RFC 4982

Support for Multiple Hash Algorithms in Cryptographically Generated Addresses (CGAs)

📅 published July 2007, from ietf

Support for Multiple Hash Algorithms in Cryptographically Generated Addresses (CGAs) 💖

Okay bestie, the title block is giving everything 🎀

RFC number: 4982 ✨
Series: Network Working Group
Authors: M. Bagnulo (UC3M) and J. Arkko (Ericsson) 👑
Category: Standards Track 🦋
Date: July 2007 🌸
Updates: 3972 💅

Status of This Memo 🌈

This document is an Internet standards track protocol for the Internet community, and it's asking everyone for discussion and suggestions for improvements 🫶 If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited ✨

Copyright Notice 💜

Abstract 🧚

This doc looks at what recent attacks on commonly used hash functions mean for Cryptographically Generated Addresses (CGAs) 👀 It also updates the CGA spec so CGAs can support multiple hash algorithms 🔥

Table of Contents 🍓

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . 2
3.  Impact of Collision Attacks in CGAs . . . . . . . . . . . . . . 2
4.  Options for Multiple Hash Algorithm Support in CGAs . . . . . . 3
  4.1.  Where to Encode the Hash Function?  . . . . . . . . . . . . 4
5.  CGA Generation Procedure  . . . . . . . . . . . . . . . . . . . 6
6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 6
7.  Security Considerations . . . . . . . . . . . . . . . . . . . . 7
8.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . 7
9.  References  . . . . . . . . . . . . . . . . . . . . . . . . . . 7
  9.1.  Normative References  . . . . . . . . . . . . . . . . . . . 7
  9.2.  Informative References  . . . . . . . . . . . . . . . . . . 7

1. Introduction ✨

Okay so, recent attacks on hash functions people use right now have made a lot of folks in the Internet community really worried 😭 The recommended approach [6] [10] is a two-step glow-up. Step one is to analyze how these attacks affect the different Internet protocols that use hash functions. Step two is to make sure those protocols can move over to a different, more secure hash function without wrecking how the Internet runs 🧚

This document does that analysis for the Cryptographically Generated Addresses (CGAs) defined in [2] 💅 The first big finding is that protocols using CGAs are not affected by the recently available attacks against hash functions 🎉 The second finding is that the hash function is hard coded in the CGA specification 🙈 So this document updates the CGA specification [2] to allow alternative hash functions. To make that work, it creates a new registry managed by IANA to register the different hash algorithms used in CGAs 📋✨

2. Terminology 🎀

Quick lore on the key words: when this document says "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", or "OPTIONAL", you read them the way RFC 2119 [1] describes 🫶

3. Impact of Collision Attacks in CGAs 🔥

Recent cryptography advances have led to simplified attacks against the collision-free property of some commonly used hash functions [6] [10]. That includes SHA-1, which is the hash function CGAs use [2] 😭 This means it's possible to get two messages, M1 and M2, that have the same hash value with much less than 2^(L/2) attempts 🤯 Next we'll look at how these attacks affect the current ways CGAs are used.

As we get it, attacks on the collision-free property mostly threaten using hash functions for non-repudiation 🧐 The reason is that an attacker could make two different messages with the same hash value, then show either one whenever they like. For example, that could happen after the other party in the transaction has signed one of them. But here's the catch: both messages must be generated by the same party 👀

As far as we understand, current CGA usages don't include non-repudiation, so attacks on the collision-free property of the hash function don't enable any useful attack against CGA-based protocols 💖

Right now, CGAs are mostly used to prove you own a CGA and then tie it to alternative addresses that can be used to reach the original CGA 🦋 These uses include:

Protecting the shim6 protocol [7] 🧚 Here, CGAs are identifiers for established communications. CGA features prove that the owner of the identifier is the one giving the alternative addresses that can reach the initial identifier. This works by signing the list of alternative addresses available in the multihomed host with the private key of the CGA.
Securing the IPv6 mobility support protocol [8] as proposed in [9] 🌸 Here, CGAs are Home Addresses, and they prove that the owner of the Home Address is the one creating the binding with the new Care-off Address. Just like the case above, this works by signing the Binding Update message that carries the Care-off Address with the private key of the CGA.
Secure Neighbour Discovery [4] 👑 Here, CGA features prove address ownership, so you can check that the owner of the IP address is the one giving the layer 2 address information. This works by signing the layer 2 address information with the private key of the CGA.

Basically, every current use of CGAs relies on them to protect communication between two peers from third-party attacks, not from the peer itself 🛡️ Attacks on the collision-free property need one party to generate two messages with the same hash value so it can attack its communicating peer. Since CGAs aren't currently used to protect against that kind of thing, it makes sense that a weaker collision resistance in the hash function doesn't enable extra attacks 💅

4. Options for Multiple Hash Algorithm Support in CGAs 🌈

CGAs, as currently defined in [2], are intrinsically bound to the SHA-1 hash algorithm, and no other hash function is supported 😬

Even though attacks on the collision-free property don't create new vulnerabilities in current CGA applications, it still seems wise to enable multiple hash function support in CGAs ✨ There are two main reasons. First, future CGA applications might be vulnerable to attacks on the collision-free property of SHA-1 💀 Supporting alternative hash functions would let applications with stricter collision-free requirements use CGAs 🔥 Second, one lesson from the recent attacks on hash functions is that we might one day need to switch to alternative hash functions because of successful attacks on other properties of commonly used hash functions 😭 So it seems wise to modify protocols in general, and CGAs in particular, to make the move to alternative hash functions as easy as possible 🫶

🌸 Part 1 wraps here, more parts are coming! 🌸

4.1. Where to Encode the Hash Function? ✨

okay bestie, next up is the big question: where do we even put the name of the hash function? 💅 There are a few options on the table.

First option: stuff the hash function into the hash input itself. That means making a new extension to the CGA Parameter Data Structure from [3] that spells out which hash function is being used. The problem is that this is vulnerable to bidding down attacks or downgrading attacks as defined in [10]. So even if you use a strong hash, an attacker could find a CGA Parameter Data Structure that uses a weaker function but still lands on the same hash value. That happens when H1 with a PDS saying H1 gives X, and H2 with a PDS saying H2 also gives X. 😬

Here's how the downgrade would go. Alice makes a CGA called CGA_A using the strong hash HashStrong and a CGA Parameter Data Structure called CGA_PDS_A. HashStrong gets encoded as an extension field in CGA_PDS_A. Then an attacker X uses brute force to find a different CGA Parameter Data Structure, CGA_PDS_X, whose hash value (using a weaker hash function) matches CGA_A. At that point the attacker can pretend to be the owner of CGA_A, and the stronger hash function did absolutely nothing for protection. 💀

So the conclusion is that the hash function used in CGA generation must be encoded in the address itself. 🔥 Wait, careful: the original says "must" in lowercase, so the proper rendering is: the hash function used in the CGA generation must be encoded in the address itself.

Since we want to support several hash functions, we will likely need at least 2 or 3 bits for this. 🌸

Option two: use more bits from the hash bits of the interface identifier. Sounds easy, but the resulting CGA is weaker because less hash information gets encoded in the address. Also, since those bits are currently used as hash bits, it is impossible to make this approach backward compatible with existing implementations. Not it. 🙅‍♀️

Option three: use the "u" and the "g" bits. Probably not such a good idea, because those bits have been honoured so far by every interface identifier generation mechanism, and they let those mechanisms serve their original purpose. For example, we can still create a global registry for unique interface identifiers. Let's leave those bits alone. 🫶

Option four is the one we're going with: encode the hash value in the Sec bits. Quick refresher on the Sec bits: they artificially add difficulty to CGA generation so you get extra protection against brute force attacks. They were designed so that the lifetime of CGAs gets extended when it becomes feasible to attack 59-bit-long hash values. That's not the case today, so in general a CGA will have a Sec value of 000. 🦋

The proposal is to use the Sec bits for two jobs at once: brute force protection info and the hash function being used. For example:

Sec value 000 means the hash function is SHA-1, and the 0 bits of hash2 (as defined in RFC 3972) must be 0.
Sec value 001 means the hash function is SHA-1, and the 16 bits of hash2 (as defined in RFC 3972) must be zero.
The other Sec values could mean that an alternative hash function needs to be used, and that a certain number of bits of hash2 must be zero.

We are not defining a concrete hash function for the other Sec values, because it isn't clear yet that we need to, nor which hash function should be picked. Not our problem yet, bestie. 🧚

Now, there are only 8 Sec values, so we might need to reuse some when we run out of unused ones. That makes sense when some Sec values are no longer used because their security has gotten weak. If the usage of a Sec value has been abandoned for a long time, it would be possible to reassign it. 🍓

BUT this has to be the absolute last resort, because it may mess with interoperability. Two implementations that use different meanings for the same Sec value wouldn't be able to interoperate properly. If an old implementation receives a CGA generated with the new meaning, it fails, and the same goes for a new implementation receiving a CGA generated with the old meaning. 😭 So if you do go down the reassignment road, a long time is required between deprecating the old value and reassigning it, so old implementations don't misinterpret the value.

An erroneous interpretation of a reused Sec value, on either the CGA owner's side or the CGA verifier's side, would have this result: CGA verification would fail in the worst case, and both nodes would have to revert to unprotected IPv6 addresses. This can only happen with obsolete CGA parameter sets, which would be considered insecure anyway. In any case, an implementation must not simultaneously support two different meanings of a Sec value. Never, ever, ever mix meanings. 🚫💜

5. CGA Generation Procedure 👑

The SEC registry defined in the IANA considerations section of this document contains entries for the different Sec values. Each of these entries points to an RFC that defines the CGA generation procedure that MUST be used when generating CGAs with the associated Sec value. So the registry basically tells you which RFC to follow. 🌈

It should be noted that the CGA generation procedure may change in the new procedure, and not only in terms of the hash function used. It can change in other aspects too. For example, longer Modifier values may be required if the number of 0s required in hash2 exceeds the currently defined bound of 112 bits. The new procedure (which might involve a longer Modifier value) would be described in the RFC that the corresponding Sec registry entry points to. ✨

Also, the RFC that defines the CGA generation procedure for a Sec value MUST explicitly define the minimum key length acceptable for CGAs with that Sec value. This is to provide coherent protection for both the hash technique and the public key technique. Yes, both need to be strong, no cheating! 🔐

6. IANA Considerations 🎀

This document defines a new registry called "CGA SEC" for the Sec field defined in RFC 3972 [2]. IANA created it and maintains it. The values in this name space are 3-bit unsigned integers.

Initial values for the CGA Extension Type field are given below. Future assignments are to be made through Standards Action [5]. Assignments consist of a name, the value, and the RFC number where the CGA generation procedure is defined.

The following initial values are assigned in this document:

       Name        | Value |  RFCs
-------------------+-------+------------
SHA-1_0hash2bits   |   000 | 3972, 4982
SHA-1_16hash2bits  |   001 | 3972, 4982
SHA-1_32hash2bits  |   010 | 3972, 4982

7. Security Considerations 🚨

This document is about security issues and, in particular, about protection against potential attacks against hash functions. Honestly, this whole doc is about keeping the hash game strong, so treat this section like the main plot. 🎭💀

8. Acknowledgements 🫶

Russ Housley, James Kempf, Christian Vogt, Pekka Nikander, and Henrik Levkowetz reviewed and provided comments about this document. Iconic reviewers, all of them. 👑

Marcelo Bagnulo worked on this document while visiting Ericsson Research Laboratory Nomadiclab. 🌸

9. References 📚

9.1. Normative References

[1]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
      Levels", BCP 14, RFC 2119, March 1997.

[2]   Aura, T., "Cryptographically Generated Addresses (CGA)",
      RFC 3972, March 2005.

[3]   Bagnulo, M. and J. Arkko, "Cryptographically Generated
      Addresses (CGA) Extension Field Format", RFC 4581,
      October 2006.

[4]   Arkko, J., Kempf, J., Zill, B., and P. Nikander, "SEcure
      Neighbor Discovery (SEND)", RFC 3971, March 2005.

9.2. Informative References

[5]   Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA
      Considerations Section in RFCs", BCP 26, RFC 2434,
      October 1998.

[6]   Hoffman, P. and B. Schneier, "Attacks on Cryptographic Hashes
      in Internet Protocols", RFC 4270, November 2005.

[7]   Nordmark, E. and M. Bagnulo, "Multihoming L3 Shim Approach",
      Work in Progress, July 2005.

[8]   Johnson, D., Perkins, C., and J. Arkko, "Mobility Support in
      IPv6", RFC 3775, June 2004.

[9]   Arkko, J., "Applying Cryptographically Generated Addresses and
      Credit-Based Authorization to Mobile IPv6", Work in Progress,
      June 2006.

[10]  Bellovin, S. and E. Rescorla, "Deploying a New Hash Algorithm",
      NDSS '06, February 2006.

Authors' Addresses 🦋

Marcelo Bagnulo
Universidad Carlos III de Madrid
Av. Universidad 30
Leganes, Madrid  28911
SPAIN

Phone: 34 91 6249500
EMail: marcelo@it.uc3m.es
URI:   http://www.it.uc3m.es


Jari Arkko
Ericsson
Jorvas  02420
Finland

EMail: jari.arkko@ericsson.com

This document is subject to the rights, licenses and restrictions contained in BCP 78. Except as set forth therein, the authors retain all their rights. 💜

This document and the information contained herein are provided on an "AS IS" basis and:

THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🌈

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. 📜

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. 🔗

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. 📬

Acknowledgement 💖

Funding for the RFC Editor function is currently provided by the Internet Society. ✨

📦 where this page comes from

ietf: rfc4982 2007-07
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms