RFC 4895

Authenticated Chunks for the Stream Control Transmission Protocol (SCTP)
Standards Track
August 2007
RFC Library > SCTP > RFC 4895
Abstract: This document describes a new chunk type, parameter, and procedures for SCTP to provide authentication of SCTP chunks. The AUTH chunk carries a Hash-based Message Authentication Code (HMAC) that provides integrity protection for SCTP chunks without requiring IPsec, enabling SCTP-level authentication for dynamic address reconfiguration and stream reset.
Canonical source: https://www.rfc-editor.org/rfc/rfc4895  |  IETF Datatracker

Overview & Motivation

▶

RFC 4895 adds authentication at the SCTP protocol level through a new AUTH chunk. This is needed because certain SCTP extensions (like Dynamic Address Reconfiguration and Stream Reset) modify association parameters and must be authenticated to prevent spoofing attacks.

While IPsec can protect SCTP, the AUTH chunk provides authentication within SCTP itself, which is useful when IPsec is not available or when fine-grained per-chunk authentication is needed.

AUTH Chunk Format

▶

The AUTH chunk MUST appear before the chunks it authenticates in the SCTP packet. The HMAC covers the shared key, the entire SCTP packet from the common header through the AUTH chunk (with HMAC field zeroed), and all subsequent chunks.

   0                   1                   2                   3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 0x0F   |   Flags       |         Length                |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Shared Key Identifier     |   HMAC Identifier             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
\                     HMAC (variable length)                    /
/                                                               \
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

HMAC Algorithms

▶
HMAC ID Algorithm Status
0x0001 HMAC-SHA-1 MUST
0x0003 HMAC-SHA-256 SHOULD
0x0000 Reserved —
Mandatory: All implementations MUST support HMAC-SHA-1 and SHOULD support HMAC-SHA-256. Peers negotiate the algorithm via the HMAC-ALGO parameter during association setup.

Key Management

▶

Shared keys are established during SCTP association setup using the RANDOM and CHUNKS parameters in INIT/INIT-ACK. Each endpoint generates a random number, and the shared key is formed by concatenating both random values. Keys are identified by a Shared Key Identifier.

  • RANDOM parameter: Each endpoint provides a random value (≥32 bytes) in INIT/INIT-ACK
  • CHUNKS parameter: Lists chunk types that MUST be authenticated
  • Key derivation: Shared key = RANDOM(local) || RANDOM(remote) (initiator first)
  • Key rotation: New keys established via re-association or application-layer protocol

Authenticated Chunk Types

▶

The CHUNKS parameter negotiates which chunk types require authentication. Chunks that modify association state are prime candidates for authentication.

Chunk Type Purpose Auth Recommended
ASCONF Dynamic Address Reconfig MUST
ASCONF-ACK Address Reconfig Ack MUST
RE-CONFIG Stream Reset MUST
FORWARD-TSN Partial Reliability SHOULD

3GPP Relevance

▶
  • NGAP/S1AP SCTP security: When IPsec is not used for NGAP (N2) or S1AP signaling, SCTP AUTH provides transport-level integrity for control plane messages
  • Multi-homing protection: SCTP AUTH prevents address hijacking during dynamic address reconfiguration of gNB-AMF SCTP associations
  • Diameter transport: SCTP-based Diameter connections (S6a, Gx) can use AUTH chunks for per-message authentication
  • Complementary to DTLS: AUTH provides lighter-weight authentication than DTLS-over-SCTP (RFC 6083) when full encryption is not required