Rfc 1038 – draft revised ip security option
Contents
- 9.3.13.1 Internet Options Defined.
- 9.3.15.3 DoD Fundamental Security.
- 9.3.15.3.1 Length.
- 9.3.15.3.2 Classification Protection Level.
- 9.3.15.3.3 Protection Government bodies Flags.
- 9.3.15.3.4 Usage Rules.
- 9.3.15.3.4.1 Unclassified Hosts, including gateways.
- 9.3.15.3.4.2 Hosts accredited within the Dedicated, System-High, or
- 9.3.15.3.4.3 Hosts accredited within the Multi-Level or Controlled Way of
- 9.3.13.1 Internet Options Defined.
- 9.3.15.3 DoD Fundamental Security.
- 9.3.15.3.1 Length.
- 9.3.15.3.2 Classification Protection Level.
- 9.3.15.3.3 Protection Government bodies Flags.
- 9.3.15.3.4 Usage Rules.
- 9.3.15.3.4.1 Unclassified Hosts, including gateways.
- 9.3.15.3.4.2 Hosts accredited within the Dedicated, System-High, or
- 9.3.15.3.4.3 Hosts accredited within the Multi-Level or Controlled Way of
- 9.3.15.3.4.4 Out-Of-Range Procedure.
- 9.3.15.3.4.5 Reliable Intermediary Procedure.
- 9.3.15.4 DoD Extended Security Option
- Taarak Mehta Ka Ooltah Chashmah – तारक मेहता – Episode 1038 – 31st March , 2018
[Docs] [txtpdf] [Tracker]
Obsoleted by: 1108
Network Working Group M. St. Johns
Request Comments: 1038 IETF
The month of january 1988
Draft Revised IP Security Option
Status of the Memo
This RFC is really a pre-publication draft from the revised Ip Address
Security Option. This draft reflects the version as approved by
the Protocol Standards Steering Group. It’s deliver to
informational purposes only. The ultimate form of this document will
be accessible from Navy Publications and cannot vary from
this document in almost any major fashion.
This document is going to be printed like a switch to the MIL-STD 1777,
“Ip Address”. Distribution of the memo is limitless.
9.3.13.1 Internet Options Defined.
The next internet choices are defined:
CLASS NUMBER LENGTH DESCRIPTION
_____ ______ ______ ___________
00000 – Finish of Option list: This method occupies
only one octet it’s no length octet.
00001 – No Operation: This method occupies only one
octet it’s no length octet.
00010 var. Fundamental Security: Accustomed to carry security
level and accrediting authority flags.
00011 var. Loose Source Routing: Accustomed to route the
datagram according to information provided by
the origin.
00101 var. Extended Security: Accustomed to carry additional
security information as needed by
registered government bodies.
01001 var. Strict Source Routing: Accustomed to route the
datagram according to information provided by
the origin.
00111 var. Record Route: Accustomed to trace the path a
datagram takes.
01000 4 Stream ID: Accustomed to carry the stream
identifier.
2 00100 var. Internet Timestamp: Accustomed to accumulate
timing information on the road.
St. Johns [The First Page]
RFC 1038 Draft Revised IP Security Option The month of january 1988
9.3.15.3 DoD Fundamental Security.
Option type: 130 Option length: variable minimum length: 4
The choice identifies the U.S. security level that the datagram
will be protected, and also the accrediting government bodies whose protection
rules affect each datagram.
The choice can be used by accredited reliable aspects of an online
to:
a. Validate the datagram as suitable for transmission in the
source.
b. Be certain that the path taken through the datagram (such as the
destination) remains safe and secure to the stage needed by all
indicated accrediting government bodies.
c. Supply common label information needed by computer security
models.
This method should be copied on fragmentation. This method seems
for the most part once in a while datagram.
The format of the choice is the following:
+————–+———–+————-+————-//———-+
10000010 XXXXXXXX SSSSSSSS AAAAAAA[1] AAAAAAA0
[]
+————–+———–+————-+————-//———-+
TYPE = 130 LENGTH CLASSIFICATION PROTECTION
VARIABLE PROTECTION AUTHORITY
LEVEL FLAGS
FIGURE 10-A. SECURITY OPTION FORMAT
9.3.15.3.1 Length.
The size of the choice is variable. The minimum length choice is
4.
9.3.15.3.2 Classification Protection Level.
Seo specifies the U.S. classification level that the
datagram ought to be protected. The data within the datagram should
be assumed to become only at that level until and unless of course it’s regraded in
compliance using the procedures of indicated protecting
St. Johns [Page 2]
RFC 1038 Draft Revised IP Security Option The month of january 1988
government bodies. Seo specifies among the four U.S.
classification levels, and it is encoded the following:
11011110 – Key
10101101 – Secret
01111010 – Private
01010101 – Unclassified
9.3.15.3.3 Protection Government bodies Flags.
Seo signifies the nation’s Access Program(s) with accrediting
authority whose rules affect the security from the datagram.
a. Field Length: Seo is variable long. The reduced-
order bit (Bit 7) of every octet is encoded as “zero” if it’s the
final octet within the field, or as “one” should there be additional
octets. Presently, just one octet is required with this field
(since there are under seven government bodies), and also the final bit
from the first octet is coded as “zero”.
b. Source Flags: The very first seven bits (Bits through 6) in every
octet are source flags that are each connected by having an authority
as indicated below. The part akin to an expert is
“one” when the datagram will be protected in compliance using the
rules of this authority.
9.3.15.3.4 Usage Rules.
Utilisation of the option mandates that a number be familiar with 1) the
classification level, or levels, where it’s allowed to function,
and a pair of) the security government bodies accountable for its certification.
The achievement of the is implementation dependent. Rules to be used
from the choice for various kinds of hosts receive below.
9.3.15.3.4.1 Unclassified Hosts, including gateways.
a. Output: Unclassified hosts either can use or otherwise make use of the
option. If it’s used, classification level should be unclassified,
bit from the accreditation field (GENSER) should be one, and all sorts of
other items of the accreditation field should be . While utilisation of the
choice is allowed, it’s suggested that unclassified hosts
thinking about maximizing interoperability with existing non-
compliant implementations not make use of the option.
b. Input: Unclassified hosts should accept for more
processing IP datagrams with no option. When the choice is
present with an incoming IP datagram, then your datagram is recognized
for more processing only when the classification level is
St. Johns [Page 3]
RFC 1038 Draft Revised IP Security Option The month of january 1988
unclassified, bit from the accreditation field (GENSER) is a,
and all sorts of other items of the accreditation field are zero.
Otherwise, the out-of-range procedure is adopted.
9.3.15.3.4.2 Hosts accredited within the Dedicated, System-High, or
Compartmented Modes in a classification level greater than unclassified.
a. Output. Using the choice is required. The
classification level ought to be the dedicated level for dedicated
hosts and also the system-higher level for system-high and compartmented
hosts. The accrediting authority flags ought to be one for those
government bodies that have accredited the hosts, and nil for those
other government bodies.
b. Input. If 1) the choice exists, 2) the classification
level matches the host classification level, and three) the
accrediting authority flags for those accrediting government bodies from the
receiving host is one, and all sorts of other medication is zero, the IP datagram
ought to be recognized for more processing. Otherwise, the out-
of-range procedure is adopted.
9.3.15.3.4.3 Hosts accredited within the Multi-Level or Controlled Way of
network transmission.
a. Output. Using the choice is required. The
classification degree of an IP datagram ought to be inside the range
of levels that the host is accredited. The security
government bodies flags ought to be one for those government bodies under whose
[Docs] [txtpdf] [Tracker]
Obsoleted by: 1108
Network Working Group M. St. Johns
Request Comments: 1038 IETF
The month of january 1988
Draft Revised IP Security Option
Status of the Memo
This RFC is really a pre-publication draft from the revised Ip Address
Security Option. This draft reflects the version as approved by
the Protocol Standards Steering Group. It’s deliver to
informational purposes only. The ultimate form of this document will
be accessible from Navy Publications and cannot vary from
this document in almost any major fashion.
This document is going to be printed like a switch to the MIL-STD 1777,
“Ip Address”. Distribution of the memo is limitless.
9.3.13.1 Internet Options Defined.
The next internet choices are defined:
CLASS NUMBER LENGTH DESCRIPTION
_____ ______ ______ ___________
00000 – Finish of Option list: This method occupies
only one octet it’s no length octet.
00001 – No Operation: This method occupies only one
octet it’s no length octet.
00010 var. Fundamental Security: Accustomed to carry security
level and accrediting authority flags.
00011 var. Loose Source Routing: Accustomed to route the
datagram according to information provided by
the origin.
00101 var. Extended Security: Accustomed to carry additional
security information as needed by
registered government bodies.
01001 var. Strict Source Routing: Accustomed to route the
datagram according to information provided by
the origin.
00111 var. Record Route: Accustomed to trace the path a
datagram takes.
01000 4 Stream ID: Accustomed to carry the stream
identifier.
2 00100 var. Internet Timestamp: Accustomed to accumulate
timing information on the road.
St. Johns [The First Page]
RFC 1038 Draft Revised IP Security Option The month of january 1988
9.3.15.3 DoD Fundamental Security.
Option type: 130 Option length: variable minimum length: 4
The choice identifies the U.S. security level that the datagram
will be protected, and also the accrediting government bodies whose protection
rules affect each datagram.
The choice can be used by accredited reliable aspects of an online
to:
a. Validate the datagram as suitable for transmission in the
source.
b. Be certain that the path taken through the datagram (such as the
destination) remains safe and secure to the stage needed by all
indicated accrediting government bodies.
c. Supply common label information needed by computer security
models.
This method should be copied on fragmentation. This method seems
for the most part once in a while datagram.
The format of the choice is the following:
+————–+———–+————-+————-//———-+
10000010 XXXXXXXX SSSSSSSS AAAAAAA[1] AAAAAAA0
[]
+————–+———–+————-+————-//———-+
TYPE = 130 LENGTH CLASSIFICATION PROTECTION
VARIABLE PROTECTION AUTHORITY
LEVEL FLAGS
FIGURE 10-A. SECURITY OPTION FORMAT
9.3.15.3.1 Length.
The size of the choice is variable. The minimum length choice is
4.
9.3.15.3.2 Classification Protection Level.
Seo specifies the U.S. classification level that the
datagram ought to be protected. The data within the datagram should
be assumed to become only at that level until and unless of course it’s regraded in
compliance using the procedures of indicated protecting
St. Johns [Page 2]
RFC 1038 Draft Revised IP Security Option The month of january 1988
government bodies. Seo specifies among the four U.S.
classification levels, and it is encoded the following:
11011110 – Key
10101101 – Secret
01111010 – Private
01010101 – Unclassified
9.3.15.3.3 Protection Government bodies Flags.
Seo signifies the nation’s Access Program(s) with accrediting
authority whose rules affect the security from the datagram.
a. Field Length: Seo is variable long. The reduced-
order bit (Bit 7) of every octet is encoded as “zero” if it’s the
final octet within the field, or as “one” should there be additional
octets. Presently, just one octet is required with this field
(since there are under seven government bodies), and also the final bit
from the first octet is coded as “zero”.
b. Source Flags: The very first seven bits (Bits through 6) in every
octet are source flags that are each connected by having an authority
as indicated below. The part akin to an expert is
“one” when the datagram will be protected in compliance using the
rules of this authority.
9.3.15.3.4 Usage Rules.
Utilisation of the option mandates that a number be familiar with 1) the
classification level, or levels, where it’s allowed to function,
and a pair of) the security government bodies accountable for its certification.
The achievement of the is implementation dependent. Rules to be used
from the choice for various kinds of hosts receive below.
9.3.15.3.4.1 Unclassified Hosts, including gateways.
a. Output: Unclassified hosts either can use or otherwise make use of the
option. If it’s used, classification level should be unclassified,
bit from the accreditation field (GENSER) should be one, and all sorts of
other items of the accreditation field should be . While utilisation of the
choice is allowed, it’s suggested that unclassified hosts
thinking about maximizing interoperability with existing non-
compliant implementations not make use of the option.
b. Input: Unclassified hosts should accept for more
processing IP datagrams with no option. When the choice is
present with an incoming IP datagram, then your datagram is recognized
for more processing only when the classification level is
St. Johns [Page 3]
RFC 1038 Draft Revised IP Security Option The month of january 1988
unclassified, bit from the accreditation field (GENSER) is a,
and all sorts of other items of the accreditation field are zero.
Otherwise, the out-of-range procedure is adopted.
9.3.15.3.4.2 Hosts accredited within the Dedicated, System-High, or
Compartmented Modes in a classification level greater than unclassified.
a. Output. Using the choice is required. The
classification level ought to be the dedicated level for dedicated
hosts and also the system-higher level for system-high and compartmented
hosts. The accrediting authority flags ought to be one for those
government bodies that have accredited the hosts, and nil for those
other government bodies.
b. Input. If 1) the choice exists, 2) the classification
level matches the host classification level, and three) the
accrediting authority flags for those accrediting government bodies from the
receiving host is one, and all sorts of other medication is zero, the IP datagram
ought to be recognized for more processing. Otherwise, the out-
of-range procedure is adopted.
9.3.15.3.4.3 Hosts accredited within the Multi-Level or Controlled Way of
network transmission.
a. Output. Using the choice is required. The
classification degree of an IP datagram ought to be inside the range
of levels that the host is accredited. The security
government bodies flags ought to be one for those government bodies under whose
rules the datagram ought to be protected.
b. Input. Within the specific situation in which a multi-level or controlled
host is accredited to directly interface by having an unclassified
atmosphere, the host may accept IP datagrams with no fundamental
security option. Such datagrams ought to be assumed to become
unconditionally labelled unclassified, GENSER, and really should be so
labelled clearly if they’re later output. In most other cases,
the IP datagrams must have the fundamental security option on input,
and also the out-of-range procedure ought to be adopted if it’s not.
There’s two cases that need considering in which the choice is present.
The very first situation is how the machine atmosphere permits the in
the choice to become reliable to become correct for many selection of values the
second is how the can’t be reliable to become correct. For every
multi-level or controlled host, every input funnel for IP datagrams
should be considered and classed appropriately. If your funnel comes with
a reliable range, then your values of both classification level and
the security government bodies are checked to insure they fall
within that range and the plethora of accredited values for that
St. Johns [Page 4]
RFC 1038 Draft Revised IP Security Option The month of january 1988
receiving host. If within both ranges, the IP datagram is recognized
for more processing otherwise the out-of-range procedure is
adopted. When the label can’t be reliable, then your receiving host
must involve some accredited way of understanding what the right
marking ought to be (e.g., a reliable funnel to some system-high host in a
known level). On receipt of the IP datagram, the host blogs about the
actual values within the choice to the right values. When the values
match, the datagram is recognized for more processing otherwise,
the out-of-range procedure is adopted.
9.3.15.3.4.4 Out-Of-Range Procedure.
If the IP datagram is received which doesn’t satisfy the input
needs, then:
a) The information field ought to be overwritten with ones.
b) If the issue is military services weapons needed Fundamental or Extended security
option, an ICMP “parameter problem” message is distributed towards the
originating host using the code field set to at least one (one) to point
“missing needed option” and also the pointer field set towards the option
kind of the missing option. Otherwise, an ICMP “parameter
problem” message is distributed towards the originating host with code field
set to (zero) along with the pointer field pointing towards the
position from the out-of-range security option.
c) When the receiving host comes with an interface to some local security
officer or equivalent, the issue ought to be identified across
that interface within an appropriate way.
9.3.15.3.4.5 Reliable Intermediary Procedure.
Certain devices online may behave as intermediaries to validate
that communications between two hosts are approved, with different
mixture of understanding from the hosts and also the values within the IP
security option. These units may receive IP datagrams that are in
range for that intermediate device, but they are either not inside the
acceptable range for that sender, or the best receiver. In
the previous situation, the datagram ought to be treated as described above
to have an out-of-range option. Within the latter situation, a “destination
unreachable” ICMP message ought to be sent, using the code worth of 10
(ten), indicating “Communication with Destination Host
Administratively Prohibited”.
St. Johns [Page 5]
RFC 1038 Draft Revised IP Security Option The month of january 1988
9.3.15.4 DoD Extended Security Option
Option type: 133 Option length: variable
This method permits additional security related information, beyond
that contained in the Fundamental Security Option, to become provided within an IP
datagram to meet the requirements of registered government bodies. If the option
is needed by an expert for any specific system, it should be
specified clearly in almost any Request Proposal. It’s not
otherwise needed. This method should be copied on fragmentation.
This method may seem multiple occasions inside a datagram.
The format with this choice is the following:
+————+————-+————-+——–//——-+
10000101 000LLLLL AAAAAAAA add sec info
+————+————-+————-+——–//——-+
type = 133 LENGTH = Var. ADDITIONAL ADDITIONAL
SECURITY SECURITY
INFO INFO
AUTHORITY
CODE
FIGURE 10-B.
9.3.15.4.1 Additional Security Info Authority Code.
length = 8 bits
The of the field are assigned by DCA Code R130, Washington,
D.C. 20305-2000. Each value matches a requestor who, once
assigned, becomes the authority through out the choice
definition for your value.
9.3.15.4.2 Additional Security Information.
length – variable
Seo contains any extra security information as specified
through the authority.
St. Johns [Page 6]
RFC 1038 Draft Revised IP Security Option The month of january 1988
BIT
NUMBER AUTHORITY
GENSER
1 SIOP
2 DSCCS-SPINTCOM
3 DSCCS-CRITICOM
4-7 Unassigned
AUTHORITY Supply Of ANNEX DESCRIBING
CURRENT CODING Of More
SECURITY INFORMATION
GENSER
National Access Program, less SIOP Defense Communications
Agency
ATTN: Code R130
Washington, Electricity 20305
SIOP
National Access Program Dod
Organization from the
Joint Leaders of Staff
Attn: J6T
Washington, Electricity
DSCCS-SPINTCOM
National Access Program Defense Intelligence Agency
Attn: DSE4
Bolling AFB, MD
DSCCS-CRITICOM
National Access Program National Security Agency
9800 Savage Road
Attn: T03
Foot. Meade, MD 20755-6000
St. Johns [Page 7]
Html markup created by rfcmarkup 1.129d, offered by
https://tools.ietf.org/tools/rfcmarkup/
Resourse: https://tools.ietf.org/html/
