Telnet Data Encryption Option
Extracted elements (23)
A promising future direction is anonymous Diffie-Hellman mode of TLS followed by the telnet AUTHENTICATION option, where the authentication mechanism would include client and server finished messages computed during TLS negotiation, addressing the integrity gap.
None of the encryption mechanisms under this option provide data integrity due to the complexity of specifying integrity services efficiently in a stream-oriented protocol. Future work should examine TELNET START_TLS, which provides confidentiality, integrity, and compression.
If a START is received and then a second START is received before an END, the second START is ignored. If WONT ENCRYPT is received while encrypted data is being received, it implies receipt of an ENCRYPT END command.
If the receiver of the SUPPORT command does not support any listed encryption types, it should send 'IAC SB ENCRYPT IS NULL IAC SE' to indicate no common types, and may also send IAC WONT ENCRYPT to disable the option.
If ENCRYPT is negotiated in conjunction with AUTH, the SUPPORT message MUST NOT be sent until after the session key has been determined, because it is impossible to know if the selected encryption type can be properly initialized without knowing the key type and length.
If encryption is requested by the user and the client is unable to negotiate enabling or re-enabling encryption, the client MUST immediately terminate the telnet connection, as it must assume an active attack is in progress.
Once the Encryption option is in effect, all data in the negotiated direction, including TELNET options, is encrypted. Encryption begins with the octet immediately following the START command and ends after the END command.
Once two hosts exchange WILL and DO, the sender of DO ENCRYPT must send an ENCRYPT SUPPORT command to inform the remote side which encryption types it will accept.
The ENCRYPT option must be negotiated in both directions. WILL and DO are used only at connection start to obtain and grant permission for future negotiations.
The order of encryption types in a SUPPORT command must indicate preference, with the first type being most preferred and the last type least preferred.
ENC_KEYID and DEC_KEYID commands are used to negotiate a common encryption key identifier. If keyid is omitted in either command, it signals that no more known keyids exist and the attempt to find a common keyid has failed.
IAC SB ENCRYPT END IAC SE signals that all subsequent data will not be encrypted. IAC SB ENCRYPT REQUEST-START and REQUEST-END allow the DO ENCRYPT side to request the remote side start or stop encryption.
IAC SB ENCRYPT IS encryption-type ... IAC SE is sent by the WILL ENCRYPT side to specify the encryption type to use and any initial data needed for initialization.
IAC SB ENCRYPT REPLY encryption-type ... IAC SE is sent by the DO ENCRYPT side to continue the initial data exchange for initializing the encryption scheme.
IAC SB ENCRYPT START keyid IAC SE signals that all subsequent data in the stream will be encrypted. The keyid field is variable length, encoded most-significant-byte first, must be at least one byte long, and value zero is reserved for the default encryption key. Only WILL ENCRYPT side may send START.
IAC SB ENCRYPT SUPPORT encryption-type-list IAC SE is sent by the DO ENCRYPT side to declare which encryption types it will accept. The list must only include types supportable in the current session.
IAC WILL ENCRYPT indicates the sender is willing to send encrypted data; IAC WONT ENCRYPT refuses. IAC DO ENCRYPT indicates willingness to receive encrypted data; IAC DONT ENCRYPT refuses.
The default specification for the ENCRYPT option is WONT ENCRYPT / DONT ENCRYPT, meaning no encryption of the Telnet data stream by default.
The ENCRYPT option is assigned command code 38. It defines sub-commands IS (0), SUPPORT (1), REPLY (2), START (3), END (4), REQUEST-START (5), REQUEST-END (6), ENC_KEYID (7), and DEC_KEYID (8).
Encryption type numbers are assigned by IANA under a First Come First Served policy per RFC 2434. Defined types include NULL (0), DES_CFB64 (1), DES_OFB64 (2), DES3_CFB64 (3), DES3_OFB64 (4), CAST5_40_CFB64 (8), CAST5_40_OFB64 (9), CAST128_CFB64 (10), CAST128_OFB64 (11). If over 50% of the 8-bit space becomes allocated, IANA shall refer requests to IESG or a designated expert.
The ENCRYPT option used in isolation provides protection only against passive attacks (eavesdropping), not active attacks. An attacker able to modify packets in flight could prevent the ENCRYPT option from being negotiated at all.
Using the Telnet Authentication option alongside ENCRYPT and setting ENCRYPT_USING_TELOPT in the authentication-type-pair can force encryption negotiation even against active attacks.
The keyid field in START and REQUEST-START commands is variable length, encoded with the most significant byte first. A keyid value of zero indicates the default encryption key. The field must be at least one byte long. Only keyids received in a DEC_KEYID command are valid.