RFC 6978

okay bestie, you're gonna love this one 💖 RFC 6978 is an Experimental, independent submission by Joe Touch of USC/ISI, dated July 2013, with ISSN 2070-1721. It's titled A TCP Authentication Option Extension for NAT Traversal 🎀 The title block doesn't list any Obsoletes or Updates, so it's not replacing or changing anything else 🦋

Abstract ✨

okay so this doc is about giving TCP-AO a glow-up so it works through Network Address Translators and/or Network Address and Port Translators (NATs/NAPTs) 🌸 the change only touches the data used to compute traffic keys. TCP-AO's packet processing and key generation algorithms stay exactly the same, no cap 💅

Status of This Memo ✨

this document is not an Internet Standards Track specification 🫶 it's published for examination, experimental implementation, and evaluation.

it defines an Experimental Protocol for the Internet community 🧚 it's a contribution to the RFC Series, independent of any other RFC stream. the RFC Editor chose to publish it at its discretion and makes no statement about its value for implementation or deployment. documents approved by the RFC Editor are not a candidate for any level of Internet Standard, see Section 2 of RFC 5741 😭

info about the current status, errata, and how to give feedback lives at http://www.rfc-editor.org/info/rfc6978 🍓

Copyright Notice ✨

Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 🌈

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. please review these carefully, since they explain your rights and restrictions with respect to this document 📜

Table of Contents ✨

1. Introduction ....................................................2
2. Conventions Used in This Document ...............................2
3. Background ......................................................3
4. Extension to Allow NAT Traversal ................................3
5. Intended Use ....................................................4
6. Security Considerations .........................................5
7. References ......................................................5
   7.1. Normative References .......................................5
   7.2. Informative References .....................................5
8. Acknowledgments .................................................6

1. Introduction 🦋

okay so TCP-AO gets an extension called TCP-AO-NAT [RFC5925] so it can keep working when NATs and/or NAPTs [RFC2663] are in the picture 🌸 those devices rewrite the source address and/or the source port of a TCP connection. without TCP-AO-NAT, TCP-AO would be sensitive to those changes and would throw out authenticated segments. 😭

one potential use is the experimental multipath TCP protocol [RFC6824], which uses multiple IP addresses to support a single TCP transfer 👑

this doc assumes you already know TCP-AO [RFC5925] inside out. quick preview: it focuses on how TCP-AO generates traffic keys, and it doesn't otherwise change the TCP-AO mechanism or its key generation [RFC5926] 💅

2. Conventions Used in This Document ✨

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🫶 when they show up in lower case, they just have their normal everyday meaning and don't carry the RFC 2119 interpretations 🙈

3. Background 🧚

TCP-AO makes traffic keys that are specific to a socket pair [RFC5925]. these are the inputs used to create a connection's traffic keys. (fyi, 'local' and 'remote' mean what they mean in TCP-AO [RFC5925].) 🍓

• IP local address
• IP remote address
• TCP local port
• TCP remote port
• TCP local Initial Sequence Number (ISN)
• TCP remote Initial Sequence Number (ISN)

ngl the remote ISN isn't known for SYN segments, so it gets left out of the traffic key used to authenticate those. everything else is used in the traffic keys of all other segments 🔥

NATs and NAPTs (both called "NATs" from here on, even if port translation is included) would mess with all this, because they change the IP address and TCP port of the endpoint behind the NAT [RFC2663] 😭💀

4. Extension to Allow NAT Traversal 👑

the whole premise of TCP-AO-NAT is that it could be useful to allow TCP-AO even when NATs are involved, like protecting client/server communication where the clients are behind NATs 💖

so TCP-AO-NAT is an extension that makes TCP-AO work with NATs 🎀 it needs no changes to the TCP-AO header or packet processing, and no changes to the algorithms that generate traffic keys [RFC5926]. the only thing that changes is the data used to generate traffic keys ✨

in TCP-AO, "a Master Key Tuple (MKT) describes the TCP-AO properties to be associated with one or more connections" [RFC5925] 🦋 that includes the TCP connection identifier, the TCP option flag (which says whether TCP options other than TCP-AO get included in the Message Authentication Code (MAC) calculation), keying information, and other parameters. TCP-AO-NAT adds two extra flags to the MKT:

• localNAT
• remoteNAT

TCP-AO implementations supporting TCP-AO-NAT MUST support both localNAT and remoteNAT flags. 🫶

these flags say whether a segment's local or remote (respectively) IP address and TCP port get zeroed before the MAC calculation. that happens either when making the MAC to insert (outgoing segments) or when calculating a MAC to check against the value in the option. the flags change the TCP-AO processing rules like this:

• In TCP-AO-NAT, traffic keys are computed by zeroing the local/remote IP address and TCP port as indicated by the localNAT or remoteNAT flags.
• In TCP-AO-NAT, MAC values are computed by zeroing the local/remote IP address and TCP port as indicated by the localNAT or remoteNAT flags.

the flags have to match on both ends of the connection, just like every other MKT parameter 🔥

5. Intended Use 🌈

a host MAY use TCP-AO-NAT when it's behind a NAT (figured out with NAT discovery techniques), or when TCP-AO protection is wanted but regular TCP-AO fails to set up connections 🧚

a client behind a NAT MAY set localNAT=TRUE for MKTs supporting TCP-AO-NAT on outgoing connections. a server MAY set remoteNAT=TRUE for MKTs supporting TCP-AO-NAT on incoming connections. peer-to-peer apps with dual NAT support, like the ones traversing so-called 'symmetric NATs' [RFC5389], MAY set both localNAT=TRUE and remoteNAT=TRUE for MKTs supporting TCP-AO-NAT bidirectionally 🦋 once these flags are set in an MKT, they affect every connection that matches that MKT 💅

TCP-AO-NAT is only meant for use where endpoints have coordinated on it, for connections matching the shared MKT parameters, same as every other MKT parameter 🫶

heads up, TCP-AO-NAT is not meant for services going through Application Layer Gateways (ALGs), meaning NATs that also translate in-band addresses, like the ones used in FTP or SIP 🙈 TCP-AO-NAT protects the contents of the TCP segments from modification, so it would (correctly) read those changes as an attack on the contents 💀

6. Security Considerations 💀

okay this section is serious, so listen up 😭

TCP-AO-NAT doesn't affect the security of connections that don't set either the localNAT or remoteNAT flags 🔥 those connections aren't affected themselves, and they aren't affected by segments in other connections that do set those flags.

⚠️ setting either the localNAT or remoteNAT flags reduces the randomness of the input to the Key Derivation Function (KDF) used to generate the traffic keys. the biggest hit happens with IPv4, where the randomness drops from 2 IPv4 addresses, 2 ISNs, and both ports down to just the two ISNs when both flags are set. the randomness in the IPv4 addresses and service port is likely small, and the randomness of the dynamic port is under debate and should not be considered substantial [RFC6056]. so the KDF input randomness is mostly driven by the ISNs, and cutting it by either or both of the IPv4 addresses and ports isn't expected to have a significant impact 🙈

7. References 📜

7.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC5925]  Touch, J., Mankin, A., and R. Bonica, "The TCP
           Authentication Option", RFC 5925, June 2010.

7.2. Informative References

[RFC2663]  Srisuresh, P. and M. Holdrege, "IP Network Address
           Translator (NAT) Terminology and Considerations",
           RFC 2663, August 1999.

[RFC5389]  Rosenberg, J., Mahy, R., Matthews, P., and D. Wing,
           "Session Traversal Utilities for NAT (STUN)", RFC 5389,
           October 2008.

[RFC5926]  Lebovitz, G. and E. Rescorla, "Cryptographic Algorithms
           for the TCP Authentication Option (TCP-AO)", RFC 5926,
           June 2010.

[RFC6056]  Larsen, M. and F. Gont, "Recommendations for Transport-
           Protocol Port Randomization", BCP 156, RFC 6056,
           January 2011.

[RFC6824]  Ford, A., Raiciu, C., Handley, M., and O. Bonaventure,
           "TCP Extensions for Multipath Operation with Multiple
           Addresses", RFC 6824, January 2013.

8. Acknowledgments 🫶

this extension was inspired by discussions with Dan Wing 💜

this document was initially prepared using 2-Word-v2.0.template.dot 🎀

Author's Address ✨

Joe Touch
USC/ISI
4676 Admiralty Way
Marina del Rey, CA 90292
USA

Phone: +1 (310) 448-9151
EMail: touch@isi.edu