RFC 8136

Additional Transition Functionality for IPv6

📅 published April 2017, from ietf

Abstract ✨

okay bestie, so this doc proposes an extra mechanism that's meant to do two things at once: make the jump from IPv4 to IPv6 easier 🦋 AND level up IPv6's security and privacy 🔐 no cap, we're doing both.

Title Block 🎀

Quick vibe check on the header: this is an Independent Submission, RFC 8136, called "Additional Transition Functionality for IPv6." The authors are B. Carpenter (Univ. of Auckland) and R. Hinden (Check Point Software). It's Informational, ISSN 2070-1721, dated 1 April 2017 👀 (april fools energy, iykyk). The header doesn't list anything this RFC obsoletes or updates.

Status of This Memo 📜

This document is not an Internet Standards Track specification, so it's published just for informational purposes 🌸

This is a contribution to the RFC Series, independent of any other RFC stream. The RFC Editor picked to publish it at their discretion and makes no statement about its value for implementation or deployment. Documents approved by the RFC Editor aren't a candidate for any level of Internet Standard, so see Section 2 of RFC 7841 for the deets 💅

Info about the current status, any errata, and how to send feedback is at http://www.rfc-editor.org/info/rfc8136 🌈

Copyright Notice 💜

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read those carefully, because they spell out your rights and restrictions for this doc 📖

Table of Contents 🧚

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
  1.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Required Function of All IPv4 Nodes . . . . . . . . . . . . .   2
3.  Security Flag for IPv6 Packets  . . . . . . . . . . . . . . .   3
4.  Advanced Solution . . . . . . . . . . . . . . . . . . . . . .   4
  4.1.  Privacy Extension . . . . . . . . . . . . . . . . . . . .   4
5.  Security Considerations . . . . . . . . . . . . . . . . . . .   5
6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   5
  7.1.  Normative References  . . . . . . . . . . . . . . . . . .   5
  7.2.  Informative References  . . . . . . . . . . . . . . . . .   6
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   7

1. Introduction ✨

okay so the Internet Architecture Board said in a recent statement [IABv6] that the IETF is expected to "stop requiring IPv4 compatibility in new or extended protocols" and that future work will "optimize for and depend on IPv6" 🙌 to help that happen, this memo makes a big change to IPv4 node requirements [RFC1122] and adds a missing security feature to IPv6 [RFC2460]. main character energy fr 👑

1.1. Terminology 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are not to be interpreted as described in [RFC2119].

2. Required Function of All IPv4 Nodes 🔥

so the goal here is that routers, firewalls, load balancers, and all the other middleboxes can spot IPv4 packets easily and treat them properly (selective dropping, switching to the slow path through a router, sending them down the longest path first, etc.) 🚦 to make that work, all IPv4 nodes MUST set the security flag defined by [RFC3514] to 1. this should be enough to make dual stack apps prefer IPv6 when they get the choice, and the Happy Eyeballs algorithm [RFC6555] will usually favour the IPv6 path 🦋

3. Security Flag for IPv6 Packets 🔐

the requirement above kinda cancels out the practical effect of the IPv4 security flag for benign traffic 💀 but that's fixable by adding an equivalent flag for IPv6. honestly this is highly desirable so IPv4 and IPv6 stay feature equivalent. and it's easy because IPv6 has SO many bits 🌸

here's the solution: the Security Flag bit for an IPv6 packet is just the parity of the packet's source address. in other words, if the source address has an odd number of 1s, the flag is True, and otherwise it's False 🧮 everything else about the flag works exactly as described in [RFC3514] 💅

for an interface whose IPv6 address is set by Stateless Address Autoconfiguration [RFC4862], the host itself decides its security flag state by picking a suitable Interface Identifier value. and this is now possible and compatible with [RFC7136], [RFC7217], [RFC7421], and [RFC7721] ✨

for an interface whose IPv6 address is set by DHCPv6 [RFC3315] or manually, the network administrator is free to choose an Interface Identifier that gives the desired security flag, and that's also compatible with [RFC7721] 🧚

there's one exception: a link with a 127-bit prefix [RFC6164]. since there's only one bit available as an Interface Identifier, one end or the other will inevitably have its security flag set, and the other won't 😭 in this case, the node at one end just reads the other end's security flag as the opposite of what it says, and vice versa 🙃

and since RFC 6164 is designed for links between routers, when different ISPs sit at each end of the link, it's normal operational practice for one ISP to consider the other ISP to be evil 💀💀 (a little drama, but that's the vibe)

4. Advanced Solution 🌈

if the previous solution turns out to be too simple to deploy in practice, there's a more advanced solution defined too. it uses a new IPv6 hop-by-hop User Security Flag Option (UFO) 🎀

the UFO is a hop-by-hop option that can be included in any IPv6 packet. multiple UFOs MUST NOT be present in the packet. the UFO has no alignment requirement. here's its format:

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                                 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                 |  Option Type  | Option Length |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | UserSecFlag   |
 +-+-+-+-+-+-+-+-+

               User Security Flag Option Layout

Option Type: an 8-bit identifier for the type of option. the option identifier for the User Security Flag Option (0x7g) has not been allocated by the IANA 🙈
Option Length: an 8-bit unsigned integer, the length of the option (excluding the Option Type and Option Length fields). the value MUST be 1 🔥
UserSecFlag: an 8-bit unsigned integer. Bit 0 has the functionality defined in [RFC3514]. the other bits are reserved and MUST be zero or one 💅

4.1. Privacy Extension 🔒

the mechanism can be extended to add a privacy flag. with the mechanism of Section 3, the privacy flag could be encoded using quaternary parity (CRC-2) to get an extra bit. but that would waste a considerable amount of address space, so it SHOULD NOT be done 🙅‍♀️

with the UFO mechanism, bit 1 of UserSecFlag is defined as the privacy flag. if it's set, the packet contains private information and MUST NOT be inspected en route. all firewalls, monitoring devices, and government agencies MUST respect this rule 🛑 this option is expected to be way more computationally efficient than conventional privacy techniques like IPsec and Transport Layer Security (TLS), since no encryption or key management is needed to get the privacy 🧠✨

5. Security Considerations 🚨

the security considerations of [RFC3514] now apply to IPv6. however, with the security flag set for all IPv4 packets, there's a risk that all IPv4 traffic will now be treated as a very distributed denial-of-service attack 😱

given the recent experience with very large scale DDoS attacks from Internet of Things (IoT) devices like IP Cameras, plus phishing attacks, malware, and so on, all happening on the IPv4 Internet, it's a safe assumption that all IPv4 packets are evil 👀

since the mechanism in Section 3 is compatible with [RFC7721], address privacy isn't impacted. also, with that mechanism, exactly half the IPv6 address space will indicate that the security flag is set, so we can assert that the IPv6 Internet is only half evil 🌓💀

6. IANA Considerations 🧚

this document does not require any IANA actions 🌸

7. References 📚

7.1. Normative References 💜

[RFC1122]  Braden, R., Ed., "Requirements for Internet Hosts -
           Communication Layers", STD 3, RFC 1122,
           DOI 10.17487/RFC1122, October 1989,
           <http://www.rfc-editor.org/info/rfc1122>.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC2460]  Deering, S. and R. Hinden, "Internet Protocol, Version 6
           (IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460,
           December 1998, <http://www.rfc-editor.org/info/rfc2460>.

[RFC3315]  Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
           C., and M. Carney, "Dynamic Host Configuration Protocol
           for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July
           2003, <http://www.rfc-editor.org/info/rfc3315>.

[RFC4862]  Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless
           Address Autoconfiguration", RFC 4862,
           DOI 10.17487/RFC4862, September 2007,
           <http://www.rfc-editor.org/info/rfc4862>.

[RFC6164]  Kohno, M., Nitzan, B., Bush, R., Matsuzaki, Y., Colitti,
           L., and T. Narten, "Using 127-Bit IPv6 Prefixes on Inter-
           Router Links", RFC 6164, DOI 10.17487/RFC6164, April 2011,
           <http://www.rfc-editor.org/info/rfc6164>.

[RFC6555]  Wing, D. and A. Yourtchenko, "Happy Eyeballs: Success with
           Dual-Stack Hosts", RFC 6555, DOI 10.17487/RFC6555, April
           2012, <http://www.rfc-editor.org/info/rfc6555>.

[RFC7136]  Carpenter, B. and S. Jiang, "Significance of IPv6
           Interface Identifiers", RFC 7136, DOI 10.17487/RFC7136,
           February 2014, <http://www.rfc-editor.org/info/rfc7136>.

[RFC7217]  Gont, F., "A Method for Generating Semantically Opaque
           Interface Identifiers with IPv6 Stateless Address
           Autoconfiguration (SLAAC)", RFC 7217,
           DOI 10.17487/RFC7217, April 2014,
           <http://www.rfc-editor.org/info/rfc7217>.

7.2. Informative References ✨

okay bestie, these are the reading-list references 📚 they're here for background and context, so they're not the must-read ones from 7.1. I'm keeping every entry exactly as written so you can look them all up 🔍

[IABv6]    IAB, "IAB Statement on IPv6", November 2016,
           <https://www.iab.org/2016/11/07/iab-statement-on-ipv6/>.

[RFC3514]  Bellovin, S., "The Security Flag in the IPv4 Header",
           RFC 3514, DOI 10.17487/RFC3514, April 2003,
           <http://www.rfc-editor.org/info/rfc3514>.

[RFC7421]  Carpenter, B., Ed., Chown, T., Gont, F., Jiang, S.,
           Petrescu, A., and A. Yourtchenko, "Analysis of the 64-bit
           Boundary in IPv6 Addressing", RFC 7421,
           DOI 10.17487/RFC7421, January 2015,
           <http://www.rfc-editor.org/info/rfc7421>.

[RFC7721]  Cooper, A., Gont, F., and D. Thaler, "Security and Privacy
           Considerations for IPv6 Address Generation Mechanisms",
           RFC 7721, DOI 10.17487/RFC7721, March 2016,
           <http://www.rfc-editor.org/info/rfc7721>.

Authors' Addresses 🫶

the authors, the people who wrote this whole thing, and how to reach them 💌

Brian Carpenter
Department of Computer Science
University of Auckland
PB 92019
Auckland  1142
New Zealand

Email: brian.e.carpenter@gmail.com


Robert M.  Hinden
Check Point Software
959 Skyway Road
San Carlos  CA 94070
United States of America

Email: bob.hinden@gmail.com

and that's the whole RFC, bestie 🌈💖 we did it 😭✨

📦 where this page comes from

ietf: rfc8136 2017-04
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms