On the Generation of Transient Numeric Identifiers
draft-irtf-pearg-numeric-ids-generation-00
Internet Research Task Force (IRTF) F. Gont
Internet-Draft SI6 Networks
Intended status: Best Current Practice I. Arce
Expires: February 24, 2020 Quarkslab
August 23, 2019
On the Generation of Transient Numeric Identifiers
draft-irtf-pearg-numeric-ids-generation-00
Abstract
This document performs an analysis of the security and privacy
implications of different types of "numeric identifiers" used in IETF
protocols, and tries to categorize them based on their
interoperability requirements and the associated failure severity
when such requirements are not met. Subsequently, it provides advice
on possible algorithms that could be employed to satisfy the
interoperability requirements of each identifier type, while
minimizing the security and privacy implications, thus providing
guidance to protocol designers and protocol implementers. Finally,
this describes a number of algorithms that have been employed in real
implementations to generate transient numeric identifiers and
analyzes their security and privacy properties.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on February 24, 2020.
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
Gont & Arce Expires February 24, 2020 [Page 1]
Internet-Draft Generation of Transient Numeric IDs August 2019
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Threat Model . . . . . . . . . . . . . . . . . . . . . . . . 5
4. Issues with the Specification of Identifiers . . . . . . . . 5
5. Protocol Failure Severity . . . . . . . . . . . . . . . . . . 6
6. Categorizing Identifiers . . . . . . . . . . . . . . . . . . 6
7. Common Algorithms for Identifier Generation . . . . . . . . . 8
7.1. Category #1: Uniqueness (soft failure) . . . . . . . . . 8
7.2. Category #2: Uniqueness (hard failure) . . . . . . . . . 10
7.3. Category #3: Uniqueness, constant within context (soft-
failure) . . . . . . . . . . . . . . . . . . . . . . . . 10
7.4. Category #4: Uniqueness, monotonically increasing within
context (hard failure) . . . . . . . . . . . . . . . . . 12
8. Common Vulnerabilities Associated with Transient Numeric
Identifiers . . . . . . . . . . . . . . . . . . . . . . . . . 17
8.1. Network Activity Correlation . . . . . . . . . . . . . . 17
8.2. Information Leakage . . . . . . . . . . . . . . . . . . . 17
8.3. Exploitation of Semantics of Transient Numeric
Identifiers . . . . . . . . . . . . . . . . . . . . . . . 19
8.4. Exploitation of Collisions of Transient Numeric
Identifiers . . . . . . . . . . . . . . . . . . . . . . . 19
9. Vulnerability Analysis of Specific Transient Numeric
Identifiers Categories . . . . . . . . . . . . . . . . . . . 19
9.1. Category #1: Uniqueness (soft failure) . . . . . . . . . 19
9.2. Category #2: Uniqueness (hard failure) . . . . . . . . . 20
9.3. Category #3: Uniqueness, constant within context (soft
failure) . . . . . . . . . . . . . . . . . . . . . . . . 20
9.4. Category #4: Uniqueness, monotonically increasing within
context (hard failure) . . . . . . . . . . . . . . . . . 20
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22
Show full document text