I-D Action: draft-bezerra-relay-auth-transparency-01.txt

Internet-Draft draft-bezerra-relay-auth-transparency-01.txt is now available.

   Title:   Authentication-Transparent Protocol Extensions in Middleware-Relayed Systems
   Author:  Cleiton Augusto Correa Bezerra
   Name:    draft-bezerra-relay-auth-transparency-01.txt
   Pages:   14
   Dates:   2026-08-06

Abstract:

   Protocol-aware middleware (relays, bridges, gateways) re-serializes
   messages at their protocol frame boundary, silently discarding any
   bytes appended outside that boundary.  Authentication material placed
   after the frame boundary by a sender is therefore stripped at every
   relay hop before reaching the receiver, with no error indication.
   This document identifies this behavior as a protocol design
   vulnerability class -- "relay-transparent authentication stripping"
   -- demonstrates it with running code in three independent protocol
   stacks (MAVLink v2, ROS2/DDS CDR, and CAN/ISO-TP with a SecOC-unaware
   gateway), and specifies the architectural principle that
   authentication material must be carried as a first-class,
   independently addressable protocol unit to survive relay transit.
   Post-quantum signature sizes push authentication out of fixed fields
   and so create the precondition systematically; this revision reports
   three measured cases where they do not, because a transport that
   refuses to carry the oversized unit produces a loss of availability
   instead of a silent authentication bypass.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-bezerra-relay-auth-transparency/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-bezerra-relay-auth-transparency-01.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-bezerra-relay-auth-transparency-01

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]