What is TCP-AO?

TCP-AO (TCP Authentication Option) adds a cryptographic signature to every TCP segment of a connection, mainly to protect BGP sessions from forged packets.

Long-lived TCP sessions between routers, BGP above all, are attractive targets: an attacker who can spoof a valid-looking segment can reset the session and drop every route learned over it. The older defence, TCP-MD5, adds an MD5 hash of each segment and a shared password, but MD5 is weak and the key can't be changed without tearing the session down. TCP-AO, defined in RFC 5925 with its algorithms in RFC 5926, was designed to replace it. Both ends are configured with one or more Master Key Tuples, each holding a key ID, a secret and an algorithm such as HMAC-SHA-1-96 or AES-128-CMAC-96. From the master key, each connection derives its own traffic keys, so a segment captured from one connection can't be replayed into another. Every segment carries the ID of the key used to sign it and the ID of the key the sender would like to receive next, which lets operators roll keys over on a live session without resetting it.

In practice, TCP-AO is still less widely deployed than TCP-MD5, because both routers in a session, and the software on each, have to support it; many networks keep MD5 with their transit providers and IX peers for that reason. Support has been arriving in router operating systems and in the Linux kernel, so check your platform before relying on it. Like MD5, it protects the TCP session only: it doesn't validate the routes carried over it, which is the job of filtering and RPKI. It's often paired with GTSM, which cheaply discards spoofed packets from distant attackers before any cryptography is needed. See also BGP.