Additional Security Algorithms For Use With TCP-AO

Introduction TCP end-points use the TCP Authentication Option (TCP-AO) to authenticate segments. TCP-AO relies upon:

A Master Key Tuple (MKT)
A Key Derivation Function (KDF)
A Message Authentication Code (MAC) algorithm

TCP-AO systems are configured with one or more MKTs for each connection that they protect. When a connection is associated with multiple MKTs, TCP-AO can rotate among them during the course of a TCP session. This facilitates dynamic key change and authentication algorithm agility. An MKT includes:

Two MKT identifiers, one used for sending and one used for receiving
A connection identifier (i.e., a TCP socket pair)
A master key (i.e., a shared secret)
A KDF
A MAC algorithm
A flag indicating whether TCP options other than TCP-AO are authenticated

The KDF generates a traffic key. Its inputs are:

A pseudorandom function (PRF) used to generate the traffic key
The master key
Context (i.e., A binary string containing information related to the connection)
Output length (i.e., the length of the traffic key, in bits)

The MAC algorithm produces a MAC. It is defined by:

The KDF algorithm used to generate the traffic key
The length of the traffic key, in bits
The length of the MAC, in bits

The following are inputs to the MAC Algorithm:

traffic key
message

TCP-AO systems include the MAC in the TCP-AO. They use the MAC to authenticate segments. specifies cryptographic algorithms for TCP-AO. It explains how to use KDF_HMAC_SHA1 and KDF_AES_128_CMAC as KDFs. It also explains how to use HMAC-SHA-1-96 and AES-128-CMAC-96 as MAC algorithms. This document specifies several new KDFs and MAC algorithms for TCP-AO. The KDFs and MAC algorithms defined in this document use stronger cryptography. According to , "Applications of HMAC can choose to truncate the output of HMAC by outputting the t leftmost bits of the HMAC computation for some parameter t". The algorithms described in this document truncate the output of HMAC to 128 bits (i.e., 16 bytes). Therefore, when they are encoded in TCP-AO, the TCP-AO consumes 20 bytes.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP14 when, and only when, they appear in all capitals, as shown here.

Updates to RFC 5926

Concrete KDFs

KDF_HMAC_SHA256 For KDF_HMAC_SHA256:

PRF for KDF_alg: HMAC-SHA256
Use: HMAC-SHA256(Key, Input).
Input: ( i || Label || Context || Output_Length)
Key: Master_Key, configured by user, and passed to the KDF
Output_Length: 256 bits
Result: Traffic_Key, used in the MAC function by TCP-AO

KDF_HMAC_SHA384 For KDF_HMAC_SHA384:

PRF for KDF_alg: HMAC-SHA384
Use: HMAC-SHA384(Key, Input).
Input: ( i || Label || Context || Output_Length)
Key: Master_Key, configured by user, and passed to the KDF
Output_Length: 384 bits
Result: Traffic_Key, used in the MAC function by TCP-AO

KDF_HMAC_SHA512 For KDF_HMAC_SHA512:

PRF for KDF_alg: HMAC-SHA512
Use: HMAC-SHA512(Key, Input).
Input: ( i || Label || Context || Output_Length)
Key: Master_Key, configured by user, and passed to the KDF
Output_Length: 224 bits
Result: Traffic_Key, used in the MAC function by TCP-AO

KDF_HMAC_SHA3-256 For KDF_HMAC_SHA3-256:

PRF for KDF_alg: HMAC-SHA3-256
Use: HMAC-SHA3-256(Key, Input).
Input: ( i || Label || Context || Output_Length)
Key: Master_Key, configured by user, and passed to the KDF
Output_Length: 256 bits
Result: Traffic_Key, used in the MAC function by TCP-AO

KDF_HMAC_SHA3-384 For KDF_HMAC_SHA3-384:

PRF for KDF_alg: HMAC-SHA3-384
Use: HMAC-SHA3-384(Key, Input).
Input: ( i || Label || Context || Output_Length)
Key: Master_Key, configured by user, and passed to the KDF
Output_Length: 384 bits
Result: Traffic_Key, used in the MAC function by TCP-AO

KDF_HMAC_SHA3-512 For KDF_HMAC_SHA3-512:

PRF for KDF_alg: HMAC-SHA3-512
Use: HMAC-SHA3-512(Key, Input).
Input: ( i || Label || Context || Output_Length)
Key: Master_Key, configured by user, and passed to the KDF
Output_Length: 512 bits
Result: Traffic_Key, used in the MAC function by TCP-AO

MAC Algorithms The following subsections should be added to Section 3.2 of .

The Use of HMAC-SHA256-128 By definition, HMAC requires a cryptographic hash function. SHA256 will be that hash function used for authenticating and providing integrity validation on TCP segments with HMAC. The three fixed elements for HMAC-SHA256-128 are:

KDF_Alg: KDF_HMAC_SHA256
Key_Length: 256 bits.
MAC_Length: 128 bits.

For:

MAC = MAC_alg (Traffic_Key, Message)

HMAC-SHA256-128 for TCP-AO has the following values:

MAC_alg: HMAC-SHA256
Traffic_Key: Variable; the result of the KDF.
Message: The message to be authenticated, as specified in , Section 5.1.

The Use of HMAC-SHA384-128 By definition, HMAC requires a cryptographic hash function. SHA384 will be that hash function used for authenticating and providing integrity validation on TCP segments with HMAC. The three fixed elements for HMAC-SHA384-128 are:

KDF_Alg: KDF_HMAC_SHA384
Key_Length: 384 bits.
MAC_Length: 128 bits.

For:

MAC = MAC_alg (Traffic_Key, Message)

HMAC-SHA384-128 for TCP-AO has the following values:

MAC_alg: HMAC-SHA384
Traffic_Key: Variable; the result of the KDF.
Message: The message to be authenticated, as specified in , Section 5.1.

The Use of HMAC-SHA512-128 By definition, HMAC requires a cryptographic hash function. SHA512 will be that hash function used for authenticating and providing integrity validation on TCP segments with HMAC. The three fixed elements for HMAC-SHA512-128 are:

KDF_Alg: KDF_HMAC_SHA512
Key_Length: 512 bits.
MAC_Length: 128 bits.

For:

MAC = MAC_alg (Traffic_Key, Message)

HMAC-SHA512-128 for TCP-AO has the following values:

MAC_alg: HMAC-SHA512
Traffic_Key: Variable; the result of the KDF.
Message: The message to be authenticated, as specified in , Section 5.1.

The Use of HMAC-SHA3-256-128 By definition, HMAC requires a cryptographic hash function. SHA3-256 will be that hash function used for authenticating and providing integrity validation on TCP segments with HMAC. The three fixed elements for HMAC-SHA3-256-128 are:

KDF_Alg: KDF_HMAC_SHA3-256.
Key_Length: 256 bits.
MAC_Length: 128 bits.

For:

MAC = MAC_alg (Traffic_Key, Message)

HMAC-SHA3-256-128 for TCP-AO has the following values:

MAC_alg: HMAC-SHA3-256.
Traffic_Key: Variable; the result of the KDF.
Message: The message to be authenticated, as specified in , Section 5.1.

The Use of HMAC-SHA3-384-128 By definition, HMAC requires a cryptographic hash function. SHA3-384 will be that hash function used for authenticating and providing integrity validation on TCP segments with HMAC. The three fixed elements for HMAC-SHA3-384-128 are:

KDF_Alg: KDF_HMAC_SHA3-384.
Key_Length: 384 bits.
MAC_Length: 128 bits.

For:

MAC = MAC_alg (Traffic_Key, Message)

HMAC-SHA3-384-128 for TCP-AO has the following values:

MAC_alg: HMAC-SHA3-384.
Traffic_Key: Variable; the result of the KDF.
Message: The message to be authenticated, as specified in , Section 5.1.

The Use of HMAC-SHA3-512-128 By definition, HMAC requires a cryptographic hash function. SHA3-512 will be that hash function used for authenticating and providing integrity validation on TCP segments with HMAC. The three fixed elements for HMAC-SHA3-224-128 are:

KDF_Alg: KDF_HMAC_SHA3-512.
Key_Length: 512 bits.
MAC_Length: 128 bits.

For:

MAC = MAC_alg (Traffic_Key, Message)

HMAC-SHA3-512-128 for TCP-AO has the following values:

MAC_alg: HMAC-SHA3-512.
Traffic_Key: Variable; the result of the KDF.
Message: The message to be authenticated, as specified in , Section 5.1.

Security Considerations According to , "Applications of HMAC can choose to truncate the output of HMAC by outputting the t leftmost bits of the HMAC computation for some parameter t". The algorithms described in this document truncate the output of HMAC to 128 bits (i.e., 16 bytes). Therefore, when they are encoded in TCP-AO, the TCP-AO consumes 20 bytes. continues, "We recommend that the output length t be not less than half the length of the hash output (to match the birthday attack bound) and not less than 80 bits (a suitable lower bound on the number of bits that need to be predicted by an attacker). In this document, only the following MAC algorithms comply with that recommendation:

HMAC-SHA256-128
HMAC-SHA3-256-128

IANA Considerations IANA is requested to add the following entries to the "Cryptographic Algorithms for TCP-AO Registration" (https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-parameters-3). IANA Actions

Algorithm	Reference
SHA256-128	This Document
SHA384-128	This Document
SHA512-128	This Document
SHA3-256-128	This Document
SHA3-384-128	This Document
SHA3-512-128	This Document

Acknowledgements Thanks to Lars Eggert, Gorry Fairhurst, C.M. Heard, Russ Housley, John Mattsson, Yoshifumi Nishida, Joe Touch, Michael Tuxen, and Magnus Westerlund for their review and comments.