PacketCable Security Ticket Control Sub-Option for the DHCP CableLabs Client Configuration (CCC) Option
Extracted elements (14)
CCDs are permitted to retain security tickets in local persistent storage so that a power-cycled device can reuse non-expired tickets, avoiding expensive Kerberos ticket acquisition and greatly reducing security overhead. The STC sub-option gives service providers control over this persistence to support re-establishment of security associations and remote diagnostics.
Although the PacketCable Security Specification is based on Kerberos V5 (RFC 1510/RFC 4120), it is not a strict implementation of that RFC; implementors must consult the PacketCable Security Specification directly for authoritative behavior.
A bit value of 0 in the TCM means the CCD MUST apply normal invalidation rules (as defined in the PacketCable Security Specification) to the locally persisted ticket for the corresponding server/server group.
A bit value of 1 in the TCM means the CCD MUST immediately invalidate the locally persisted ticket for the corresponding server/server group.
If a CCD does not locally store tickets, it MUST ignore this sub-option. Bit values not known to the CCD MUST be ignored.
Reserved TCM bits #2 through #15 MUST be set to 0.
The length field of the STC sub-option MUST be 2.
TCM bit #0 (least significant bit) is assigned to the PacketCable Provisioning Server used by the CCD. TCM bit #1 is assigned to the group of all PacketCable Call Management Servers used by the CCD.
The Security Ticket Control (STC) sub-option is assigned sub-option code 9 within the CableLabs Client Configuration (CCC) Option. It carries a 2-byte Ticket Control Mask (TCM) field encoded as an unsigned 16-bit quantity in network byte order.
IANA assigned a sub-option code (9) to the STC sub-option from the 'CableLabs Client Configuration' sub-option number space within the BOOTP-DHCP Parameters Registry.
IANA established a new registry 'CableLabs Client Configuration Option Ticket Control Mask Bit Definitions' within the BOOTP-DHCP Parameters Registry. Future bit mask definitions are registered via 'IETF Consensus' approval policy per RFC 2434.
A malicious DHCP server could instruct a large number of MTAs to invalidate all security tickets simultaneously, causing a Denial of Service (DoS) condition as the devices concurrently attempt to re-authenticate and obtain new Kerberos tickets from the security infrastructure.
The CMTS (head-end router) is explicitly configured to forward DHCP requests only to valid DHCP server addresses and to allow downstream DHCP traffic only from those addresses, mitigating the risk of rogue DHCP servers. However, this does not prevent spoofed DHCP servers located behind the CMTS.
The STC sub-option encoding is: Code=9 (1 byte), Len=2 (1 byte), TCM=m1/m2 (2 bytes). The TCM is an unsigned 16-bit network-byte-order field where each bit corresponds to a specific server or server group.