On the Generation of Transient Numeric Identifiers

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 37
Abstract: This document performs an analysis of the security and privacy implications of different types of "transient numeric identifiers" used in IETF protocols and tries to categorize them based on their interoperability requirements and their associated failure severity when such requirements are not met. Subsequently, it provides advice on possible algorithms that could be employed to satisfy the interoperability requirements of each identifier category while minimizing the negative security and privacy implications, thus providing guidance to protocol designers and protocol implementers. Finally, it describes a number of algorithms that have been employed in real implementations to generate transient numeric identifiers and analyzes their security and privacy properties. This document is a product of the Privacy Enhancements and Assessments Research Group (PEARG) in the IRTF.
Publication Date: 2023-07-01
Status Note: Informational
DOI: 10.17487/RFC9415
Link: https://doi.org/10.17487/RFC9415
Author(s): Fernando Gont
Ivan Arce
Keyword(s): Security, Vulnerability, Algorithm, Fingerprinting

Latest version of IETF RFC 9415

Document Versions — IETF RFC 9415

▶ IETF RFC 9415 (2023-07-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 791 [Active*]
IETF RFC 793 [Superseded*]
IETF RFC 1035 [Active, Amended*]
IETF RFC 1321 [Active*]
IETF RFC 2460 [Superseded*]
IETF RFC 4086 [Active*]
IETF RFC 4291 [Active*]
IETF RFC 4862 [Active*]
IETF RFC 5722 [Active*]
IETF RFC 5905 [Active*]
IETF RFC 5925 [Active*]
IETF RFC 6056 [Active*]
IETF RFC 6151 [Active*]
IETF RFC 6191 [Active*]
IETF RFC 6437 [Active*]
IETF RFC 6528 [Superseded*]
IETF RFC 7217 [Active*]
IETF RFC 7323 [Active*]
IETF RFC 8064 [Active*]
IETF RFC 8200 [Active*]
IETF RFC 8981 [Active*]
IETF RFC 9293 [Active*]

Bibliographic Reference(s)

10.1109-IEEESTD.2018.8277153 — POSIX EXTERNAL
10.48550-arXiv.1906.10478 — IPID-DEV EXTERNAL
GITHUB.veorq.SipHash — SipHash EXTERNAL
ISBN.158113603X — Bellovin2002 EXTERNAL
ISBN.0521431085 — PTVF92 EXTERNAL
ISBN.1593278268 — Aumasson2018 EXTERNAL
ISO 9899: 2018 [Active]
NIST FIPS 180-4 [Active]
PaX Team, "Address Space Layout Randomization", <https://pax.grsecurity.net/docs/aslr.txt>. EXTERNAL
"BLAKE3: one function, fast everywhere", September 2022, <https://blake3.io/>. EXTERNAL
TBIT, "TBIT, the TCP Behavior Inference Tool", 2001, <https://www.icir.org/tbit/>. EXTERNAL
EFF, "Cover your tracks: See how trackers view your browser", <https://coveryourtracks.eff.org/>. EXTERNAL
Bellovin, S., "Security Problems in the TCP/IP Protocol Suite", Computer Communications Review, Vol. 19, No. 2, pp. 32-48, April 1989, <https://www.cs.columbia.edu/~smb/papers/ipext.pdf>. EXTERNAL
Fyodor, "Remote OS detection via TCP/IP Stack FingerPrinting", Phrack Magazine, Volume 8, Issue 54, December 1998, <http://www.phrack.org/archives/issues/54/9.txt>. EXTERNAL
IANA, "Protocol Registries", <https://www.iana.org/protocols>. EXTERNAL
Lyon, G., "Chapter 8. Remote OS Detection", January 2009, <https://nmap.org/book/osdetect.html>. EXTERNAL
Schuba, C., "Addressing Weakness in the Domain Name System Protocol", August 1993, <http://ftp.cerias.purdue.edu/pub/papers/christoph-schuba/schuba-DNS-msthesis.pdf>. EXTERNAL
OpenBSD, "arc4random(3)", Library Functions Manual, September 2019, <https://man.openbsd.org/arc4random>. EXTERNAL
Linux, "getentropy(3)", Linux Programmer's Manual, March 2021, <https://man7.org/linux/man-pages/man3/getentropy.3.html>. EXTERNAL
Zalewski, M., "Strange Attractors and TCP/IP Sequence Number Analysis", April 2001, <https://lcamtuf.coredump.cx/oldtcp/tcpseq.html>. EXTERNAL
Shimomura, T., "Technical details of the attack described by Markoff in NYT", message to the USENET comp.security.misc newsgroup, 25 January 1995, <https://www.gont.com.ar/files/post-shimomura-usenet.txt>. EXTERNAL
Silbersack, M., "Improving TCP/IP security through randomization without sacrificing interoperability", EuroBSDCon 2005 Conference, <https://www.silby.com/eurobsdcon05/eurobsdcon_silbersack.pdf>. EXTERNAL
Romailler, Y., "The Definitive Guide to "Modulo Bias and How to Avoid It"!", Kudelski Security Research, July 2020, <https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/>. EXTERNAL
Sanfilippo, S., "new tcp scan method", message to the Bugtraq mailing list, 18 December 1998, <https://seclists.org/bugtraq/1998/Dec/79>. EXTERNAL
Sanfilippo, S., "more ip id", message to the Bugtraq mailing list, November 1999, <https://github.com/antirez/hping/raw/master/docs/MORE-FUN-WITH-IPID>. EXTERNAL
Sanfilippo, S., "about the ip header id", message to the Bugtraq mailing list, December 1998, <http://seclists.org/bugtraq/1998/Dec/48>. EXTERNAL
NVD, "Vulnerability Advisories for PRNGs", <https://www.gont.com.ar/miscellanea/prng-cves/>. EXTERNAL
Zalewski, M., "p0f v3 (3.09b)", <https://lcamtuf.coredump.cx/p0f.shtml>. EXTERNAL
Fyodor, "Idle Scanning and related IPID games", 2003, <https://nmap.org/presentations/CanSecWest03/CD_Content/idlescan_paper/idlescan.html>. EXTERNAL
Morris, R., "A Weakness in the 4.2BSD UNIX TCP/IP Software", CSTR 117, AT&T Bell Laboratories, Murray Hill, NJ, February 1985, <https://pdos.csail.mit.edu/~rtm/papers/117.pdf>. EXTERNAL
Centre for the Protection of National Infrastructure (CPNI), "Security Assessment of the Transmission Control Protocol (TCP)", CPNI Technical Note 3/2009, February 2009, <https://www.si6networks.com/files/publications/tn-03-09-security-assessment-TCP.pdf>. EXTERNAL
Knuth, D., "The Art of Computer Programming", Volume 2 (Seminumerical Algorithms), 2nd Ed., Reading, Massachusetts, Addison-Wesley Publishing Company, January 1981. EXTERNAL
McDanel, B., "TCP Timestamping - Obtaining System Uptime Remotely", message to the Bugtraq mailing list, March 2001, <https://seclists.org/bugtraq/2001/Mar/182>. EXTERNAL
Klein, A., "OpenBSD DNS Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability", November 2007, <https://dl.packetstormsecurity.net/papers/attack/OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP_ID_Vulnerability.pdf>. EXTERNAL
Zalewski, M., "Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later (2002)", <https://lcamtuf.coredump.cx/newtcp/>. EXTERNAL
nmap, "Nmap: Free Security Scanner For Network Exploration and Audit", 2020, <https://nmap.org/>. EXTERNAL
Joncheray, L., "Simple Active Attack Against TCP", Proceedings of the Fifth USENIX UNIX Security Symposium, June 1995, <https://www.usenix.org/legacy/publications/library/proceedings/security95/full_papers/joncheray.pdf>. EXTERNAL
IETF RFC 2104 [Active, Amended*]
IETF RFC 3971 [Active*]
IETF RFC 4953 [Active*]
IETF RFC 4963 [Active*]
IETF RFC 5927 [Active*]
IETF RFC 6194 [Active*]
IETF RFC 6274 [Active*]
IETF RFC 6973 [Active*]
IETF RFC 6980 [Active*]
RFC7098 — RFC7098 EXTERNAL
IETF RFC 7258 [Active*]
IETF RFC 7707 [Active*]
IETF RFC 7721 [Active*]
IETF RFC 7739 [Active*]
IETF RFC 8446 [Superseded*]
IETF RFC 8937 [Active*]
IETF RFC 9414 [Active*]
IETF RFC 9416 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9415.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9415, On the Generation of Transient Numeric Identifiers. Available at https://doi.org/10.17487/RFC9415

Snippet:

IETF RFC 9415, On the Generation of Transient Numeric Identifiers. Available at https://doi.org/10.17487/RFC9415

HTML (ISO 690 compliant)

Preview:

IETF RFC 9415, On the Generation of Transient Numeric Identifiers. Available at https://doi.org/10.17487/RFC9415

Snippet:

<span class="citation"><cite>IETF RFC 9415</cite>, On the Generation of Transient Numeric Identifiers. Available at <a href="https://doi.org/10.17487/RFC9415" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9415</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9415, On the Generation of Transient Numeric Identifiers
doi: 10.17487/RFC9415
url: https://doi.org/10.17487/RFC9415

Snippet:

<li>
<cite id="bib-rfc9415">IETF RFC 9415</cite>, On the Generation of Transient Numeric Identifiers
<span class="doi">10.17487/RFC9415</span>
</li>

Referenced By

IETF RFC 9414 [Active*]
IETF RFC 9416 [Active*]