Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So, I was reading RFC 791, and got to the bit about options (here). Everything seemed to be decent and sensible, until I got to the 'levels of security' part.

Now, I can understand how, internally, the DoD might want their packets to take special routes, but at the same time, wouldn't using an option like that simply alert people that, hey, this is the traffic most worth trying to decrypt/trace (assuming, of course, that someone sending something classified would also have the basic sense to encrypt the transmission)?

Who would use that capability of IP? Why? When would it be helpful to anyone but an attacker sifting through a lot of information?

...Additionally...

If I wrote a networked program which labeled all of its packets 'secret', for example, would they be treated any differently when routed through the internet than packets labeled simply 'unclassified' or 'confidential'?

share|improve this question
    
If I wrote a networked program which labeled all of its packets - It is almost certainly nothing unusual would happen. Almost no equipment in the world is set to do anything at all when those options are use. –  Zoredache Mar 27 '13 at 22:21
    
Just because a feature is documented in a RFC doesn't mean its used. People designing this protocol back in 1981 likely imagined using this in a world very different than our modern world. Imagine a world with no GPG, SSL, or VPNs and where networks frequently use hubs (repeating packets to all ports) versus smart switches. You can imagine that flags like this could be useful in some way to be used by hardware to route traffic responsibly based on its level. Not aware that this has ever been used; but kind of like the obscure HTTP request methods (e.g., HTTP TRACE?). –  dr jimbob Mar 28 '13 at 20:38
add comment

2 Answers

up vote 17 down vote accepted

The point of classification flags is that it tells routers what they are allowed to do with it. You wouldn't see classification flags on the open internet as they are handled by private government networks. What the flags do perform however is allow routers within the government network to determine if a packet should be allowed to bridge to a public or less secure network without having to understand what is within the packet.

share|improve this answer
    
But couldn't that be a security issue if a router within the government were breached? Couldn't it inform a potential attacker which nodes on the network were most important? And what traffic would be most worth the possible exposure associated with attempted retrieval (so, have the router act normally until it catches a 'top secret' stream, then phone home)? –  root Mar 27 '13 at 21:02
    
In my limited experience, classified networks are required to be (and are) air-gapped, so is this one of the specifications that's never actually been implemented by anyone? –  Xander Mar 27 '13 at 21:04
7  
Hmmmmmmm - should be air gapped, yes.... –  Rory Alsop Mar 27 '13 at 21:08
3  
To be honest, I have never seen the classification used, and I hadn't even heard of it until now. –  Rory Alsop Mar 27 '13 at 21:28
1  
@Xander - I believe you are correct that they are actually all air gapped. I just remember hearing about the flag back in college and remembering it was in there for classifying data that would be impossible for the router to otherwise decide what to do with. They may have never used it or may not use it anymore. I'm not sure about actual usage, just the intent. –  AJ Henderson Mar 27 '13 at 23:31
show 2 more comments

The option is defined completely and finally in RFC1108, a historical RFC which would have been standards-track had that process existed at the time. Support for it is still advertised by Cisco and it seems by implication that the US DoD is still using it for something.

That said, there is no apparent equivalent in IPv6 at all, and I have never once seen this deployed. It is also not a particularly useful mechanism for protecting data except that it might mark sensitive traffic as unforwardable provided that the device which would otherwise forward it is compliant. It would certainly flag traffic as interesting, though there is likely to be a lot of noise and I'd imagine you wouldn't see any of it unless you were doing a packet trace on a classified network (at which point pretty well everything you see will be interesting).

However, as a packet filtering mark, it certainly would add more security than it would remove. In general, it is vastly more important to protect data than to hide metadata, and security by obscurity is no security at all. There are two uses for it which I can see:

  • A link on a classified network carries traffic for multiple groups. Some devices are members of some groups but not others; the relationship is many-to-many and separate devices for each possible classification would be impractical. However, the network is airgapped from the rest of the world, and the mechanism is used as an additional line of defense similar to a VLAN. This is implemented in a device functioning like a layer 3 switch.
  • A network is not airgapped from the outside world for some operational reason, and an additional line of defense against disclosure is desired. The border gateway discards all packets with an indicated classification.

In these regards, and in light of the RFC, it seems that it's extremely similar to VLANs without the encapsulation, and provides about as much security value.

I would gather, from the lack of any updates to the RFC in over 10 years, and the continued limited support for the specification in current hardware, that like so many other things in government IT, it is no longer a preferred mechanism, but is in use by certain legacy systems in some limited capacity.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.