On the Generation of Transient Numeric Identifiers
draft-irtf-pearg-numeric-ids-generation-02
Internet Research Task Force (IRTF) F. Gont
Internet-Draft SI6 Networks
Intended status: Informational I. Arce
Expires: November 15, 2020 Quarkslab
May 14, 2020
On the Generation of Transient Numeric Identifiers
draft-irtf-pearg-numeric-ids-generation-02
Abstract
This document performs an analysis of the security and privacy
implications of different types of "numeric identifiers" used in IETF
protocols, and tries to categorize them based on their
interoperability requirements and the associated failure severity
when such requirements are not met. Subsequently, it provides advice
on possible algorithms that could be employed to satisfy the
interoperability requirements of each identifier category, while
minimizing the security and privacy implications, thus providing
guidance to protocol designers and protocol implementers. Finally,
this describes a number of algorithms that have been employed in real
implementations to generate transient numeric identifiers and
analyzes their security and privacy properties.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on November 15, 2020.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
Gont & Arce Expires November 15, 2020 [Page 1]
Internet-Draft Generation of Transient Numeric IDs May 2020
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Threat Model . . . . . . . . . . . . . . . . . . . . . . . . 5
4. Issues with the Specification of Identifiers . . . . . . . . 5
5. Protocol Failure Severity . . . . . . . . . . . . . . . . . . 6
6. Categorizing Identifiers . . . . . . . . . . . . . . . . . . 6
7. Common Algorithms for Transient Numeric Identifier Generation 9
7.1. Category #1: Uniqueness (soft failure) . . . . . . . . . 9
7.2. Category #2: Uniqueness (hard failure) . . . . . . . . . 11
7.3. Category #3: Uniqueness, stable within context (soft
failure) . . . . . . . . . . . . . . . . . . . . . . . . 12
7.4. Category #4: Uniqueness, monotonically increasing within
context (hard failure) . . . . . . . . . . . . . . . . . 13
8. Common Vulnerabilities Associated with Transient Numeric
Identifiers . . . . . . . . . . . . . . . . . . . . . . . . . 19
8.1. Network Activity Correlation . . . . . . . . . . . . . . 19
8.2. Information Leakage . . . . . . . . . . . . . . . . . . . 20
8.3. Exploitation of Semantics of Transient Numeric
Identifiers . . . . . . . . . . . . . . . . . . . . . . . 21
8.4. Exploitation of Collisions of Transient Numeric
Identifiers . . . . . . . . . . . . . . . . . . . . . . . 21
8.5. Cryptanalysis . . . . . . . . . . . . . . . . . . . . . . 21
9. Vulnerability Analysis of Specific Transient Numeric
Identifiers Categories . . . . . . . . . . . . . . . . . . . 22
9.1. Category #1: Uniqueness (soft failure) . . . . . . . . . 22
9.2. Category #2: Uniqueness (hard failure) . . . . . . . . . 23
9.3. Category #3: Uniqueness, stable within context (soft
failure) . . . . . . . . . . . . . . . . . . . . . . . . 23
9.4. Category #4: Uniqueness, monotonically increasing within
context (hard failure) . . . . . . . . . . . . . . . . . 23
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 25
11. Security Considerations . . . . . . . . . . . . . . . . . . . 25
12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 26
13. References . . . . . . . . . . . . . . . . . . . . . . . . . 26
Show full document text