RFC 4808

RFC 4808: Key Change Strategies for TCP-MD5 🦋

Okay bestie, this is RFC 4808, and it's all about Key Change Strategies for TCP-MD5 🔐✨. It's from the Network Working Group and was written by Steven M. Bellovin at Columbia University (he shows up as S. Bellovin in the header). It was published in March 2007 and it's Informational, so it's sharing info, not setting a standard 💅. The header doesn't list anything it obsoletes or updates, so it's a solo act 🎀.

---

Status of This Memo

Okay, so this memo is giving info for the Internet community 🌸. It doesn't specify an Internet standard of any kind. Distribution of it is unlimited, so share away 💖.

Copyright Notice

Copyright (C) The IETF Trust (2007) ©️🌈.

Abstract

The TCP-MD5 option is most commonly used to secure BGP sessions between routers 🛜. The annoying part is that changing the long-term key is hard, because the change has to be synchronized between different organizations 😩. This doc describes single-ended strategies that will permit (mostly) unsynchronized key changes ✨.

1. Introduction ✨

Okay so the TCP-MD5 option [RFC2385] is most commonly used to secure BGP sessions between routers 🛜. Changing the long-term key is difficult, since the change needs to be synchronized between different organizations 🙃. Worse yet, if the keys are out of sync, it may break the connection between the two routers, and then repair attempts get really hard 💀.

The proper solution involves some sort of key management protocol 🧚. Apart from the complexity of those, RFC 2385 was not written with key changes in mind 🙈. In particular, there is no KeyID field in the option, which means even a key management protocol would run into the same problem 😭.

Fortunately, a heuristic permits key change despite this protocol deficiency 🎀. The change can be installed unilaterally at one end of a connection, and it is fully compatible with the existing protocol 👑.

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖.

2. The Algorithm 🧠

Separate algorithms are necessary for transmission and reception 🔁. Reception is easier, so we're doing it first 🫶.

2.1. Reception

A receiver has a list of valid keys 📝. Each key has a (conceptual) timestamp associated with it ⏰. When a segment arrives, each key gets tried in turn 🔑. The segment is discarded if and only if it cannot be validated by any key in the list 🗑️.

In principle, there's no need to test keys in any particular order 🌀. For performance reasons though, a simple most-recently-used (MRU) strategy, where you try the last valid key first, should work well 🔥. More complex mechanisms, like examining the TCP sequence number of an arriving segment to see whether it fits in a hole, are almost certainly unnecessary 🙅‍♀️. On the other hand, validating that a received segment is putatively legal, by checking its sequence number against the advertised window, can help avoid denial of service attacks 🛡️💅.

The newest key that has successfully validated a segment is marked as the "preferred" key, see below 👑.

Implicit in this scheme is the assumption that older keys will eventually be unneeded and can be removed 🗝️. So implementations SHOULD provide an indication of when a key was last used successfully 📊.

2.2. Transmission

Transmission is more complex, because the sender doesn't know which keys can be accepted at the far end 🤷‍♀️. So the conservative strategy is to delay using any new keys for a considerable amount of time, probably measured in days 🗓️. This time interval is the amount of asynchronicity the parties wish to permit, and it's agreed upon out of band and configured manually 🤝.

Some automation is possible though 🤖. If a key has been used successfully to validate an incoming segment, clearly the other side knows it 🧠✨. So any key marked as "preferred" by the receiving part of a stack SHOULD be used for transmissions 💖.

A sophisticated implementation could try alternate keys if the TCP retransmission counter gets too high 🧐. (This is analogous to dead gateway detection 🪦.) In particular, if a key change has just been attempted but those segments aren't acknowledged, it's reasonable to fall back to the previous key and issue an alert of some sort 🚨. Similarly, an implementation with a new but unused key could occasionally try to use it, kind of like how TCP implementations probe closed windows 🪟. Doing this avoids the "silent host" problem discussed in Section 3.1 🤫. This should be done at a moderately slow rate 🐢.

Note that there's an ambiguity when an acknowledgment is received for a segment transmitted with two different keys 👀. The TCP Timestamp option [RFC1323] can be used for disambiguation ⏱️.

3. Operations 🛠️

3.1. Single-Ended Operations

Suppose only one end of the connection has this algorithm implemented 🙋‍♀️. The new key gets provisioned on that system, with a start time far in the future, so far that it won't be used spontaneously 🔮. After the key is ready, the other end is notified, out-of-band, that a key change can commence 📣.

At some point, the other end gets upgraded 🆙. Because it doesn't have multiple keys available, it will start using the new key immediately for its transmission, and it will drop all segments that use the old key 😤. As soon as it tries to transmit, the upgraded side designates the new key as preferred, and uses it for all of its transmissions 💅. Note specifically that this includes retransmissions of any segments rejected because they used the old key 🔁.

There's a problem if the unchanged machine is a "silent host", meaning a host that has nothing to say and so doesn't transmit 🙊. The best way to avoid this is for an upgraded machine to try a variety of keys in the event of repeated unacknowledged packets, and to probe for new unused keys during silent periods, as discussed in Section 2.2 🎯. Alternatively, application-level KeepAlive messages may be used to make sure neither end of the connection is completely silent 💜. See, for example, Section 4.4 of [RFC4271] or Section 3.5.4 of [RFC3036] 📚.

3.2. Double-Ended Operations

Double-ended operations are similar, except both sides deploy the new key at about the same time 👯. One should be configured to start using the new key at a point where it's reasonably certain the other side would have it installed too 🗓️. Assuming that's actually happened, the new key gets marked "preferred" on both sides 🎉.

3.3. Monitoring

As noted, implementations should monitor when a key was last used for transmission or reception 👁️. Any monitoring mechanism can be used. Most likely it'll be one or both of a MIB object or objects, plus the vendor's usual command-line mechanism for displaying data of this type 💻. Either way, the network operations center should keep track of this 🖥️. When a new key has been used successfully for both transmission and reception for a reasonable amount of time, the old key can be marked for deletion 🗑️. The exact value isn't crucial, but it should probably be longer than twice the maximum segment lifetime ⏳. There's an implicit assumption here that there won't be substantial overlap in the usage period of such keys, so monitoring systems should look for any such anomalies, of course 🚨.

To be continued in part 2 🌙✨

Full Copyright Statement ✨

Copyright (C) The IETF Trust (2007). 💖

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. So the authors keep their rights unless BCP 78 says otherwise 📜

This document and the information in it are provided "AS IS", and that's a big deal. THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE all say there are NO WARRANTIES, express or implied. That includes no promise that using the info won't infringe anyone's rights, and no implied warranties of merchantability or fitness for a particular purpose. Nobody is promising it'll work for your thing 💀

---

Intellectual Property 🔥

Okay, so the IETF doesn't take a side on whether any Intellectual Property Rights or other rights could apply to the tech in this document. That covers whether someone's claim is valid, what the scope is, and whether you can even get a license for it. It also doesn't claim it went looking for any of those rights itself 🙈 Info about how rights work for RFC documents lives in BCP 78 and BCP 79.

Copies of IPR disclosures sent to the IETF Secretariat are available, and so are any assurances of licenses. You can also find the result of an attempt to get a general license or permission for implementers or users to use the proprietary rights. All of that is in the IETF's online IPR repository at http://www.ietf.org/ipr 🦋

The IETF also invites anyone to flag copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that to the IETF at ietf-ipr@ietf.org 💌

Acknowledgement 🫶

Funding for the RFC Editor function is currently provided by the Internet Society. Thank you to the Internet Society for keeping the RFC Editor running 🌸