RFC 6704
Forcerenew Nonce Authentication
RFC 6704: Forcerenew Nonce Authentication 💖
Bestie, this one is from the Internet Engineering Task Force (IETF) 🌸
- Request for Comments: 6704
- Authors: D. Miles (Google), W. Dec (Cisco Systems), J. Bristow (Swisscom Schweiz AG), and R. Maglione (Telecom Italia)
- Category: Standards Track
- ISSN: 2070-1721
- Date: August 2012
- Updates: RFC 3203 (this doc is literally fixing it up 🧚)
Abstract ✨
Okay so DHCP FORCERENEW lets a server reconfigure one single host by forcing the DHCP client into a Renew state whenever the server triggers it 🔥. In the Forcerenew Nonce Authentication protocol, the server sends a nonce to the client inside the initial DHCP ACK. The client then uses that nonce to validate any FORCERENEW message that comes later 💅. This document updates RFC 3203.
Status of This Memo 🎀
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check out Section 2 of RFC 5741 📚.
For the current status of this document, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6704.
Copyright Notice 🌈
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they're in effect on the date this document was published. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 🫶.
Table of Contents 🧚
1. Introduction ....................................................2
2. Requirements Language ...........................................3
3. Message Authentication ..........................................3
3.1. Forcerenew Nonce Authentication ............................3
3.1.1. Forcerenew Nonce Protocol Capability Option .........4
3.1.2. Forcerenew Nonce Authentication Protocol ............6
3.1.3. Server Considerations for Forcerenew Nonce
Authentication ......................................8
3.1.4. Client Considerations for Forcerenew Nonce
Authentication ......................................9
4. IANA Considerations ............................................10
5. Security Considerations ........................................10
5.1. Protocol Vulnerabilities ..................................11
6. Acknowledgements ...............................................11
7. Normative References ...........................................111. Introduction ✨
Okay so the DHCP reconfigure extension in [RFC3203] is super useful 🦋. It lets the DHCP server reconfigure one single host, and the server is the one who triggers it. The problem is that right now its use is limited, because a Forcerenew message always has to be authenticated using the procedures in [RFC3118]. And [RFC3118] is mandatory for FORCERENEW, but the way it's currently defined, it needs a constant token or shared secret handed to DHCP clients out-of-band. Not it 🙈.
Here's why authentication became mandatory for DHCP FORCERENEW. The goal was to stop an off-network attacker from using FORCERENEW to predict exactly when a DHCP renewal would happen. Without FORCERENEW, the client controls when renewal timing happens, and an off-network attacker has zero way to predict it, since they don't have access to the exchange between the DHCP client and the DHCP server 💀.
But the requirement to use the DHCP authentication in [RFC3118] is stricter than this use case actually needs, and that's why adoption of DHCP FORCERENEW has been limited 😭. [RFC3315] defines an authentication protocol that uses a nonce to keep off-network attackers from successfully making clients renew. The attacker doesn't have access to the nonce, so they can't trick the client into renewing whenever they feel like it 🔥.
This document defines extensions to Authentication for DHCPv4 Messages [RFC3118] to create a brand-new authentication protocol for DHCPv4 FORCERENEW [RFC3203] messages. This method doesn't need out-of-band key distribution to DHCP clients, which is the whole point 💖. The Forcerenew Nonce gets exchanged between server and client on the initial DHCP ACK, and then it's used to verify any subsequent FORCERENEW message. This document updates [RFC3203].
2. Requirements Language 🌸
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
3. Message Authentication 🎀
The Forcerenew message MUST be authenticated using either [RFC3118] or the proposed Forcerenew Nonce Authentication protocol 🫶.
3.1. Forcerenew Nonce Authentication 🦋
The Forcerenew Nonce Authentication protocol gives you protection against a client getting misconfigured by a Forcerenew message from a malicious DHCP server 🙅♀️. It works like this: the DHCP server sends a Forcerenew Nonce to the client during the initial exchange of DHCP messages. The client records that Forcerenew Nonce so it can authenticate later Forcerenew messages from that same server. After that, the server includes a Hashed Message Authentication Code (HMAC) computed from the Forcerenew nonce in its subsequent Forcerenew messages 🧠✨.
Both the Forcerenew Nonce that goes from server to client and the HMAC in later Forcerenew messages get carried as the Authentication information in a DHCP Authentication option. The format of that Authentication information is defined in the next section 👑.
The Forcerenew Nonce Authentication protocol gets used (the server starts it) only if the client and server are not using the authentication mechanism in [RFC3118], and the client and server have negotiated to use the Forcerenew Nonce Authentication protocol 💅.
3.1.1. Forcerenew Nonce Protocol Capability Option ✨
okay so, a DHCP client shows it's ready for Forcerenew Nonce stuff by slipping a FORCERENEW_NONCE_CAPABLE (145) option into its DHCP Discover and Request messages going to the server 💖
Servers can be picky. A DHCP server that doesn't support Forcerenew Nonce Authentication protocol authentication SHOULD ignore the FORCERENEW_NONCE_CAPABLE (145) option 🙈 The server shows its own preference by putting a FORCERENEW_NONCE_CAPABLE (145) option in any DHCP Offer messages it sends to the client.
And here's the rule that's a hard no 🚫 A DHCP client MUST NOT send DHCP messages with authentication options where the protocol value is Forcerenew Nonce Authentication. Not even a little bit, bestie 💅
The option itself is super simple. It has code 145, a length of n, and then a list of the algorithms the client supports:
Code Len Algorithms
+-----+-----+----+----+----+
| 145 | n | A1 | A2 | A3 | ....
+-----+-----+----+----+----+
Figure 1: FORCERENEW_NONCE_CAPABLE OptionIn this document, Section 3.1.2 defines the Forcerenew Nonce Authentication protocol for algorithm equal to 1 and type equal to 2 🦋 Future documents will cover the other values, so algorithm !=1 and type !=2 can use a different algorithm with shorter or longer values. Future-proofing, iconic 👑
So the client basically says "I'm capable!" by putting the option in its DHCP Discover and Request messages. If the server supports Forcerenew nonce authentication AND requires it, it puts the FORCERENEW_NONCE_CAPABLE option in the DHCPOFFER. The whole handshake goes like this 👇
Server Client Server
(not selected) (selected)
v v v
| | |
| Begins initialization |
| | |
| _____________/|\____________ |
|/DHCPDISCOVER | DHCPDISCOVER \|
| w/FORCERENEW- | w/FORCERENEW- |
| NONCE-CAPABLE | NONCE-CAPABLE |
| | |
Determines | Determines
configuration | configuration
| | |
|\ | /|
| \__________ | _________/ |
| DHCPOFFER \ | /DHCPOFFER |
|w/FORCERENEW \ | /w/FORCERENEW|
|NONCE-CAPABLE \| /NONCE-CAPABLE|
| | |
| Collects replies |
| | |
| Selects configuration |
| | |
| _____________/|\____________ |
|/ DHCPREQUEST | DHCPREQUEST\ |
| w/Forcerenew- | w/Forcerenew- |
| Nonce-Capable | Nonce-Capable |
| | |
| | Commits configuration
| | |
| |Creates 128-bit Forcerenew Nonce
| | |
| | _____________/|
| |/ DHCPACK |
| | w/Auth-Proto= |
| | Forcerenew- |
| | Nonce |
| | |
|Client stores Forcerenew Nonce |
| | |
| Initialization complete |
| | |
. . .
. . .
| | |
| Forcerenew |
| | _____________/|
| |/ DHCPFORCE |
| | w/Auth-Proto= |
| | Forcerenew- |
| | Digest(HMAC)|
| | |
| Client checks HMAC digest |
| using stored Forcerenew Nonce |
| | |
| |\____________ |
| | DHCPREQUEST\ |
| | w/FORCERENEW- |
| | NONCE-CAPABLE |
| | |
| | Commits configuration
| | |
| |Creates 128-bit Forcerenew Nonce
| | |
| | _____________/|
| |/ DHCPACK |
| | w/Auth-Proto= |
| | Forcerenew- |
| | Nonce |
| | |
| | |
| | |
. . .
. . .
| | |
| Graceful shutdown |
| | |
| |\ ____________ |
| | DHCPRELEASE \|
| | |
| | Discards lease
| | |
v v v
Figure 2: Timeline Diagram of Messages Exchanged between DHCP Client
and Servers Using the Forcerenew Nonce Authentication Protocol3.1.2. Forcerenew Nonce Authentication Protocol 🔐
This protocol is a team effort 🫶 It uses both the DHCP authentication option defined in [RFC3118] (reusing the option format) and the Reconfigure Key Authentication Protocol defined in [RFC3315].
Here's the layout of the DHCP authentication option:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Length | Protocol | Algorithm |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| RDM | Replay Detection (64 bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Replay cont. |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Replay cont. | |
+-+-+-+-+-+-+-+-+ |
| |
| Authentication Information |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: Format of the DHCP Authentication OptionThese are the fields you set in the DHCP authentication option for the Forcerenew Nonce Authentication protocol 📝
Code: 90 (Authentication) per [RFC3118]Length: contains the length of the protocolProtocol: 3 (Reconfigure Key) per [RFC3118]Algorithm: 1 (HMAC-MD5) per [RFC3118] and [RFC3315]Replay Detection: per the Replay Detection Method (RDM)Replay Detection Method (RDM): 0Authentication Information: specified below
The Authentication Information for this protocol is laid out like this 💜
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Value (128 bits) |
+-+-+-+-+-+-+-+-+ |
. .
. .
. +-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4: Format of the Authentication InformationThe Type field tells you what kind of data is in the Value field 🎀
1: Forcerenew nonce Value (used in ACK message)2: HMAC-MD5 digest of the message (Forcerenew message)
The Value is the message authentication code, generated by applying MD5 to the DHCP message ✨
3.1.3. Server Considerations for Forcerenew Nonce Authentication ✨
okay bestie, the server side is where the magic happens 🪄. Forcerenew Nonce Authentication only works if the client says it's capable by putting the FORCERENEW_NONCE_CAPABLE (145) option in its DHCP Discover or Request messages 💅. If the server is going to use the Forcerenew Nonce Protocol, the DHCP Discovery or Request message from the client MUST contain the FORCERENEW_NONCE_CAPABLE (145) option. No option means the server knows this protocol isn't supported, so it MUST NOT include a Forcerenew Nonce Protocol Authentication option in the DHCP ACK 🙈.
The server flexes its capability by including FORCERENEW_NONCE_CAPABLE (145) in the DHCPOFFER 👑. It SHOULD NOT include this option unless the client already said it's capable in a DHCP Discovery message. Clients can use the presence of that option to prefer Forcerenew Nonce capable servers over the ones that don't support it. Main character server energy, no cap 🦋.
Now for the nonce drama 🎀. If a capable server gets a DISCOVER or REQUEST (any type) saying the client is capable, and the server has no previous nonce recorded, it MUST generate a nonce and include it in the ACK. The server only picks a Forcerenew Nonce for a client during the Request/ACK exchange. It records that nonce and sends it to the client in an Authentication option in the DHCP ACK message 🧚.
When a client is renewing, the server SHOULD NOT include the nonce in the ACK unless it generated a brand new one. This keeps the number of times the nonce goes over the wire to a minimum, which is very minimalist of it 🌸.
Here's a plot twist 😭. If the server that got the DHCP Request sent at time T1 never responds, the client enters the REBINDING state and tries to reach any server. The new Server that receives the DHCP message MUST generate a new nonce. Fresh nonce, fresh start ✨.
The Forcerenew nonce is 128 bits long, and it MUST be a cryptographically strong random or pseudo-random number that cannot easily be predicted. It's embedded as a 128-bit value in the Authentication information, where type is set to 1 (Forcerenew nonce Value). Iconic, literally 💜.
To authenticate a Forcerenew message, the server picks a replay detection value according to the RDM it selected, then computes an HMAC-MD5 of the Forcerenew message. It follows the procedure in Section 21.5 of [RFC3315] and uses the Forcerenew Nonce for that client. The server computes the HMAC-MD5 over the entire DHCP Forcerenew message, including the Authentication option, and the HMAC-MD5 field in the Authentication option is set to zero for that computation 🔥
3.1.4. Client Considerations for Forcerenew Nonce Authentication
Clients that support this mechanism MUST show off their Forcerenew nonce Capability by including the FORCERENEW_NONCE_CAPABLE (145) DHCP option defined in Section 3.1.1 in all DHCP Discover and Request messages 💖. DHCP servers that support Forcerenew nonce Protocol authentication MUST include the FORCERENEW_NONCE_CAPABLE (145) DHCP option in all DHCP Offers. That way, the client can use this capability to pick a server if multiple Offers arrive 🍓.
The client MUST validate that the DHCP ACK message contains a Forcerenew Nonce in a DHCP authentication option. Here's the tea ☕. If the server said it was capable of Forcerenew Nonce Authentication in the DHCP OFFER, but the ACK that comes back while the client is in the selecting state doesn't include a valid DHCP authentication option for this protocol, the client MUST discard the message and return to the INIT state 🙅♀️.
The client MUST record the Forcerenew Nonce from any valid ACK it receives, as long as that ACK contains one 🫶.
To authenticate a Forcerenew message, the client computes an HMAC-MD5, following the procedure in Section 21.5 of [RFC3315]. It runs that over the DHCP Forcerenew message, after setting the HMAC-MD5 field in the Authentication option to zero, and uses the Forcerenew Nonce it got from the server. If the computed HMAC-MD5 matches the value in the Authentication option, the client accepts the FORCERENEW message 🌈.
4. IANA Considerations 🧾
IANA has assigned the following new DHCPv4 option code from the registry "BOOTP Vendor Extensions and DHCP Options" maintained at http://www.iana.org/assignments/bootp-dhcp-parameters:
Tag: 145
Name: FORCERENEW_NONCE_CAPABLE
Data length: 1
Description: Forcerenew Nonce Capable
Reference: this document5. Security Considerations 🚨
Okay, serious moment, bestie 😭. In some network environments FORCERENEW can be used to snoop and spoof traffic, so the FORCERENEW message MUST be authenticated using the procedures described in [RFC3118] or the mechanism described in this document.
The mechanism in [RFC3315] for DHCPv6, which this document mirrors for DHCPv4, uses a nonce to stop an off-link attacker from successfully triggering a renewal on a client by sending DHCPFORCERENEW. Since the attacker is off-link, it doesn't have the nonce, so it can't force a renewal 🛡️.
An on-link attacker can always just watch the DHCP renewal message go out and respond to it. So this mechanism is useless for preventing on-link attacks, which means the security of the nonce against on-link attacks isn't relevant. Therefore, HMAC-MD5 is, by definition, adequate for the purpose, and there is no need for an extensible HMAC mechanism. FORCERENEW messages that fail authentication should be silently discarded by the client 🙈.
5.1. Protocol Vulnerabilities
Not every part of this is perfect, bestie. Here are the weak spots 👀.
The mechanism described in this document is vulnerable to a denial-of-service (DoS) attack through flooding a client with bogus FORCERENEW messages. Authenticating the bogus FORECERENEW messages takes calculations that may overwhelm the device the client is running on 💀.
The mechanism described does protect against a malicious DHCP server using a FORCERENEW message to mount a DoS or man-in-the-middle attack on a client. However, this protocol can be compromised by an attacker that can intercept the initial message in which the DHCP server sends the nonce to the client 😤.
6. Acknowledgements 🫶
This contribution is based on work by Vitali Vinokour. Major sections of this document use modified text from [RFC3315]. The authors wish to thank Ted Lemon, Matthew Ryan, and Bernie Volz for their support 💜.
7. Normative References 📚
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3118] Droms, R. and W. Arbaugh, "Authentication for DHCP
Messages", RFC 3118, June 2001.
[RFC3203] T'Joens, Y., Hublet, C., and P. De Schrijver, "DHCP
reconfigure extension", RFC 3203, December 2001.
[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
and M. Carney, "Dynamic Host Configuration Protocol for
IPv6 (DHCPv6)", RFC 3315, July 2003.Authors' Addresses 🌸
David Miles
Google
EMail: davidmiles@google.com
Wojciech Dec
Cisco Systems
Haarlerbergpark Haarlerbergweg 13-19
Amsterdam, NOORD-HOLLAND 1101 CH
Netherlands
EMail: wdec@cisco.com
James Bristow
Swisscom Schweiz AG
Zentweg 9
Bern, 3050,
Switzerland
EMail: James.Bristow@swisscom.com
Roberta Maglione
Telecom Italia
Via Reiss Romoli 274
Torino 10148
Italy
EMail: roberta.maglione@telecomitalia.it📦 where this page comes from
- ietf: rfc6704 2012-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms