RFC 5905 / OPERATING BOUNDARIES

Authentication & later updates

Packet authentication and careful peer handling protect different parts of the exchange. Later RFCs update the original security choices.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 15 ↗

RFC 5905 · § 15EXAMPLE

4 / 4

Use an appropriate modern design.

Read later algorithm and security specifications rather than deploying obsolete MD5 guidance.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

WHAT CHANGED

RFC 5905 §7.3RFC 8573 §§2–3

The original MD5-based MAC is deprecated. The update requires AES-CMAC support for the described shared-key authentication, using an AES-128 key and a tag of at least 128 bits.

Read the updated RFC section ↗

KEY POINT

Protect the source and keep the update history visible.

Original RFC 5905 describes optional symmetric-key authentication; a checksum is not authentication.
RFC 8573 deprecates its MD5-based authentication and specifies AES-CMAC for that shared-key design.
RFC 9109 updates client port selection. RFC 8915 separately defines Network Time Security with key establishment and authenticated NTP.

DETAILS

Authentication cannot by itself eliminate delay manipulation by an attacker on the network path. RFC Editor also lists later updates 7822, 9748, and 9769; consult those documents and errata for implementation work.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy

All chapters in this RFC