Cryptographic Protection of TCP Streams
RFC 8548, “Cryptographic Protection of TCP Streams”, is an Experimental document published in May 2019 by A. Bittau, D. Giffin, M. Handley, D. Mazieres, Q. Slack, E. Smith. The canonical text is published by the RFC Editor.
Abstract
This document specifies "tcpcrypt", a TCP encryption protocol designed for use in conjunction with the TCP Encryption Negotiation Option (TCP-ENO). Tcpcrypt coexists with middleboxes by tolerating resegmentation, NATs, and other manipulations of the TCP header. The protocol is self-contained and specifically tailored to TCP implementations, which often reside in kernels or other environments in which large external software dependencies can be undesirable. Because the size of TCP options is limited, the protocol requires one additional one-way message latency to perform key exchange before application data can be transmitted. However, the extra latency can be avoided between two hosts that have recently established a previous tcpcrypt connection.
What “Experimental” means
Describes a specification that is part of a research or development effort, published so the community can gain experience with it.
The canonical text of RFC 8548 is hosted at rfc-editor.org. Available in TXT,HTML.
- RFC 8547 TCP-ENO: Encryption Negotiation Option
- RFC 8549 Export of BGP Community Information in IP Flow Information Export
- RFC 8546 The Wire Image of a Network Protocol
- RFC 8550 Secure/Multipurpose Internet Mail Extensions Version 4.0 Certificate Handling
- RFC 8545 Well-Known Port Assignments for the One-Way Active Measurement Protocol and the Two-Way Active Measurement Protocol
- RFC 8551 Secure/Multipurpose Internet Mail Extensions Version 4.0 Message Specification
- RFC 8544 Organization Extension for the Extensible Provisioning Protocol
- RFC 8552 Scoped Interpretation of DNS Resource Records through "Underscored" Naming of Attribute Leaves