences with AES-GCM-ESP ...............................6
3.6. Packet Expansion ...........................................7
4. The Use of AES-GMAC in AH .......................................7
5. IKE Conventions .................................................8
5.1. Phase 1 Identifier .........................................8
5.2. Phase 2 Identifier .........................................8
5.3. Key Length Attribute .......................................9
5.4. Keying Material and Salt Values ............................9
6. Test Vectors ....................................................9
7. Security Considerations ........................................10
8. Design Rationale ...............................................11
9. IANA Considerations ............................................11
10. Acknowledgements ..............................................11
11. References ....................................................12
11.1. Normative References .....................................12
11.2. Informative References ...................................121. Introduction 🦋
Okay bestie, here's the big picture 💖. This doc describes AES-GMAC mode (AES-GMAC) as a way to get data origin authentication in ESP [RFC4303] and in AH [RFC4302]. In the spec, these are called ENCR_NULL_AUTH_AES_GMAC and AUTH_AES_GMAC, respectively ✨.
ENCR_NULL_AUTH_AES_GMAC is the bestie of the AES Galois/Counter Mode ESP [RFC4106]. That one gives you authentication and confidentiality, but ENCR_NULL_AUTH_AES_GMAC is for when you don't want the confidentiality part 🙈. Like GCM, GMAC is efficient, secure, and really fast in hardware 🔥. And here's the iconic bit: if you already have AES-GCM-ESP running, adding ENCR_NULL_AUTH_AES_GMAC and AUTH_AES_GMAC barely costs you anything extra 👑.
This document doesn't go into the implementation details of GCM or GMAC. You'll find those in [GCM], along with test vectors 🧚.
1.1. Conventions Used in This Document 💅
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖.
2. AES-GMAC 🌸
GMAC is a block cipher mode of operation that gives you data origin authentication. It's defined using the GCM authenticated encryption operation, which takes four inputs: a secret key, an initialization vector (IV), a plaintext, and an input for additional authenticated data (AAD) 🔑. It spits out two things: a ciphertext that's the same length as the plaintext, and an authentication tag 🎀. GMAC is the special case where the plaintext has length zero. That means the ciphertext is empty and gets ignored, so the only real output is the Authentication Tag ✨. The rest of this section explains how the GMAC IV and AAD get built from the ESP and AH fields, and how the ESP and AH packets get built from the Authentication Tag 🦋.
Below, the AES-GMAC IV input is called a nonce, so it doesn't get mixed up with the IV fields in the packets 💜. The same nonce and key combination MUST NOT be used more than once, because reusing a nonce/key combination wrecks the security guarantees of AES-GMAC 💀.
This restriction makes it tricky to use this mode safely with statically configured keys 😭. For good security, implementations MUST use an automated key management system, such as the Internet Key Exchange (IKE) (either version two [RFC4306] or version one [RFC2409]), so this requirement gets met 🔐.
3. The Use of AES-GMAC in ESP 🎀
The AES-GMAC algorithm for ESP is defined as an ESP "combined mode" algorithm (see Section 3.2.3 of [RFC4303]), not as an ESP integrity algorithm 💅. It's called ENCR_NULL_AUTH_AES_GMAC to make it super clear that it does no encryption and gives no confidentiality 🙈.
Rationale: ESP has no way for integrity transforms to put an initialization vector inside the Payload field. Only encryption transforms are expected to use IVs 🧠. Defining GMAC as an encryption transform sidesteps that problem, and lets GMAC get the same pipelining perks that GCM gets ⚡.
Like all ESP combined modes, it's registered in IKEv2 as an encryption transform, also known as a "Type 1" transform 📋. It MUST NOT be used together with any other ESP encryption transform (within a particular ESP encapsulation) 🚫. If you want confidentiality, use GCM ESP [RFC4106] instead, and that one SHOULD be used 🔒.
3.1. Initialization Vector 🧁
With ENCR_NULL_AUTH_AES_GMAC, an explicit Initialization Vector (IV) lives in the ESP Payload, right at the start of that field ✨. The IV MUST be eight octets long 📏. For a given key, the IV MUST NOT repeat 🙅♀️. The most natural way to do this is with a counter, but implementations can set the IV field any way that guarantees uniqueness, like a linear feedback shift register (LFSR) 🌈. The best part is that the sender can pick any IV generation method that meets the uniqueness requirement without having to coordinate with the receiver 🫶.
3.2. Nonce Format 🍓
The nonce passed to the AES-GMAC authentication algorithm has this layout 📐:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Salt |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initialization Vector |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 1: Nonce Format
Here's what the nonce components are 💜:
- Salt: The salt field is a four-octet value. It gets assigned at the start of the security association and then stays the same for the whole life of that security association 🧂. The salt SHOULD be unpredictable (i.e., chosen at random) before it gets selected, but it doesn't need to be secret 🤫. Section 5.4 explains how to set the salt for a Security Association set up through the Internet Key Exchange 🗝️.
- Initialization Vector: This field is described in Section 3.1 ✨.
3.3. AAD Construction 🦋
Data integrity and data origin authentication cover the SPI, (Extended) Sequence Number, Authenticated Payload, Padding, Pad Length, and Next Header fields 🛡️. They all get packed into the AES-GMAC Additional Authenticated Data (AAD) field 📦. There are two AAD formats: one for 32-bit sequence numbers and one for 64-bit extended sequence numbers 🔢. Figure 2 shows the 32-bit version, and Figure 3 shows the 64-bit extended version 👀.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| SPI |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 32-bit Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Authenticated Payload (variable) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Padding (0-255 bytes) |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | Pad Length | Next Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 2: AAD Format with 32-bit Sequence Number
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| SPI |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 64-bit Extended Sequence Number |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Authenticated Payload (variable) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Padding (0-255 bytes) |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | Pad Length | Next Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 3: AAD Format with 64-bit Extended Sequence Number
Which one you use depends on the security association (SA) management protocol that created the SA 🧩. For IKEv2 [RFC4306], this gets negotiated via Transform Type 5 ✨. Without any negotiation, ESP defaults to 64-bit extended sequence numbers (see Section 2.2.1 of [RFC4303]) 💖.
3.4. Integrity Check Value (ICV) 🎀
okay so the ICV is literally just the AES-GMAC Authentication Tag, nothing extra 🧁 The tag MUST NOT be truncated, so the ICV is 16 octets long. bestie, no shortening it 🙅♀️
3.5. Differences with AES-GCM-ESP 💅
let's talk about how this is different from AES-GCM-ESP [RFC4106] 👀 The big deal is that here, the AAD is the SPI, Sequence Number, and ESP Payload, and the AES-GCM plaintext is zero-length. In AES-GCM-ESP, the AAD is only the SPI and Sequence Number, and the plaintext is the ESP Payload. Figure 4 shows the whole glow-up ✨ It shows the case where the Extended Sequence Number option is not used. If that option is used, the Sequence Number field in the figure gets swapped out for the Extended Sequence Number.
ENCR_NULL_AUTH_AES_GMAC is not equivalent to AES-GCM-ESP with encryption "turned off" 🚫 Don't mix them up!
The ICV computations are still pretty similar, though, because of how the GHASH function is structured [GCM] 🧩
+-> +-----------------------+ <-+
AES-GCM-ESP | | SPI | |
AAD -------+ +-----------------------+ |
| | Sequence Number | |
+-> +-----------------------+ |
| Authentication | |
| IV | |
+->+-> +-----------------------+ +
AES-GCM-ESP | | | |
Plaintext -+ ~ ESP Payload ~ |
| | | |
| +-----------+-----+-----+ |
| | Padding | PL | NH | |
+----> +-----------+-----+-----+ <-+
|
ENCR_NULL_AUTH_AES_GMAC AAD --+Figure 4: Differences between ENCR_NULL_AUTH_AES_GMAC and AES-GCM-ESP 📸
3.6. Packet Expansion 🫧
the IV adds eight octets to the packet and the ICV adds 16 octets 💕 Those are the only sources of expansion, except for the 10-13 bytes taken up by the ESP SPI, Sequence Number, Padding, Pad Length, and Next Header fields (when you use the minimal amount of padding).
4. The Use of AES-GMAC in AH 🦋
in AUTH_AES_GMAC, the AH Authentication Data field holds the IV and the Authentication Tag, as shown in Figure 5 🎀 This is not your usual AH situation, since this field has both an input to the authentication algorithm (the IV) and the output of that algorithm (the tag). No padding is needed here, because the length is already a multiple of 64 bits ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initialization Vector (IV) |
| (8 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| Integrity Check Value (ICV) (16 octets) |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 5: The AUTH_AES_GMAC Authentication Data Format 📸
the IV works the way Section 3.1 describes, and the ICV works the way Section 3.4 describes 🫶 The GMAC Nonce input is formed as described in Section 3.2. The GMAC AAD input is the authenticated data defined in Section 3.1 of [RFC4302]. Those values get handed to that algorithm along with the secret key, and the authentication tag it spits out becomes the ICV 🧚
5. IKE Conventions 🌸
this section is all about the conventions for generating keying material and salt values for ENCR_NULL_AUTH_AES_GMAC and AUTH_AES_GMAC, using IKE version one [RFC2409] and version two [RFC4306] 🔑
5.1. Phase 1 Identifier 🙈
this document does NOT spell out how to use AES-GMAC for IKE Phase 1 negotiations 😅 That would need a separate specification, plus an Encryption Algorithm Identifier assigned to it. Implementations SHOULD use an IKE Phase 1 cipher that is at least as strong as AES-GMAC. Using AES-CBC [RFC3602] with the same AES key size as ENCR_NULL_AUTH_AES_GMAC or AUTH_AES_GMAC is RECOMMENDED 💜
5.2. Phase 2 Identifier 🍓
for IKE Phase 2 negotiations, IANA has assigned identifiers, as described in Section 9 📋
5.3. Key Length Attribute 📏
AES-GMAC works with any of the three AES key lengths 🙌 But how you say which length you want is different for AH and ESP.
- For AH: each key length gets its own integrity transform identifier and algorithm name (Section 9). The IKE Key Length attribute MUST NOT be used with these identifiers. This transform MUST NOT be used with ESP 🚫
- For ESP: there's a single encryption transform identifier, which represents the combined transform (Section 9). The IKE Key Length attribute MUST be used with each use of this identifier to indicate the key length. The Key Length attribute MUST have a value of 128, 192, or 256 💅
5.4. Keying Material and Salt Values 🧂
IKE uses a pseudo-random function (PRF) to derive keying material 🪄 The PRF gets used over and over to produce keying material of any size, called KEYMAT. The keying material gets pulled out of the output string without caring about boundaries.
The size of the KEYMAT for ENCR_NULL_AUTH_AES_GMAC and AUTH_AES_GMAC MUST be four octets longer than what the associated AES key needs. Here's how the keying material is used:
- ENCR_NULL_AUTH_AES_GMAC with a 128-bit key and AUTH_AES_128_GMAC: the KEYMAT requested for each AES-GMAC key is 20 octets. The first 16 octets are the 128-bit AES key, and the last four octets are the salt value in the nonce 💖
- ENCR_NULL_AUTH_AES_GMAC with a 192-bit key and AUTH_AES_192_GMAC: the KEYMAT requested for each AES-GMAC key is 28 octets. The first 24 octets are the 192-bit AES key, and the last four octets are the salt value in the nonce 🌈
- ENCR_NULL_AUTH_AES_GMAC with a 256-bit key and AUTH_AES_256_GMAC: the KEYMAT requested for each AES-GMAC key is 36 octets. The first 32 octets are the 256-bit AES key, and the last four octets are the salt value in the nonce 👑
6. Test Vectors 🧪
Appendix B of [GCM] has test vectors that will help implementers with AES-GMAC 🫶
7. Security Considerations 💀
okay this section is SERIOUS, bestie 😭 Since the authentication coverage is different between AES-GCM-ESP and this specification (see Figure 4), it's worth pointing out that both specifications are secure 🔐 In ENCR_NULL_AUTH_AES_GMAC, the IV is in neither the plaintext nor the additional authenticated data. That doesn't hurt security, because the IV field only provides an input to the GMAC IV, which isn't required to be authenticated (see [GCM]). In AUTH_AES_GMAC, the IV IS in the additional authenticated data. This also has no bad effect on security. It follows from the fact that GMAC stays secure even against attacks where the adversary can manipulate both the IV and the message. Even an adversary with those powerful abilities cannot forge an authentication tag for any message (other than one that was submitted to the chosen-message oracle). Since such an adversary could easily pick messages that contain the IVs they go with, there are no security problems with putting the IV in the AAD 🙅♀️
GMAC is provably secure against adversaries who can adaptively choose plaintexts, ICVs, and the AAD field, under standard cryptographic assumptions. Roughly, those assumptions say the output of the underlying cipher under a randomly chosen key is indistinguishable from a randomly selected output 🧠 Basically, if you use it within its intended parameters, breaking GMAC means breaking the underlying block cipher. The proof of security is in [GCMP].
The most important security consideration is that the IV never repeats for a given key 🚨 This is partly handled by not allowing AES-GMAC with statically configured keys, as discussed in Section 2.
When IKE is used to establish fresh keys between two peer entities, separate keys get established for the two traffic flows 🔑 But if a different mechanism is used to establish fresh keys, one that only establishes a single key to protect packets, then there's a high probability that the peers will pick the same IV values for some packets 😬 So to avoid counter block collisions, ESP or AH implementations that let the same key protect packets with the same peer MUST ensure that the two peers assign different salt values to the security association (SA) 🧂
The other thing is that, like any block cipher mode of operation, the security of all data protected under a given security association decreases slightly with each message 📉
To protect against this problem, implementations MUST generate a fresh key before processing 2^64 blocks of data with a given key 🔄 Also, it's impossible to reach this limit when using 32-bit Sequence Numbers 🥹
Note that, for each message, GMAC calls the block cipher only once 🧩
8. Design Rationale 🧠
this spec was designed to be as similar to AES-GCM-ESP [RFC4106] as possible 💅 It reuses the design and implementation experience from that spec. All three AES key sizes are included because AES-GCM-ESP supports all of them, and the larger key sizes give future users more high-security options 👑
9. IANA Considerations 📋
IANA has assigned the following IKEv2 parameters. For AES GMAC in AH, these integrity (type 3) transform identifiers have been assigned:
"9"forAUTH_AES_128_GMAC"10"forAUTH_AES_192_GMAC"11"forAUTH_AES_256_GMAC
For AES-GMAC in ESP, this encryption (type 1) transform identifier has been assigned:
"21"forENCR_NULL_AUTH_AES_GMAC
10. Acknowledgements 🫶
big thanks to Fabio Maino and David Black, whose discussions made this spec so much better 💖 Tero Kivinen gave useful comments, and Steve Kent gave guidance on ESP interactions 🌷 This work is closely modeled after AES-GCM, which is itself closely modeled after Russ Housley's AES-CCM transform [RFC4309]. The GCM mode was originally imagined as an improvement on the CWC mode [CWC], which Doug Whiting and Yoshi Kohno took part in 🎀 We love you Fabio, David, Tero, Steve, Russ, Doug, and Yoshi 🥰
11. References 📚
the reference list keeps going in the next part 🧚
11.1. Normative References 📚
Okay so these are the references the spec needs you to have read, no skipping bestie 🤓
[GCM]McGrew, D. and J. Viega, "The Galois/Counter Mode of Operation (GCM)", Submission to NIST.http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/gcm/gcm-spec.pdf, January 2004.[RFC2119]Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.[RFC3602]Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC Cipher Algorithm and Its Use with IPsec", RFC 3602, September 2003.
11.2. Informative References 🧚
These ones are the extra-credit reading. Super helpful for the big picture, but you can still function without them 💅
[CWC]Kohno, T., Viega, J., and D. Whiting, "CWC: A high-performance conventional authenticated encryption mode", Fast Software Encryption.http://eprint.iacr.org/2003/106.pdf, February 2004.[GCMP]McGrew, D. and J. Viega, "The Security and Performance of the Galois/Counter Mode (GCM)", Proceedings of INDOCRYPT '04,http://eprint.iacr.org/2004/193, December 2004.[RFC2409]Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.[RFC4106]Viega, J. and D. McGrew, "The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)", RFC 4106, June 2005.[RFC4302]Kent, S., "IP Authentication Header", RFC 4302, December 2005.[RFC4303]Kent, S., "IP Encapsulating Security Payload (ESP)", RFC 4303, December 2005.[RFC4306]Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", RFC 4306, December 2005.[RFC4309]Housley, R., "Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)", RFC 4309, December 2005.
Authors' Addresses 🎀
Here's where you can find the two brilliant minds behind this one. Slide into their inboxes if you have questions 💌
David A. McGrew
Cisco Systems, Inc.
510 McCarthy Blvd.
Milpitas, CA 95035
US
Phone: (408) 525 8651
EMail: mcgrew@cisco.com
URI: http://www.mindspring.com/~dmcgrew/dam.htm
John Viega
McAfee, Inc.
1145 Herndon Parkway, Suite 500
Herndon, VA 20170
EMail: viega@list.orgFull Copyright Statement 💖
Copyright (C) The Internet Society (2006). 🌸
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
The legal fine print, bestie: this document and the information in it are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🙈
Intellectual Property 🦋
The IETF doesn't take a side on whether any Intellectual Property Rights or other rights that someone might claim over the technology in this document are valid or how far they reach. It also doesn't say whether licenses for those rights are available. And it hasn't independently gone looking for any of that stuff either. If you want the procedures for rights in RFC documents, check out BCP 78 and BCP 79 🧐
Copies of IPR disclosures sent to the IETF Secretariat, assurances of licenses, and the results of any attempt to get a general license or permission to use proprietary rights for implementing or using this specification can all be found in the IETF's online IPR repository at http://www.ietf.org/ipr. 🔍
The IETF also invites anyone to flag any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org. 📬
Acknowledgement 🫶
Funding for the RFC Editor function comes from the IETF Administrative Support Activity (IASA). Thank you, IASA, you keep the lights on for all of us ✨
📦 where this page comes from
- ietf: rfc4543 2006-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms