MAC Authentication for the Babel Routing Protocol
obsoletes
- rfc-7298 — Babel Hashed Message Authentication Code (HMAC) Cryptographic Authentication
updated by
- rfc-9467 — Relaxed Packet Counter Verification for Babel MAC Authentication
Extracted elements (29)
An 'index' field is introduced alongside the PC to handle PC resets. Whenever a node resets its PC or is unsure whether it has been reset, it picks a fresh index. A receiver that detects an index change re-challenges the sender, closing the replay window that a simple monotonic counter cannot close after a reboot.
During the preparse phase, Challenge Requests are processed and challenges are scheduled before the (Index, PC) pair is verified. This simplifies implementation but relies on rate limiting to avoid amplified challenge flooding in response to replayed packets.
The MAC pseudo-header includes source and destination IP addresses and UDP ports but is never transmitted. Including the source address binds the MAC to a specific sender, which limits resource exhaustion attacks to one table entry per attacker-controlled source address.
Unlike Babel over DTLS (RFC 8968), which restricts traffic to unicast and applies a standard unicast security protocol, this document protects both unicast and multicast Babel traffic natively, requiring very few changes to the core protocol.
For incremental deployment, nodes are first configured to send authenticated packets but accept unauthenticated ones; once all nodes authenticate, unauthenticated packets are rejected. For key rotation, the new key is added to all nodes, both keys are sent per packet, and after propagation the old key is removed.
The MAC TLV MUST be ignored if found in the packet body; it is only valid in the packet trailer. PC, Challenge Request, and Challenge Reply TLVs found in an accepted packet are silently ignored during normal processing.
A Challenge Request received on a multicast address MUST be silently ignored. The Challenge Reply MUST be sent to the unicast address from which the Challenge Request was sent.
A neighbour table entry MUST NOT be created before the MAC test has passed successfully, to avoid memory exhaustion attacks. The MAC of a packet MUST NOT be computed for each MAC TLV, but only once per configured key.
A node MUST impose rate limiting on Challenge Replies; the limit SHOULD default to one Challenge Reply per peer every 300 ms. A node SHOULD NOT send other packets over the same interface before sending the Challenge Reply.
Before sending a packet on a MAC-protected interface, a PC TLV containing the current PC and Index MUST be appended to the packet body, and the PC MUST be incremented by a strictly positive amount. A node MUST NOT include multiple PC TLVs in a single packet.
Every implementation MUST implement HMAC-SHA256 as defined in RFC 6234 and RFC 2104. Implementations SHOULD implement keyed BLAKE2s with 128-bit digests, and MAY implement other MAC algorithms.
If the packet contains no PC TLV, the packet MUST be dropped. If the neighbour's Index is absent or differs from the Index in the received PC TLV, a challenge MUST be sent and the packet MUST be dropped.
If the PC overflows, a fresh index MUST be generated. For each key configured on the interface, a MAC TLV MUST be appended to the packet trailer.
If the received PC is smaller than or equal to the PC stored in the neighbour table, the packet MUST be dropped (no challenge is sent, since the mismatch may be caused by harmless packet reordering).
Implementations MUST allow each interface to be provisioned with one or more MAC keys and associated algorithms. Implementations SHOULD allow an interface to be configured to accept unauthenticated packets for incremental deployment.
Implementations MUST ensure that an (Index, PC) pair is discarded within a finite time since the last accepted packet. Unsuccessful challenges MUST NOT prevent an (Index, PC) pair from being discarded for unbounded periods.
On reception, if the packet trailer carries no MAC TLV the packet MUST be immediately dropped. If no configured key produces a MAC matching one in the packet, the packet MUST be silently dropped.
IANA allocated four entries in the Babel TLV Types registry: Type 16 (MAC), Type 17 (PC), Type 18 (Challenge Request), Type 19 (Challenge Reply), all referencing RFC 8967.
Indices must be unique per (key, source) pair and nonces unique per (key, source, destination) triple over the key's lifetime. 64-bit random values are considered sufficient; if uniqueness cannot be guaranteed (e.g., clock reset), rekeying is necessary.
Keys should be 32 octets long and randomly chosen. If derived from a passphrase, a password-hardening KDF such as PBKDF2, bcrypt, or scrypt MUST be used; only derived keys should be sent to routers.
Resource exhaustion from replayed packets with obsolete indices is bounded because the MAC pseudo-header includes the sender's IP address, limiting the attacker to one neighbour-table entry per distinct source address per key. The neighbour table MUST NOT be populated before a successful MAC check.
The expiry mechanism (Section 4.4) is required to prevent an attacker at a Layer 2 switch from delaying authentic packets indefinitely by keeping a stale (Index, PC) pair alive through repeated failed challenges.
Challenge lifecycle: sender detects Index mismatch → sends unicast Challenge Request with fresh nonce stored in neighbour table with 30-second expiry timer → receiver replies with Challenge Reply copying the nonce → challenger compares nonces; if equal, challenge succeeds and stored (Index, PC) is updated.
Packet reception on a MAC-protected interface proceeds through five sequential checks: (1) MAC test, (2) preparse for PC/Challenge TLVs, (3) drop if no PC TLV, (4) accept if successful Challenge Reply, (5) challenge if Index mismatch, otherwise compare PC monotonically and accept or drop.
Challenge Reply TLV (Type=19): body is a copy of the Nonce from the corresponding Challenge Request, limited to 192 octets.
Challenge Request TLV (Type=18): body is a Nonce of 0 to 192 octets uniquely identifying the challenge. A node MUST NOT send a nonce larger than 192 octets.
MAC computation uses a pseudo-header not sent on the wire. For IPv6: 128-bit source address, 16-bit source port, 128-bit destination address, 16-bit destination port. For IPv4: 32-bit source address, 16-bit source port, 32-bit destination address, 16-bit destination port.
MAC TLV (Type=16): a variable-length TLV placed in the packet trailer. The body contains the MAC computed over the pseudo-header concatenated with the Babel packet. Length depends on the MAC algorithm used.
PC TLV (Type=17): contains a 32-bit unsigned PC field followed by an Index field of 0 to 32 octets. A node MUST NOT send an Index larger than 32 octets; a receiver MAY ignore a PC TLV with an Index larger than 32 octets.