RFC 7602
IS-IS Extended Sequence Number TLV
IS-IS Extended Sequence Number TLV 🎀
RFC 7602 💅 is the IETF Standards Track spec that gives IS-IS its Extended Sequence Number (ESN) TLV, and it was published in July 2015 🌸. The authors are U. Chunduri, W. Lu, and A. Tian from Ericsson Inc., plus N. Shen from Cisco Systems, Inc. It's published under ISSN 2070-1721. Its header doesn't list anything it obsoletes or updates ✨.
Abstract ✨
okay so this doc defines the Extended Sequence Number TLV 🦋 to protect Intermediate System to Intermediate System (IS-IS) PDUs from replay attacks 🔥. bestie, that's the whole vibe.
Status of This Memo 🌈
This is an Internet Standards Track document ✨.
This document is a product of the Internet Engineering Task Force (IETF) 🌸. It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7602 🔗.
Copyright Notice 💜
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License 📜.
Table of Contents 🗺️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
1.2. Acronyms . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Replay Attacks and Impact on IS-IS Networks . . . . . . . . . 4
2.1. IIHs . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.2. LSPs . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.3. SNPs . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Extended Sequence Number TLV . . . . . . . . . . . . . . . . 4
3.1. Sequence Number Wrap . . . . . . . . . . . . . . . . . . 5
4. Mechanism and Packet Encoding . . . . . . . . . . . . . . . . 5
4.1. IIHs . . . . . . . . . . . . . . . . . . . . . . . . . . 6
4.2. SNPs . . . . . . . . . . . . . . . . . . . . . . . . . . 6
5. Backward Compatibility and Deployment . . . . . . . . . . . . 6
5.1. IIHs and SNPs . . . . . . . . . . . . . . . . . . . . . . 7
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
7. Security Considerations . . . . . . . . . . . . . . . . . . . 7
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
8.1. Normative References . . . . . . . . . . . . . . . . . . 8
8.2. Informative References . . . . . . . . . . . . . . . . . 8
Appendix A. ESSN Encoding Mechanisms . . . . . . . . . . . . . . 10
A.1. Using Timestamps . . . . . . . . . . . . . . . . . . . . 10
A.2. Using Non-volatile Storage . . . . . . . . . . . . . . . 10
Appendix B. Operational/Implementation Considerations . . . . . 11
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 11
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 121. Introduction 💖
Intermediate System to Intermediate System (IS-IS) [ISO10589] has been adopted widely in various Layer 2 / Layer 3 routing and switching deployments of data centers and for critical business operations 🏢. Its flexibility and scalability make it well suited for the rapid development of new data center infrastructures. Also, while technologies such as Software-Defined Networking (SDN) may improve network management and enable new applications, their use has an effect on the security requirements of the routing infrastructure 🧠.
A replayed IS-IS PDU can potentially cause many problems in IS-IS networks, including bouncing adjacencies, blackholing, and even some form of Denial-of-Service (DoS) attacks as explained in Section 2 😬. This problem is also discussed in the Security Considerations section, in the context of cryptographic authentication work as described in [RFC5304] and [RFC5310].
Currently, there is no mechanism to protect IS-IS Hello (IIH) PDUs and Sequence Number PDUs (SNPs) from replay attacks 🙈. However, Link State PDUs (LSPs) have a sequence number in the LSP header as defined in [ISO10589], with which they can effectively mitigate intra-session replay attacks. But, LSPs are still susceptible to inter-session replay attacks.
This document defines the Extended Sequence Number (ESN) TLV to protect IS-IS PDUs from replay attacks 🎯.
The new ESN TLV defined here thwarts these threats and can be deployed with the authentication mechanisms specified in [RFC5304] and [RFC5310] for a more secure network 🫶.
Replay attacks can be effectively mitigated by deploying a group key management protocol (being developed as defined in [GROUP-IKEv2] and [MRKMP]) with a frequent key change policy 🔑. Currently, there is no such mechanism defined for IS-IS. Even if such a mechanism is defined, usage of this TLV can be helpful to avoid replays before the keys are changed.
Also, it is believed that, even when such a key management system is deployed, there always will be some systems based on manual keying that coexist with systems based on key management protocols 🧩. The ESN TLV defined in this document is helpful for such deployments.
1.1. Requirements Language 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
1.2. Acronyms 🍓
CSNP - Complete Sequence Number PDU
ESN - Extended Sequence Number
IIH - IS-IS Hello
IS - Intermediate System
LSP - IS-IS Link State PDU
PDU - Protocol Data Unit
PSNP - Partial Sequence Number PDU
SNP - Sequence Number PDU2. Replay Attacks and Impact on IS-IS Networks 🔥
Replaying a captured protocol packet to cause damage is a common threat for any protocol 🕵️. Securing the packet with cryptographic authentication information alone cannot mitigate this threat completely. This section explains the replay attacks and their applicability to each IS-IS PDU.
2.1. IIHs 👋
When an adjacency is brought up, an IS sends an IIH packet with an empty neighbor list (TLV 6); it can be sent with or without authentication information. Packets can be replayed later on the broadcast network, and this may cause all ISs to bounce the adjacency, thus churning the network 🌀. Note that mitigating replay is only possible when authentication information is present.
2.2. LSPs 🧾
Normal operation of the IS-IS update process as specified in [ISO10589] provides timely recovery from all LSP replay attacks ⏰. Therefore, the use of the extensions defined in this document is prohibited in LSPs. Further discussion of the vulnerability of LSPs to replay attacks can be found in [ISIS-ANALYSIS].
2.3. SNPs 📨
A replayed CSNP can result in the sending of unnecessary PSNPs on a given link. A replayed CSNP or PSNP can result in unnecessary LSP flooding on the link 🌊.
3. Extended Sequence Number TLV 🧚
The Extended Sequence Number (ESN) TLV is composed of 1 octet for the Type, 1 octet that specifies the number of bytes in the Value field, and a 12-byte Value field. This TLV is defined only for IIH and SNP PDUs 💫.
- Code -
11. - Length - total length of the value field, which is
12bytes. - Value - 64-bit Extended Session Sequence Number (ESSN), which is followed by a 32-bit, monotonically increasing, per-packet sequence number.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+
| Type |
+-+-+-+-+-+-+-+-+
| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Extended Session Sequence Number (High-Order 32 Bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Extended Session Sequence Number (Low-Order 32 Bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Packet Sequence Number (32 Bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 1: Extended Sequence Number (ESN) TLV 🖼️
The ESN TLV defined here is optional. Though this is an optional TLV, it can be mandatory on a link when 'verify' mode is enabled as specified in Section 5.1 👀. The ESN TLV MAY be present only in IIH PDUs and SNPs. A PDU with multiple ESN TLVs is invalid and MUST be discarded on receipt 🚫.
The 64-bit ESSN MUST be nonzero and MUST contain a number that is increased whenever it is changed due any situation, as specified in Section 3.1 🔢. Encoding the 64-bit unsigned integer ESSN value is a local matter, and implementations MAY use one of the alternatives provided in Appendix A. Effectively, for each PDU that contains the ESN TLV, the 96-bit unsigned integer value consisting of the 64-bit ESSN and 32-bit Packet Sequence Number (PSN) -- where the ESSN is the higher-order 64 bits -- MUST be greater than the most recently received value in a PDU of the same type originated by the same IS 👑.
3.1. Sequence Number Wrap 🔄
If the 32-bit Packet Sequence Number in the ESN TLV wraps or the router performs a cold restart, the 64-bit ESSN value MUST be set higher than the previous value 🥹. IS-IS implementations MAY use the guidelines provided in Appendix A for accomplishing this.
4. Mechanism and Packet Encoding 🦋
The encoding of the ESN TLV in each applicable IS-IS PDU is detailed below. Please refer to Section 5 for appropriate operations on how to interoperate with legacy node(s) that do not support the extensions defined in this document. If the received PDU with the ESN TLV is accepted, then the stored value for the corresponding originator and PDU type MUST be updated with the latest value received 💌. Please note that level information is included in the PDU type 📝.
4.1. IIHs 💜
ESN TLV information is maintained for each type of IIH PDU being sent on a given circuit. The procedures for encoding, verification, and sequence number wrapping are explained in Section 3 ✨.
4.2. SNPs 🌸
Separate CSNP/PSNP ESN TLV information is maintained per PDU type, per originator, and per link. The procedures for encoding, verification, and sequence number wrapping are explained in Section 3 🎀.
5. Backward Compatibility and Deployment ✨
okay so the best part about the ESN TLV 🎀 is that you can roll it out without a flag day 🙌 nobody has to shut everything down at once. you can deploy it on just the links in a special area that needs maximum security 🔒, or go for the whole network. literally your choice bestie 💅
The implementation SHOULD allow ESN TLV features to be configured on each IS-IS link level 💖 It SHOULD ALSO let operators control the 'send' and/or 'verify' feature of IS-IS PDUs, for the links and for the node 🧚 In this doc, 'send' mode means including the ESN TLV in your own IS-IS PDUs, and 'verify' mode means processing the ESN TLV in PDUs you receive from neighbors 🦋
Okay now this part is kind of scary 😭 When an adversary is actively attacking, the network can end up with inconsistent data views if there's a big delay between turning on 'send' and turning on 'verify' 💀 Like from the first node to the last node, or all the nodes on one LAN segment. The reason is that replayed PDUs can get accepted by nodes that haven't set up 'verify' yet when the attack happens 🙈 So to keep that window small, it is recommended that the network operators SHOULD set up 'verify' in a timely fashion 🍓
5.1. IIHs and SNPs 🌸
okay so the ESN TLV touches IIH PDUs and SNPs (both CSNP and PSNP) on the link level 🫶 'send' and 'verify' can be set independently on each link, and on a broadcast network they can also be set independently on each level 🔥
To roll out ESN support without breaking anything, the ISs on an interface get set to 'send' mode first 🌈 Once every router on that interface is in 'send' mode, 'verify' can be turned on for each IS ✨ After that, every IIH PDU and SNP sent on that interface MUST contain the ESN TLV 💜 And any PDU that shows up without an ESN TLV MUST be discarded once 'verify' is enabled 💀 Super important 🚨
To safely turn ESN support off on a link, you disable 'verify' on all the ISs on that link first 🦋 Once 'verify' is off on every router on the interface, you can disable 'send' on each IS 🍓 For things to think about before turning 'verify' on or off on all ISs on a link, check out Section 5 👑
6. IANA Considerations 🎀
IANA gave a new TLV codepoint, the one defined in this document, from the "IS-IS TLV Codepoints" registry 💖 It's called the Extended Sequence Number TLV and has these attributes:
Value Name IIH LSP SNP Purge
----- --------------------- --- --- --- -----
11 ESN TLV y n y n7. Security Considerations 🔒
this section is the big one, so listen up bestie 😤
This document describes a mechanism to mitigate the replay attack threat, as discussed in the Security Considerations sections of [RFC5304] and [RFC5310] 🧚 But if an adversary interferes by not forwarding packets or by delaying messages, as described in Section 3.3 of [RFC6862], the mechanism in this document CANNOT mitigate those threats 💀 Also, some of the threats in Section 2.3 of [ISIS-ANALYSIS] can't be addressed with the ESN TLV as specified here 🙈 Otherwise, this document does not introduce any new security concerns to IS-IS or any of the other specifications it references 🫶
8. References 📚
8.1. Normative References 💜
[ISO10589] International Organization for Standardization, "Intermediate system to intermediate system intra-domain-routing routine information exchange protocol for use in conjunction with the protocol for providing the connectionless-mode Network Service (ISO 8473)", ISO/IEC 10589:2002, Second Edition, Nov. 2002.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.
[RFC5905] Mills, D., Martin, J., Ed., Burbank, J., and W. Kasch, "Network Time Protocol Version 4: Protocol and Algorithms Specification", RFC 5905, DOI 10.17487/RFC5905, June 2010, <http://www.rfc-editor.org/info/rfc5905>.
8.2. Informative References 🌷
[MRKMP] Hartman, S., Zhang, D., and G. Lebovitz, "Multicast Router Key Management Protocol (MaRK)", Work in Progress, draft-hartman-karp-mrkmp-05, September 2012.
[ISIS-ANALYSIS] Chunduri, U., Tian, A., and W. Lu, "KARP IS-IS security analysis", Work in Progress, draft-ietf-karp-isis-analysis-07, July 2015.
[GROUP-IKEv2] Rowles, S., Yeung, A., Ed., Tran, P., and Y. Nir, "Group Key Management using IKEv2", Work in Progress, draft-yeung-g-ikev2-08, October 2014.
[RFC5304] Li, T. and R. Atkinson, "IS-IS Cryptographic Authentication", RFC 5304, DOI 10.17487/RFC5304, October 2008, <http://www.rfc-editor.org/info/rfc5304>.
[RFC5310] Bhatia, M., Manral, V., Li, T., Atkinson, R., White, R., and M. Fanto, "IS-IS Generic Cryptographic Authentication", RFC 5310, DOI 10.17487/RFC5310, February 2009, <http://www.rfc-editor.org/info/rfc5310>.
[RFC6862] Lebovitz, G., Bhatia, M., and B. Weis, "Keying and Authentication for Routing Protocols (KARP) Overview, Threats, and Requirements", RFC 6862, DOI 10.17487/RFC6862, March 2013, <http://www.rfc-editor.org/info/rfc6862>.
[RFC7474] Bhatia, M., Hartman, S., Zhang, D., and A. Lindem, Ed., "Security Extension for OSPFv2 When Using Manual Key Management", RFC 7474, DOI 10.17487/RFC7474, April 2015, <http://www.rfc-editor.org/info/rfc7474>.
Appendix A. ESSN Encoding Mechanisms 🧁
IS-IS nodes implementing this spec SHOULD use available mechanisms to keep the 64-bit Extended Session Sequence Number strictly increasing 📈 whenever it changes for the deployed life of the node (including cold restarts) ✨
This appendix gives guidelines for keeping the 64-bit ESSN strictly increasing in the ESN TLV 💅 Implementations can use any similar method, as long as that property holds 🫶
A.1. Using Timestamps ⏰
One way to do this is to encode the 64-bit ESSN as the system time, stored in a 64-bit unsigned integer 🔢 This MAY be similar to the system timestamp encoding for the NTP long format defined in Appendix A.4 of [RFC5905] 🌈 The new current time MAY be used when the node loses its sequence number state, including when the Packet Sequence Number wraps 🌸
Implementations MUST make sure that when they encode the 64-bit ESN value from the current system time, it does NOT default to any previous value or some default node time, especially after cold restarts or similar events 🚨 In general, system time has to survive cold restarts for this to work 💖 One example is a battery backed real-time clock (RTC) 🔋
A.2. Using Non-volatile Storage 💾
Another way is similar to the one in [RFC7474]: use the 64-bit ESSN as a wrap/boot count stored in non-volatile storage 🧠 The value gets incremented any time the IS-IS node loses its sequence number state, including when the Packet Sequence Number wraps 🔁
There's a catch though 🙈 It's described in Section 8 of [RFC7474]. The IS-IS implementation has to be able to save its boot count in non-volatile storage 💀 If that storage ever gets repaired, or the router hardware is upgraded so the contents are lost, keys MUST be changed to prevent replay attacks 🔑
Appendix B. Operational/Implementation Considerations 🛠️
Since the ESN is kept per PDU type, per originator, and per link, this scheme can help you monitor the health of the IS-IS adjacency 👀 A Packet Sequence Number skip that happens when an IIH is received can be recorded by the neighbors and used later to correlate adjacency state changes over the interface 🦋 For example, on multi-access media, totally different network issues may show up when all neighbors record skips from the same IIH sender, compared to when only one neighbor records them 🤔 For operational issues, using the TLV defined here MAY also need more system information before you can draw firm conclusions 💭 Defining all that info is beyond the scope of this document 🙏
Acknowledgements 🫶
As a sort of sequence number mechanism to thwart protocol replays is an old concept, the authors don't claim originality for the overall protection idea described 🧓 Big thanks to Acee Lindem and Joel Halpern for the review and valuable feedback 💜 Thanks also to Alia Atlas, Chris Hopps, Nevil Brownlee, and Adam W. Montville for their reviews and suggestions during IESG directorate review ✨ And thank you to Christer Holmberg, Ben Campbell, Barry Leiba, Stephen Farrell, and Alvaro Retana for reviewing this document 🎀
Contributors 🌟
The authors would like to thank Les Ginsberg for his significant contribution through detailed reviews and suggestions 👑
Authors' Addresses 📮
Uma Chunduri Ericsson Inc. 300 Holger Way, San Jose, California 95134 United States
Phone: 408 750-5678 Email: uma.chunduri@ericsson.com
Wenhu Lu Ericsson Inc. 300 Holger Way, San Jose, California 95134 United States
Email: wenhu.lu@ericsson.com
Albert Tian Ericsson Inc. 300 Holger Way, San Jose, California 95134 United States
Phone: 408 750-5210 Email: albert.tian@ericsson.com
Naiming Shen Cisco Systems, Inc. 225 West Tasman Drive, San Jose, California 95134 United States
Email: naiming@cisco.com
📦 where this page comes from
- ietf: rfc7602 2015-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms