Defending against Sequence Number Attacks

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 12
Abstract: This document specifies an algorithm for the generation of TCP Initial Sequence Numbers (ISNs), such that the chances of an off-path attacker guessing the sequence numbers in use by a target connection are reduced. This document revises (and formally obsoletes) RFC 1948, and takes the ISN generation algorithm originally proposed in that document to Standards Track, formally updating RFC 793. [STANDARDS-TRACK]
Publication Date: 2012-02-01
Status Note: Proposed Standard
DOI: 10.17487/RFC6528
Link: https://doi.org/10.17487/RFC6528
Author(s): Fernando Gont
Steven Bellovin
Keyword(s): TCP Security

Latest version of IETF RFC 6528

Document Versions — IETF RFC 6528

▶ IETF RFC 6528 (2012-02-01)

THIS DOC [SUPERSEDED] [LATEST VERSION]

Superseded by:

IETF RFC 9293 [Active*]

Normative Reference(s)

IETF RFC 793 [Superseded*]
IETF RFC 1321 [Active*]
IETF RFC 1323 [Superseded*]
IETF RFC 2119 [Active*]
IETF RFC 4086 [Active*]
RFC6056 — RFC6056 EXTERNAL

Bibliographic Reference(s)

CERT, "CERT Advisory CA-2001-09: Statistical Weaknesses in TCP/IP Initial Sequence Numbers", http://www.cert.org/advisories/CA-2001-09.html , 2001. EXTERNAL
Shimomura, T., "Technical details of the attack described by Markoff in NYT", http://www.gont.com.ar/docs/post-shimomura- usenet.txt , Message posted in USENET's comp.security.misc newsgroup, Message-ID: <3g5gkl$5j1@ariel.sdsc.edu>, 1995. EXTERNAL
Morris, R., "Security Problems in the TCP/IP Protocol Suite", Computer Communications Review, vol. 19, no. 2, pp. 32-48, 1989. EXTERNAL
CPNI, "Security Assessment of the Transmission Control Protocol (TCP)", http://www.gont.com.ar/ papers/tn-03-09-security-assessment-TCP.pdf , 2009. EXTERNAL
Morris, R., "A Weakness in the 4.2BSD UNIX TCP/IP Software", CSTR 117, AT&T Bell Laboratories, Murray Hill, NJ, 1985. EXTERNAL
Gont, F. and P. Srisuresh, "Security implications of Network Address Translators (NATs)", Work in Progress, October 2009. EXTERNAL
US-CERT, "US-CERT Vulnerability Note VU#498440: Multiple TCP/IP implementations may use statistically predictable initial sequence numbers", http://www.kb.cert.org/vuls/id/498440 , 2001. EXTERNAL
Wright, G. and W. Stevens, "TCP/IP Illustrated, Volume 2: The Implementation", Addison-Wesley, 1994. EXTERNAL
Silbersack, M., "Improving TCP/IP security through randomization without sacrificing interoperability", EuroBSDCon 2005 Conference. EXTERNAL
Joncheray, L., "A Simple Active Attack Against TCP", Proc. Fifth Usenix UNIX Security Symposium, 1995. EXTERNAL
Zalewski, M., "Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later", http://lcamtuf.coredump.cx/newtcp/ , 2002. EXTERNAL
Zalewski, M., "Strange Attractors and TCP/IP Sequence Number Analysis", http://lcamtuf.coredump.cx/oldtcp/tcpseq.html , 2001. EXTERNAL
IETF RFC 854 [Active*]
IETF RFC 1034 [Active*]
IETF RFC 1948 [Superseded*]
IETF RFC 3022 [Active*]
IETF RFC 4120 [Active*]
IETF RFC 4251 [Active*]
IETF RFC 4301 [Active, Amended*]
IETF RFC 4954 [Active*]
IETF RFC 5321 [Active*]
IETF RFC 5925 [Active*]
IETF RFC 5936 [Active*]
IETF RFC 6151 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6528.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6528, Defending against Sequence Number Attacks. Available at https://doi.org/10.17487/RFC6528

Snippet:

IETF RFC 6528, Defending against Sequence Number Attacks. Available at https://doi.org/10.17487/RFC6528

HTML (ISO 690 compliant)

Preview:

IETF RFC 6528, Defending against Sequence Number Attacks. Available at https://doi.org/10.17487/RFC6528

Snippet:

<span class="citation"><cite>IETF RFC 6528</cite>, Defending against Sequence Number Attacks. Available at <a href="https://doi.org/10.17487/RFC6528" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6528</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6528, Defending against Sequence Number Attacks
doi: 10.17487/RFC6528
url: https://doi.org/10.17487/RFC6528

Snippet:

<li>
<cite id="bib-rfc6528">IETF RFC 6528</cite>, Defending against Sequence Number Attacks
<span class="doi">10.17487/RFC6528</span>
</li>

Referenced By

IETF RFC 7011 [Active*]
IETF RFC 7323 [Active*]
IETF RFC 9293 [Active*]
IETF RFC 9416 [Active*]