Internet Engineering Task Force (IETF) J. Touch
Request for Comments: 9235 Independent Consultant
Category: Informational J. Kuusisaari
ISSN: 2070-1721 Infinera
May 2022
TCP Authentication Option (TCP-AO) Test Vectors
Abstract
This document provides test vectors to validate implementations of
the two mandatory authentication algorithms specified for the TCP
Authentication Option over both IPv4 and IPv6. This includes
validation of the key derivation function (KDF) based on a set of
test connection parameters as well as validation of the message
authentication code (MAC). Vectors are provided for both currently
required pairs of KDF and MAC algorithms: KDF_HMAC_SHA1 and HMAC-
SHA-1-96, and KDF_AES_128_CMAC and AES-128-CMAC-96. The vectors also
validate both whole TCP segments as well as segments whose options
are excluded for middlebox traversal.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are candidates for any level of Internet
Standard; see Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc9235.
Copyright Notice
Copyright (c) 2022 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Revised BSD License text as described in Section 4.e of the
Trust Legal Provisions and are provided without warranty as described
in the Revised BSD License.
Table of Contents
1. Introduction
2. Conventions Used in This Document
3. Input Test Vectors
3.1. TCP Connection Parameters
3.1.1. TCP-AO Parameters
3.1.2. Active (Client) Side Parameters
3.1.3. Passive (Server) Side Parameters
3.1.4. Other IP Fields and Options
3.1.5. Other TCP Fields and Options
4. IPv4 SHA-1 Output Test Vectors
4.1. HMAC-SHA-1-96 (Default - Covers TCP Options)
4.1.1. Send (Client) SYN (Covers Options)
4.1.2. Receive (Server) SYN-ACK (Covers Options)
4.1.3. Send (Client) Non-SYN (Covers Options)
4.1.4. Receive (Server) Non-SYN (Covers Options)
4.2. HMAC-SHA-1-96 (Omits TCP Options)
4.2.1. Send (Client) SYN (Omits Options)
4.2.2. Receive (Server) SYN-ACK (Omits Options)
4.2.3. Send (Client) Non-SYN (Omits Options)
4.2.4. Receive (Server) Non-SYN (Omits Options)
5. IPv4 AES-128 Output Test Vectors
5.1. AES-128-CMAC-96 (Default - Covers TCP Options)
5.1.1. Send (Client) SYN (Covers Options)
5.1.2. Receive (Server) SYN-ACK (Covers Options)
5.1.3. Send (Client) Non-SYN (Covers Options)
5.1.4. Receive (Server) Non-SYN (Covers Options)
5.2. AES-128-CMAC-96 (Omits TCP Options)
5.2.1. Send (Client) SYN (Omits Options)
5.2.2. Receive (Server) SYN-ACK (Omits Options)
5.2.3. Send (Client) Non-SYN (Omits Options)
5.2.4. Receive (Server) Non-SYN (Omits Options)
6. IPv6 SHA-1 Output Test Vectors
6.1. HMAC-SHA-1-96 (Default - Covers TCP Options)
6.1.1. Send (Client) SYN (Covers Options)
6.1.2. Receive (Server) SYN-ACK (Covers Options)
6.1.3. Send (Client) Non-SYN (Covers Options)
6.1.4. Receive (Server) Non-SYN (Covers Options)
6.2. HMAC-SHA-1-96 (Omits TCP Options)
6.2.1. Send (Client) SYN (Omits Options)
6.2.2. Receive (Server) SYN-ACK (Omits Options)
6.2.3. Send (Client) Non-SYN (Omits Options)
6.2.4. Receive (Server) Non-SYN (Omits Options)
7. IPv6 AES-128 Output Test Vectors
7.1. AES-128-CMAC-96 (Default - Covers TCP Options)
7.1.1. Send (Client) SYN (Covers Options)
7.1.2. Receive (Server) SYN-ACK (Covers Options)
7.1.3. Send (Client) Non-SYN (Covers Options)
7.1.4. Receive (Server) Non-SYN (Covers Options)
7.2. AES-128-CMAC-96 (Omits TCP Options)
7.2.1. Send (Client) SYN (Omits Options)
7.2.2. Receive (Server) SYN-ACK (Omits Options)
7.2.3. Send (Client) Non-SYN (Omits Options)
7.2.4. Receive (Server) Non-SYN (Omits Options)
8. Observed Implementation Errors
8.1. Algorithm Issues
8.2. Algorithm Parameters
8.3. String Handling Issues
8.4. Header Coverage Issues
9. Security Considerations
10. IANA Considerations
11. References
11.1. Normative References
11.2. Informative References
Acknowledgments
Authors' Addresses
1. Introduction
This document provides test vectors to validate the correct
implementation of the TCP Authentication Option (TCP-AO) [RFC5925]
and its mandatory cryptographic algorithms defined in [RFC5926]. It
includes the specification of all endpoint parameters to generate the
variety of TCP segments covered by different keys and MAC coverage,
i.e., both the default case and the variant where TCP options are
ignored for middlebox traversal. It also includes both default key
derivation functions (KDFs) and MAC generation algorithms [RFC5926]
and lists common pitfalls of implementing the algorithms correctly.
The experimental extension to support NAT traversal [RFC6978] is not
included in the provided test vectors.
This document provides test vectors from multiple implementations
that have been validated against each other for interoperability.
2. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
3. Input Test Vectors
3.1. TCP Connection Parameters
The following parameters are used throughout this suite of test
vectors. The terms 'active' and 'passive' are used as defined for
TCP [RFC0793].
3.1.1. TCP-AO Parameters
The following values are used for all exchanges. This suite does not
test key switchover. The KeyIDs are as indicated for TCP-AO
[RFC5925]. The Master_Key is used to derive the traffic keys
[RFC5926].
Active (client) side KeyID: 61 decimal (0x3d hexadecimal)
Passive (server) side KeyID: 84 decimal (0x54 hexadecimal)
Master_Key: "testvector" (length = 10 bytes)
3.1.2. Active (Client) Side Parameters
The following endpoint parameters are used on the active side of the
TCP connection, i.e., the side that initiates the TCP SYN.
For IPv4: 10.11.12.13 (dotted decimal)
For IPv6: fd00::1 (IPv6 hexadecimal)
TCP port: (varies)
3.1.3. Passive (Server) Side Parameters
The following endpoint parameters are used for the passive side of
the TCP connection, i.e., the side that responds with a TCP SYN-ACK.
For IPv4: 172.27.28.29 (dotted decimal)
For IPv6: fd00::2 (IPv6 hexadecimal)
TCP port = 179 decimal (BGP)
3.1.4. Other IP Fields and Options
No IP options are used in these test vectors.
All IPv4 packets use the following other parameters [RFC0791]:
Differentiated Services Code Point (DSCP) = 111000 binary (CS7) as is
typical for BGP, Explicit Congestion Notification (ECN) = 00 binary,
set the Don't Fragment (DF) bit, and clear the More Fragments (MF)
bit.
IPv4 uses a TTL of 255 decimal; IPv6 uses a hop limit of 255 decimal.
All IPv6 packets use the following other parameters [RFC8200]:
traffic class = 0xe0 hexadecimal (DSCP = 111000 binary CS7, as is
typical for BGP, with ECN = 00 binary) and no Extension Headers
(EHs).
3.1.5. Other TCP Fields and Options
The SYN and SYN-ACK segments include Maximum Segment Size (MSS)
[RFC0793], No Operation (NOP), Window Scale [RFC7323], Selective
Acknowledgment (SACK) permitted [RFC2018], Timestamp [RFC7323], and
TCP-AO [RFC5925], in that order.
All other example segments include NOP, NOP, Timestamp, and TCP-AO,
in that order.
All segment urgent (URG) pointers are zero [RFC0793]. All segments
with data set the push (PSH) flag [RFC0793].
Each TCP connection below uses the Initial Sequence Numbers (ISNs) as
indicated at the front of each corresponding section.
4. IPv4 SHA-1 Output Test Vectors
The SHA-1 KDF and MAC algorithms, KDF_HMAC_SHA1 and HMAC-SHA-1-96,
are computed as specified for TCP-AO [RFC5926].
In the following sections, all values are indicated as 2-digit
hexadecimal values with spacing per line representing the contents of
16 consecutive bytes, as is typical for data dumps. The IP/TCP data
indicates the entire IP packet, including the TCP segment and its
options (whether covered by TCP-AO or not, as indicated), including
TCP-AO.
4.1. HMAC-SHA-1-96 (Default - Covers TCP Options)
4.1.1. Send (Client) SYN (Covers Options)
Client ISN = 0xfbfbab5a
Send_SYN_traffic_key:
6d 63 ef 1b 02 fe 15 09 d4 b1 40 27 07 fd 7b 04
16 ab b7 4f
IPv4/TCP:
45 e0 00 4c dd 0f 40 00 ff 06 bf 6b 0a 0b 0c 0d
ac 1b 1c 1d e9 d7 00 b3 fb fb ab 5a 00 00 00 00
e0 02 ff ff d4 5e 00 00 02 04 05 b4 01 03 03 08
04 02 08 0a 00 15 5a b7 00 00 00 00 1d 10 3d 54
2e e4 37 c6 f8 ed e6 d7 c4 d6 02 e7
Notes:
The TCP checksum shown (0x400c) is wrong, it should be 0xa43c.
MAC:
a6 3f 0e cb bb 2e 63 5c 95 4d ea c7
4.2. HMAC-SHA-1-96 (Omits TCP Options)
4.2.1. Send (Client) SYN (Omits Options)
Client ISN = 0xcb0efbee
Send_SYN_traffic_key:
30 ea a1 56 0c f0 be 57 da b5 c0 45 22 9f b1 0a
42 3c d7 ea
IPv4/TCP:
45 e0 00 4c 53 99 40 00 ff 06 48 e2 0a 0b 0c 0d
ac 1b 1c 1d ff 12 00 b3 cb 0e fb ee 00 00 00 00
e0 02 ff ff c2 bf 00 00 02 04 05 b4 01 03 03 08
04 02 08 0a 00 02 4c ce 00 00 00 00 1d 10 3d 54
80 af 3c fe b8 53 68 93 7b 8f 9e c2
EID 7036 (Verified) is as follows:Section: 4.2.1
Original Text:
IPv4/TCP:
45 e0 00 4c 53 99 40 00 ff 06 48 e2 0a 0b 0c 0d
ac 1b 1c 1d ff 12 00 b3 cb 0e fb ee 00 00 00 00
e0 02 ff ff 54 1f 00 00 02 04 05 b4 01 03 03 08
04 02 08 0a 00 02 4c ce 00 00 00 00 1d 10 3d 54
80 af 3c fe b8 53 68 93 7b 8f 9e c2
Corrected Text:
IPv4/TCP:
45 e0 00 4c 53 99 40 00 ff 06 48 e2 0a 0b 0c 0d
ac 1b 1c 1d ff 12 00 b3 cb 0e fb ee 00 00 00 00
e0 02 ff ff c2 bf 00 00 02 04 05 b4 01 03 03 08
04 02 08 0a 00 02 4c ce 00 00 00 00 1d 10 3d 54
80 af 3c fe b8 53 68 93 7b 8f 9e c2
Notes:
The TCP checksum shown (0x541f) is wrong, it should be 0xc2bf.
MAC:
80 af 3c fe b8 53 68 93 7b 8f 9e c2
4.2.2. Receive (Server) SYN-ACK (Omits Options)
Server ISN = 0xacd5b5e1
Receive_SYN_traffic_key:
b5 b2 89 6b b3 66 4e 81 76 b0 ed c6 e7 99 52 41
01 a8 30 7f
EID 9294 (Verified) is as follows:Section: 4.2.2
Original Text:
Receive_SYN_traffic_key:
b5 b2 89 6b b3 66 4e 81 76 b0 ed c6 e7 99 52 41a
01 a8 30 7f
Corrected Text:
Receive_SYN_traffic_key:
b5 b2 89 6b b3 66 4e 81 76 b0 ed c6 e7 99 52 41
01 a8 30 7f
Notes:
The 16th octet of the Receive_SYN_traffic_key is printed with three hex digits ("41a"). The correct value is 0x41. With 0x41, the key equals KDF_HMAC_SHA1 of the Master_Key "testvector" and the connection context given in this section, and the MAC listed in the same section (09 30 6f 9a ce a6 3a 8c 68 cb 9a 70) verifies over the packet shown. The other candidate readings (0x4a, 0x1a, 0xa4) do not reproduce that MAC. This is independent of erratum 7038, which corrects only this section's TCP checksum.
Notes:
The TCP checksum shown (0x46b6) is wrong, it should be 0x458c.
MAC:
97 76 6e 48 ac 26 2d e9 ae 61 b4 f9
5. IPv4 AES-128 Output Test Vectors
The AES-128 KDF and MAC algorithms, KDF_AES_128_CMAC and AES-128-
CMAC-96, are computed as specified for TCP-AO [RFC5926].
In the following sections, all values are indicated as 2-digit
hexadecimal values with spacing per line representing the contents of
16 consecutive bytes, as is typical for data dumps. The IP/TCP data
indicates the entire IP packet, including the TCP segment and its
options (whether covered by TCP-AO or not, as indicated), including
TCP-AO.
5.1. AES-128-CMAC-96 (Default - Covers TCP Options)
5.1.1. Send (Client) SYN (Covers Options)
Client ISN = 0x787a1ddf
Send_SYN_traffic_key:
f5 b8 b3 d5 f3 4f db b6 eb 8d 4a b9 66 0e 60 e3
IP/TCP:
45 e0 00 4c 7b 9f 40 00 ff 06 20 dc 0a 0b 0c 0d
ac 1b 1c 1d c4 fa 00 b3 78 7a 1d df 00 00 00 00
e0 02 ff ff 46 41 00 00 02 04 05 b4 01 03 03 08
04 02 08 0a 00 01 7e d0 00 00 00 00 1d 10 3d 54
e4 77 e9 9c 80 40 76 54 98 e5 50 91