Request for Comments: 3792 Nesser & Nesser Consulting
Category: Informational A. Bergstrom, Ed.
Ostfold University College
June 2004
Survey of IPv4 Addresses in Currently Deployed
IETF Security Area Standards Track and Experimental Documents
Status of this Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2004).
Abstract
This document seeks to document all usage of IPv4 addresses in
currently deployed IETF Security Area documented standards. In order
to successfully transition from an all IPv4 Internet to an all IPv6
Internet, many interim steps will be taken. One of these steps is
the evolution of current protocols that have IPv4 dependencies. It
is hoped that these protocols (and their implementations) will be
redesigned to be network address independent, but failing that will
at least dually support IPv4 and IPv6. To this end, all Standards
(Full, Draft, and Proposed) as well as Experimental RFCs will be
surveyed and any dependencies will be documented.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Document Organisation. . . . . . . . . . . . . . . . . . . . . 2
3. Full Standards . . . . . . . . . . . . . . . . . . . . . . . . 2
4. Draft Standards. . . . . . . . . . . . . . . . . . . . . . . . 2
5. Proposed Standards . . . . . . . . . . . . . . . . . . . . . . 8
6. Experimental RFCs. . . . . . . . . . . . . . . . . . . . . . . 20
7. Summary of Results . . . . . . . . . . . . . . . . . . . . . . 22
7.1. Standards. . . . . . . . . . . . . . . . . . . . . . . . 23
7.2. Draft Standards. . . . . . . . . . . . . . . . . . . . . 23
7.3. Proposed Standards . . . . . . . . . . . . . . . . . . . 23
7.4. Experimental RFCs. . . . . . . . . . . . . . . . . . . . 23
8. Security Considerations. . . . . . . . . . . . . . . . . . . . 24
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 24
10. Normative Reference. . . . . . . . . . . . . . . . . . . . . . 24
11. Authors’ Addresses . . . . . . . . . . . . . . . . . . . . . . 24
12. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 25
1.0. Introduction
This document is part of a document set aiming to document all usage
of IPv4 addresses in IETF standards. In an effort to have the
information in a manageable form, it has been broken into 7 documents
conforming to the current IETF areas (Application, Internet,
Operations and Management, Routing, Security, Sub-IP, and Transport).
For a full introduction, please see the introduction [1].
2.0. Document Organization
Sections 3, 4, 5, and 6 each describe the raw analysis of Full,
Draft, and Proposed Standards, and Experimental RFCs. Each RFC is
discussed in its turn starting with RFC 1 and ending with (around)
RFC 3100. The comments for each RFC are "raw" in nature. That is,
each RFC is discussed in a vacuum and problems or issues discussed do
not "look ahead" to see if the problems have already been fixed.
Section 7 is an analysis of the data presented in Sections 3, 4, 5,
and 6. It is here that all of the results are considered as a whole
and the problems that have been resolved in later RFCs are
correlated.
3.0. Full Standards
Full Internet Standards (most commonly simply referred to as
"Standards") are fully mature protocol specification that are widely
implemented and used throughout the Internet.
3.1. RFC 2289 A One-Time Password System
There are no IPv4 dependencies in this specification.
4.0. Draft Standards
Draft Standards represent the penultimate standard level in the IETF.
A protocol can only achieve draft standard when there are multiple,
independent, interoperable implementations. Draft Standards are
usually quite mature and widely used.
4.1. RFC 1864 The Content-MD5 Header Field
There are no IPv4 dependencies in this specification.
4.2. RFC 2617 HTTP Authentication: Basic and Digest Access
Authentication
Section 3.2.1 The WWW-Authenticate Response Header include he
following text:
(Note: including the IP address of the client in the nonce
would appear to offer the server the ability to limit the reuse
of the nonce to the same client that originally got it.
However, that would break proxy farms, where requests from a
single user often go through different proxies in the farm.
Also, IP address spoofing is not that hard.)
Section 4.5 Replay Attacks contains the text:
Thus, for some purposes, it is necessary to protect against
replay attacks. A good Digest implementation can do this in
various ways. The server created "nonce" value is
implementation dependent, but if it contains a digest of the
client IP, a time-stamp, the resource ETag, and a private
server key (as recommended above) then a replay attack is not
simple. An attacker must convince the server that the request
is coming from a false IP address and must cause the server to
deliver the document to an IP address different from the
address to which it believes it is sending the document. An
attack can only succeed in the period before the time-stamp
expires. Digesting the client IP and time-stamp in the nonce
permits an implementation which does not maintain state between
transactions.
Both of these statements are IP version independent and must rely on
the implementers discretion.
4.3. RFC 2865 Remote Authentication Dial In User Service (RADIUS)
Section 3. Packet Format has the following notes:
Identifier
The Identifier field is one octet, and aids in matching
requests and replies. The RADIUS server can detect a duplicate
request if it has the same client source IP address and source
UDP port and Identifier within a short span of time.
and
A RADIUS server MUST use the source IP address of the RADIUS
UDP packet to decide which shared secret to use, so that RADIUS
requests can be proxied.
This text is version neutral but implementers should allow for the
use of both IPv4 and IPv6 addresses.
Section 5. Attributes defines a number of IP specific attributes:
4 NAS-IP-Address
8 Framed-IP-Address
9 Framed-IP-Netmask
10 Framed-Routing
14 Login-IP-Host
22 Framed-Route
and definitions for the "value" field of the following type:
address 32 bit value, most significant octet first.
The attributes are further defined as follows:
5.4. NAS-IP-Address
Description
This Attribute indicates the identifying IP Address of the
NAS which is requesting authentication of the user, and
SHOULD be unique to the NAS within the scope of the RADIUS
server. NAS-IP-Address is only used in Access-Request
packets. Either NAS-IP-Address or NAS-Identifier MUST be
present in an Access-Request packet.
Note that NAS-IP-Address MUST NOT be used to select the
shared secret used to authenticate the request. The source
IP address of the Access-Request packet MUST be used to
select the shared secret.
A summary of the NAS-IP-Address Attribute format is shown
below. The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Address (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
4 for NAS-IP-Address.
Length
6
Address
The Address field is four octets.
5.8. Framed-IP-Address
Description
This Attribute indicates the address to be configured for the
user. It MAY be used in Access-Accept packets. It MAY be used
in an Access-Request packet as a hint by the NAS to the server
that it would prefer that address, but the server is not
required to honor the hint.
A summary of the Framed-IP-Address Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Address (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
8 for Framed-IP-Address.
Length
6
Address
The Address field is four octets. The value 0xFFFFFFFF indicates
that the NAS Should allow the user to select an address (e.g.,
Negotiated). The value 0xFFFFFFFE indicates that the NAS should
select an address for the user (e.g., Assigned from a pool of
addresses kept by the NAS). Other valid values indicate that the
NAS should use that value as the user’s IP address.
5.9. Framed-IP-Netmask
Description
This Attribute indicates the IP netmask to be configured for
the user when the user is a router to a network. It MAY be
used in Access-Accept packets. It MAY be used in an Access-
Request packet as a hint by the NAS to the server that it would
prefer that netmask, but the server is not required to honor
the hint.
A summary of the Framed-IP-Netmask Attribute format is shown below.
The fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Address (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
9 for Framed-IP-Netmask.
Length
6
Address
The Address field is four octets specifying the IP netmask of the
user.
5.14. Login-IP-Host
Description
"This Attribute indicates the system with which to connect the
user, when the Login-Service Attribute is included. It MAY be
used in Access-Accept packets. It MAY be used in an Access-
Request packet as a hint to the server that the NAS would
prefer to use that host, but the server is not required to
honor the hint."
A summary of the Login-IP-Host Attribute format is shown below. The
fields are transmitted from left to right.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Address (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
14 for Login-IP-Host.
Length
6
Address
The Address field is four octets. The value 0xFFFFFFFF indicates
that the NAS SHOULD allow the user to select an address. The
value 0 indicates that the NAS SHOULD select a host to connect the
user to. Other values indicate the address the NAS SHOULD connect
the user to.
5.22. Framed-Route
Description
This Attribute provides routing information to be configured
for the user on the NAS. It is used in the Access-Accept
packet and can appear multiple times.
A summary of the Framed-Route Attribute format is shown below. The
fields are transmitted from left to right.
0 1 2
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
| Type | Length | Text ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
Type
22 for Framed-Route.
Length
>= 3
Text
The Text field is one or more octets, and its contents are
implementation dependent. It is intended to be human readable and
MUST NOT affect operation of the protocol. It is recommended that
the message contain UTF-8 encoded 10646 [7] characters.
For IP routes, it SHOULD contain a destination prefix in dotted
quad form optionally followed by a slash and a decimal length
specifier stating how many high order bits of the prefix to use.
That is followed by a space, a gateway address in dotted quad
form, a space, and one or more metrics separated by spaces. For
example, "192.168.1.0/24 192.168.1.1 1 2 -1 3 400". The length
specifier may be omitted, in which case it defaults to 8 bits for
class A prefixes, 16 bits for class B prefixes, and 24 bits for
class C prefixes. For example, "192.168.1.0 192.168.1.1 1".
Whenever the gateway address is specified as "0.0.0.0" the IP
address of the user SHOULD be used as the gateway address.
There are also several example authentication sequences that use the
attributes discussed above and hence have IPv4 addresses.
Although the definitions in this RFC are limited to IPv4 addresses,
the specification is easily extensible for new attribute types. It
is therefore relatively simple to create new IPv6 specific
attributes.
5.0. Proposed Standards
Proposed Standards are introductory level documents. There are no
requirements for even a single implementation. In many cases
Proposed are never implemented or advanced in the IETF standards
process. They therefore are often just proposed ideas that are
presented to the Internet community. Sometimes flaws are exposed or
they are one of many competing solutions to problems. In these later
cases, no discussion is presented as it would not serve the purpose
of this discussion.
5.001. RFC 1413 Identification Protocol
There are no IPv4 dependencies in this specification.
5.002. RFC 1421 Privacy Enhancement for Internet Electronic Mail:
Part I
There are no IPv4 dependencies in this specification.
5.003. RFC 1422 Privacy Enhancement for Internet Electronic Mail:
Part II
There are no IPv4 dependencies in this specification.
5.004. RFC 1423 Privacy Enhancement for Internet Electronic Mail:
Part III
There are no IPv4 dependencies in this specification.
5.005. RFC 1424 Privacy Enhancement for Internet Electronic Mail:
Part IV
There are no IPv4 dependencies in this specification.
5.006. RFC 1510 The Kerberos Network Authentication Service (V5)
Although this specification specifies optional use of host
addresses, there are no specific requirements that the addresses
be IPv4. The specification has no IPv4 dependencies, but
implementations might have issues.
5.007. RFC 1731 IMAP4 Authentication Mechanisms
There are no IPv4 dependencies in this specification.
5.008. RFC 1734 POP3 AUTHentication command
There are no IPv4 dependencies in this specification.
5.009. RFC 1828 IP Authentication using Keyed MD5
There are no IPv4 dependencies in this specification. The
operations described operate on the entire IP packet without
specifying that the IP packet be IPv4 or IPv6.
5.010. RFC 1829 The ESP DES-CBC Transform
There are no IPv4 dependencies in this specification. The
operations described operate on the entire IP packet without
specifying that the IP packet be IPv4 or IPv6.
5.011. RFC 1847 Security Multiparts for MIME: Multipart/Signed and
Multipart/Encrypted
There are no IPv4 dependencies in this specification.
5.012. RFC 1848 MIME Object Security Services
There are no IPv4 dependencies in this specification.
5.013. RFC 1928 SOCKS Protocol Version
This specification is IPv6 aware and will function normally on
either IPv4 and IPv6.
5.014. RFC 1929 Username/Password Authentication for SOCKS V5
There are no IPv4 dependencies in this specification.
5.015. RFC 1961 GSS-API Authentication Method for SOCKS Version 5
There are no IPv4 dependencies in this specification.
5.016. RFC 1964 The Kerberos Version 5 GSS-API Mechanism
There are no IPv4 dependencies in this specification.
5.017. RFC 1968 The PPP Encryption Control Protocol (ECP)
There are no IPv4 dependencies in this specification.
5.018. RFC 2015 MIME Security with Pretty Good Privacy (PGP)
There are no IPv4 dependencies in this specification.
5.019. RFC 2025 The Simple Public-Key GSS-API Mechanism (SPKM)
There are no IPv4 dependencies in this specification.
5.020. RFC 2082 RIP-2 MD5 Authentication
This RFC documents a security mechanism for an IPv4 only routing
specification. It is expected that a similar (or better)
mechanism will be developed for RIPng.
5.021. RFC 2085 HMAC-MD5 IP Authentication with Replay Prevention
This document defines an IP version independent specification and
has no IPv4 dependencies.
5.022. RFC 2195 IMAP/POP AUTHorize Extension for Simple Challenge/
Response
There are no IPv4 dependencies in this specification.
5.023. RFC 2203 RPCSEC_GSS Protocol Specification
There are no IPv4 dependencies in this specification.
5.024. RFC 2222 Simple Authentication and Security Layer (SASL)
There are no IPv4 dependencies in this specification.
5.025. RFC 2228 FTP Security Extensions
There are no IPv4 dependencies in this specification.
5.026. RFC 2243 OTP Extended Responses
There are no IPv4 dependencies in this specification.
5.027. RFC 2245 Anonymous SASL Mechanism
There are no IPv4 dependencies in this specification.
5.028. RFC 2246 The TLS Protocol Version 1.0
There are no IPv4 dependencies in this specification.
5.029. RFC 2284 PPP Extensible Authentication Protocol (EAP)
There are no IPv4 dependencies in this specification.
5.030. RFC 2385 Protection of BGP Sessions via the TCP MD5
Signature Option
Although the specification enhancements have no IPv4 dependencies,
it is an update to an IPv4 only routing specification.
5.031. RFC 2401 Security Architecture for the Internet Protocol
This specification is both IPv4 and IPv6 aware.
5.032. RFC 2402 IP Authentication Header
This specification is both IPv4 and IPv6 aware.
5.033. RFC 2403 The Use of HMAC-MD5-96 within ESP and AH
There are no IPv4 dependencies in this specification.
5.034. RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH
There are no IPv4 dependencies in this specification.
5.035. RFC 2405 The ESP DES-CBC Cipher Algorithm With Explicit IV
There are no IPv4 dependencies in this specification.
5.036. RFC 2406 IP Encapsulating Security Payload (ESP)
This specification is both IPv4 and IPv6 aware.
5.037. RFC 2407 The Internet IP Security Domain of Interpretation
for ISAKMP
This specification is both IPv4 and IPv6 aware.
5.038. RFC 2408 Internet Security Association and Key Management
Protocol (ISAKMP)
This specification is both IPv4 and IPv6 aware.
5.039. RFC 2409 The Internet Key Exchange (IKE)
There are no IPv4 dependencies in this specification.
5.040. RFC 2410 The NULL Encryption Algorithm and Its Use With
IPsec
There are no IPv4 dependencies in this specification.
5.041. RFC 2419 The PPP DES Encryption Protocol, Version 2
(DESE-bis)
There are no IPv4 dependencies in this specification.
5.042. RFC 2420 The PPP Triple-DES Encryption Protocol (3DESE)
There are no IPv4 dependencies in this specification.
5.043. RFC 2440 OpenPGP Message Format
There are no IPv4 dependencies in this specification.
5.044. RFC 2444 The One-Time-Password SASL Mechanism