RFC 912

RFC 912: Authentication Service 🎀

okay bestie, RFC 912 is a little gem from September 1984 by Mike StJohns of TPSC 🌸 It's filed under the Network Working Group, and it's a proposed protocol, so the whole point is to get the community talking and suggesting improvements 💬 It doesn't list any RFCs it obsoletes or updates, so it's standing on its own ✨

---

Status of This Memo ✨

so this RFC is basically throwing a proposal out to the ARPA-Internet crowd and asking for feedback 🫶 Distribution is totally unlimited, so pass it around 💖

Introduction 🦋

The Authentication Server is the one that figures out who is behind a particular TCP connection 👀 You give it a pair of TCP port numbers and it sends back a string that names the owner of that connection on the server's system. The use cases they listed are super practical: automatically identifying and verifying a user during an FTP session, extra verification for a TAC dial-up user, and access checks for a generalized network file server 💅

Overview 🌈

This is a connection-based application that runs on TCP. A server listens for TCP connections on TCP port 113 (decimal) 🧚 Once a connection comes in, the server reads one line of data that tells it which connection you're asking about. If that connection exists, the server sends the system-dependent user identifier of its owner back down the same connection. Then it closes the connection right after sending the identifier 🔒

Restrictions 🚫

You can only ask about fully specified connections 🙅‍♀️ The local and foreign host pair that defines the connection is taken from the query connection itself. So, lowkey, a user on Host A can only ask the server on Host B about connections between A and B. No snooping on the rest of the network 👀

Query/Response Format 💌

The server takes simple text queries that look like this:

<local-port>, <foreign-port>

Here, <local-port> is the TCP port (decimal) on the target system, which is the server's system. <foreign-port> is the TCP port (decimal) on the source system, which is the user's system 🍓

For example:

23, 6191

The response is shaped like this:

<local-port>, <foreign-port> : <response-type> : <additional-info>

The <local-port>, <foreign-port> part is the same pair you sent in the query. <response-type> is a keyword that says what kind of response it is, and <additional-info> depends on the response type 🎀

For example:

23, 6191 : USERID : StJohns

Response Types 🫧

There are two response types, and they're both very on-brand 💜

USERID 🪪

In this case, <additional-info> is the printable form of the user identifier for the owner of the connection. The format of that identifier is completely up to the system, so don't expect a universal standard here 🤷‍♀️

ERROR 🚨

Sometimes the server just can't figure out who owns the TCP port 😭 When that happens, <additional-info> explains why. These are the suggested values and what they mean:

INVALID PORT

The local port or the foreign port was specified wrong. Oops 🙈

NO USER

The connection that the port pair points to isn't being used right now 👻

UNKNOWN ERROR

The server can't work out who owns the connection, and it doesn't know why. Other values can be used too, as needed ✨

Caveats ⚠️

The big warning: the trustworthiness of the hosts that might run an authentication server is going to vary a LOT 💀

So it's up to each application that uses the server to decide how much trust to put in the info it gets back 🧐 In some cases it may be appropriate to restrict use of the server to a locally controlled subnet. Real talk, that's a smart move 🔐

Applications 🎯

1. Automatic user authentication for FTP. Literally the whole reason this started 💅
2. Verification for privileged network operations. For example, having the server start or stop special purpose servers 🔥

Disclaimer 🙈

The author says they designed this protocol so they could stop typing their identity every time they continued an FTP session. Relatable 😭 Since they started, other applications showed up too. They tried to consider all of those while keeping the design as general as possible 💖