API Build-data JSON Resources
Theme

Choose how MSRBot.io looks on this device.

Auto (match system) Light mode Dark mode

Preference is stored in this browser only.

IETF RFC 5925
[ACTIVE]

The TCP Authentication Option

Metadata

Publisher
IETF
Doc Type
Standard
Pages
48
Abstract
This document specifies the TCP Authentication Option (TCP-AO), which obsoletes the TCP MD5 Signature option of RFC 2385 (TCP MD5). TCP-AO specifies the use of stronger Message Authentication Codes (MACs), protects against replays even for long-lived TCP connections, and provides more details on the association of security with TCP connections than TCP MD5. TCP-AO is compatible with either a static Master Key Tuple (MKT) configuration or an external, out-of-band MKT management mechanism; in either case, TCP-AO also protects connections when using the same MKT across repeated instances of a connection, using traffic keys derived from the MKT, and coordinates MKT changes between endpoints. The result is intended to support current infrastructure uses of TCP MD5, such as to protect long-lived connections (as used, e.g., in BGP and LDP), and to support a larger set of MACs with minimal other system and operational changes. TCP-AO uses a different option identifier than TCP MD5, even though TCP-AO and TCP MD5 are never permitted to be used simultaneously. TCP-AO supports IPv6, and is fully compatible with the proposed requirements for the replacement of TCP MD5. [STANDARDS-TRACK]
Publication Date
2010-06-01
Status Note
Proposed Standard
DOI
10.17487/RFC5925
Link
https://doi.org/10.17487/RFC5925
Author(s)
Dr. Joseph D. Touch
Allison J. Mankin
Ron Bonica
Keyword(s)
TCP, BGP, Digest, Algorithm
Latest version of IETF RFC 5925

Document Versions — IETF RFC 5925

  • ▶ IETF RFC 5925 (2010-06-01)
    THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

Bibliographic Reference(s)

  • Touch, J., "A TCP Authentication Option NAT Extension" , Work in Progress, January 2010. EXTERNAL
  • Savage, S., N. Cardwell, D. Wetherall, T. Anderson, "TCP Congestion Control with a Misbehaving Receiver", ACM Computer Communications Review, V29, N5, pp71-78, October 1999. EXTERNAL
  • Bashyam, M., Jethanandani, M., and A. Ramaiah "Clarification of sender behaviour in persist condition", Work in Progress, January 2010. EXTERNAL
  • Gont, F., "ICMP Attacks against TCP" , Work in Progress, March 2010. EXTERNAL
  • Lepinski, M. and S. Kent, "An Infrastructure to Support Secure Internet Routing", Work in Progress, October 2009. EXTERNAL
  • Wang, X., H. Yu, "How to break MD5 and other hash functions", Proc. IACR Eurocrypt 2005, Denmark, pp.19-35. EXTERNAL
  • Bonica, R., Weis, B., Viswanathan, S., Lange, A., and O. Wheeler, "Authentication for TCP-based Routing and Management Protocols", Work in Progress, February 2007. EXTERNAL
  • Borman, D., "TCP Options and MSS" , Work in Progress, July 2009. EXTERNAL
  • Secure Data Network Systems, "Security Protocol 4 (SP4)", Specification SDN.401, Revision 1.2, July 12, 1988. EXTERNAL
  • Eddy, W., Ed., Bellovin, S., Touch, J., and R. Bonica, "Problem Statement and Requirements for a TCP Authentication Option", Work in Progress, July 2007. EXTERNAL
  • Weis, B., Appanna, C., McGrew, D., and A. Ramaiah, "TCP Message Authentication Code Option", Work in Progress, December 2005. EXTERNAL
  • Touch, J. and A. Mankin, "The TCP Simple Authentication Option", Work in Progress, July 2007. EXTERNAL
  • Larsen, M. and F. Gont, "Transport Protocol Port Randomization Recommendations", Work in Progress, April 2010. EXTERNAL
  • IETF RFC 1321 [Active*]
  • IETF RFC 1323 [Superseded*]
  • IETF RFC 1948 [Superseded*]
  • IETF RFC 2104 [Active, Amended*]
  • IETF RFC 2663 [Active*]
  • IETF RFC 3234 [Active*]
  • IETF RFC 3562 [Active*]
  • IETF RFC 3947 [Active*]
  • IETF RFC 4301 [Active, Amended*]
  • RFC4808 — RFC4808 EXTERNAL
  • RFC4953 — RFC4953 EXTERNAL
  • IETF RFC 5246 [Superseded*]
Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC5925.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree
Reference this Doc

Plain text (ISO 690 compliant)

Preview:
IETF RFC 5925, The TCP Authentication Option. Available at https://doi.org/10.17487/RFC5925
Snippet:
IETF RFC 5925, The TCP Authentication Option. Available at https://doi.org/10.17487/RFC5925

HTML (ISO 690 compliant)

Preview:
IETF RFC 5925, The TCP Authentication Option. Available at https://doi.org/10.17487/RFC5925
Snippet:
<span class="citation"><cite>IETF RFC 5925</cite>, The TCP Authentication Option. Available at <a href="https://doi.org/10.17487/RFC5925" target="_blank" rel="noopener">https://doi.org/10.17487/RFC5925</a></span>

SMPTE Icon SMPTE's HTML Pub

Preview:
IETF RFC 5925, The TCP Authentication Option
doi: 10.17487/RFC5925
url: https://doi.org/10.17487/RFC5925
Snippet:
<li>
<cite id="bib-rfc5925">IETF RFC 5925</cite>, The TCP Authentication Option
<span class="doi">10.17487/RFC5925</span>
</li>

Referenced By