Simple Authentication Schemes for the Asynchronous Layered Coding (ALC) and NACK-Oriented Reliable Multicast (NORM) Protocols
Extracted elements (29)
Digital Signatures (RSA/ECC) provide true sender authentication and non-delayed verification but impose high computational and transmission overhead. Group-keyed MACs are efficient for high-rate flows but cannot protect against attacks from inside the group. TESLA is also efficient but requires loose time synchronization and delayed authentication. These trade-offs determine the appropriate scheme per use case.
ECC provides significantly smaller key and signature sizes for equivalent security: a 160-bit ECC key is comparable to 1024-bit RSA, and a 224-bit ECC key to 2048-bit RSA. However, RSA puts more load on the signer and less on verifiers, while ECC distributes load more evenly; with many verifiers RSA consumes more total CPU.
The 40-bit anti-replay Sequence Number (vs. the 32-bit field in ESP/RFC 4303) is chosen because on a 10 Gbps network with 64-byte packets, a 40-bit counter takes more than 15 hours to cycle, making wraparound negligible for most sessions without requiring explicit counter extension negotiation.
The ASID value is scoped by the session identifier tuple ({sender IP; TSI} for ALC, {dst multicast address; dst port} or {src IP; dst multicast; dst port} for NORM) rather than the host participation tuple, so different sessions may reuse the same ASID values for different schemes without ambiguity.
The Combined scheme prepends a cheap Group-keyed MAC check before the expensive Digital Signature verification to mitigate DoS attacks from outside-group attackers. Anti-replay protection is mandatory in this scheme because without it replayed valid packets would pass the MAC pre-check and force receivers into costly signature verification.
ECDSA-256, ECDSA-384, and ECDSA-521 are defined to promote interoperability (referencing RFC 4754 and RFC 5480). Only these three suites are considered; alternative ECC techniques such as KT-I signatures from RFC 6090 are noted as possible future additions but not specified.
Multiple authentication schemes MAY coexist within the same ALC or NORM session, even on the same communication path. All receivers MUST recognize EXT_AUTH but may ignore its content if they do not support the scheme indicated by the ASID; this allows incremental deployment.
At the receiver, for each incoming packet the receiver MUST verify that the Sequence Number does not duplicate any prior packet's SN. If the preliminary check fails the packet is discarded without cryptographic processing; if the integrity check subsequently fails the packet MUST be discarded.
During Group-keyed MAC computation the MAC field MUST be set to 0; if the receiver's recomputed MAC check fails the packet MUST be immediately dropped. The truncated output length n_m MUST be less than or equal to the key length.
Each packet sent MUST contain exactly one Digital Signature EXT_AUTH header extension. A receiver MUST drop all packets that do not contain the expected Digital Signature EXT_AUTH header extension.
ECDSA-256 using SHA-256 and the secp256r1 curve is RECOMMENDED as the default ECDSA configuration; ECDSA-384 and ECDSA-521 are also defined and offer AES-192 and AES-256 equivalent security respectively.
For NORM sessions, it is RECOMMENDED that instance_id be changed for each NORM instance when a host participates in multiple sessions. When Group-keyed MAC is used, it is RECOMMENDED that the shared group key be changed across sessions.
For RSA, RSASSA-PSS, and DSA signatures, key sizes strictly less than 1024 bits SHOULD NOT be used; sizes between 1024 and 2048 bits inclusive SHOULD be used; sizes above 2048 bits MAY be used.
In the Combined scheme the AR flag MUST be set to 1 (anti-replay is mandatory). The receiver MUST first check the Group-keyed MAC and drop on failure, then check the Digital Signature and drop on failure.
In the Combined scheme the n_m parameter SHOULD be kept small; the default and minimum meaningful value is 32 bits. The Group-keyed MAC n_m MUST be a multiple of 32 bits.
The anti-replay Sequence Number field MUST be initialized before signature generation so receivers can verify it during integrity checking. When anti-replay is enabled (AR=1), all 40 bits of the SN MUST be considered by the anti-replay mechanism.
The ASID field mapping to authentication scheme is critical and SHOULD be communicated securely out-of-band from sender to receivers. The details of the out-of-band mechanism are outside the scope of this document.
The Group-keyed MAC MUST use HMAC-SHA-256 (RECOMMENDED) or another communicated Cryptographic MAC Function. The shared group key MUST be communicated to all group members confidentially before the session starts.
The sender MUST communicate its public key to all receivers before the session starts. The use of SHA-256 as the one-way hash function is RECOMMENDED due to security threats on SHA-1.
The signature computation MUST cover the ALC or NORM header (including all header extensions) and the payload when applicable. The UDP/IP/MAC headers MUST NOT be included. During computation, the Signature field MUST be set to 0.
To prevent cross-session replay attacks on ALC, the TSI MUST be changed for each ALC session so it is unique among all active sessions of the sender for a long period preceding and following activity. When Group-keyed MAC is used, the shared group key SHOULD be changed across sessions if the receiver set changes.
The ASID (Authentication Scheme IDentifier) is a 4-bit field present in every HET=1 (EXT_AUTH) header extension. It enables a receiver to determine which authentication scheme and format applies to a given packet, allowing multiple schemes to coexist in the same ALC or NORM session. The association between ASID value and scheme is communicated out-of-band at session startup.
Digital Signature schemes introduce DoS vulnerability because forged packets are cheap to create but expensive to verify. Mitigation: use the Combined scheme as a front-end MAC filter, and rate-limit authentication checks per time unit when the number of failing packets exceeds a threshold.
Replay attacks are mitigated by the optional anti-replay Sequence Number mechanism. The anti-replay service is RECOMMENDED for all schemes and MUST be used in the Combined scheme. Schemes without anti-replay are stateless and therefore replay-neutral at the authentication layer, but higher-level protocol state (especially in NORM) may still be affected.
The Group-keyed MAC scheme cannot protect against attacks from inside the group: a group member who knows the shared key can impersonate the sender and inject forged packets that will pass the MAC check. This is an inherent limitation distinguishing group-security from sender authentication.
The Combined Digital Signature/Group-keyed MAC EXT_AUTH extension contains: HET=1, HEL, ASID (4 bits), rsvd (3 bits), AR flag (must be 1), a 40-bit SN, a variable-length Signature field (padded to 32-bit boundary), and a Group-keyed MAC field (variable size, default 32 bits). For 1024-bit RSA with 32-bit MAC the extension is 140 bytes.
The ECDSA Digital Signature EXT_AUTH header extension shares the same structure as the RSA variant (HET, HEL, ASID, rsvd, AR, SN, Signature, Padding). For ECDSA-256 the Signature field is 32 bytes and the extension totals 36 bytes, significantly smaller than the RSA equivalent.
The Group-keyed MAC EXT_AUTH header extension contains: HET=1, HEL, ASID (4 bits), rsvd (3 bits), AR flag (1 bit), SN (8 or 40 bits), a variable-length truncated Group-keyed MAC field (multiple of 32 bits), and optional Padding. For HMAC-SHA-256 with default truncation the extension is 16 bytes.
The RSA Digital Signature EXT_AUTH header extension contains: HET=1 (8 bits), HEL (8 bits), ASID (4 bits), rsvd (3 bits), AR flag (1 bit), SN (8 bits when AR=0, 40 bits when AR=1), variable-length Signature field (multiple of 32 bits, padded with zeros), and optional Padding. For a 1024-bit key, the extension is 132 bytes total.