8. Normative References (规范性参考文献)

8. 规范性参考文献 (Normative References)

本节列出撰写 RFC 安全考虑事项指南时依赖的规范性参考文献. 这些文献覆盖 IPsec、DNSSEC、TLS、HTTP、SMTP、SASL、Kerberos、PKIX、S/MIME、Telnet、VRRP、TCP SYN flooding 等安全机制和威胁背景. 英文标题和作者信息保持原文, 以便准确引用.

这些规范性引用展示了安全考虑事项章节常见的分析对象: 身份认证、完整性保护、机密性、密钥管理、证书验证、升级到安全传输、防垃圾邮件、防拒绝服务以及协议降级风险. RFC 作者在撰写安全章节时, 可以参考这些文献中的威胁模型和缓解机制, 判断自己的协议是否需要类似的说明.

本节中的文献跨度较大, 从网络层 IPsec 到应用层 HTTP、SMTP、SASL 和 S/MIME, 目的在于提醒作者安全分析应覆盖协议栈各层. 若协议依赖外部认证、加密或名称解析机制, 安全考虑事项需要明确这些依赖的假设和失败模式.

这些引用还体现了 RFC 3552 的写作方法: 安全考虑事项不应只写一句“使用 TLS”或“没有安全影响”, 而应说明威胁主体、攻击面、密钥和凭据处理、降级可能性、拒绝服务风险以及部署者需要采取的缓解措施. 因此, 本节中的参考文献可以被视为安全章节作者的案例库.

[AH] Kent, S. and R. Atkinson, "IP Authentication Header", RFC 2402, November 1998.

[DNSSEC] Eastlake, D., "Domain Name System Security Extensions", RFC 2535, March 1999.

[ENCOPT] Tso, T., "Telnet Data Encryption Option", RFC 2946, September, 2000.

[ESP] Kent, S. and R. Atkinson, "IP Encapsulating Security Payload (ESP)", RFC 2406, November 1998.

[GSS] Linn, J., "Generic Security Services Application Program Interface Version 2, Update 1", RFC 2743, January 2000.

[HTTP] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P. and T. Berners-Lee, "HyperText Transfer Protocol", RFC 2616, June 1999.

[HTTPTLS] Rescorla, E., "HTTP over TLS", RFC 2818, May 2000.

[HMAC] Madson, C. and R. Glenn, "The Use of HMAC-MD5-96 within ESP and AH", RFC 2403, November 1998.

[KERBEROS] Kohl, J. and C. Neuman, "The Kerberos Network Authentication Service (V5)", RFC 1510, September 1993.

[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

[OTP] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time Password System", STD 61, RFC 2289, February 1998.

[PHOTURIS] Karn, P. and W. Simpson, "Photuris: Session-Key Management Protocol", RFC 2522, March 1999.

[PKIX] Housley, R., Polk, W., Ford, W. and D. Solo, "Internet X.509 "Public Key Infrastructure Certificate and Certificate Restoration List (CRL) Profile", RFC 3280, April 2002.

[RFC-2223] Postel J. and J. Reynolds, "Instructions to RFC Authors", RFC 2223, October 1997.

[RFC-2505] Lindberg, G., "Anti-Spam Recommendations for SMTP MTAs", BCP 30, RFC 2505, February 1999.

[RFC-2821] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821, April 2001.

[SASL] Myers, J., "Simple Authentication and Security Layer (SASL)", RFC 2222, October 1997.

[SPKI] Ellison, C., Frantz, B., Lampson, B., Rivest, R., Thomas, B. and T. Ylonen, "SPKI Certificate Theory", RFC 2693, September 1999.

[SSH] Ylonen, T., "SSH - Secure Login Connections Over the Internet", 6th USENIX Security Symposium, p. 37-42, July 1996.

[SASLSMTP] Myers, J., "SMTP Service Extension for Authentication", RFC 2554, March 1999.

[STARTTLS] Hoffman, P., "SMTP Service Extension for Secure SMTP over Transport Layer Security", RFC 3207, February 2002.

[S-HTTP] Rescorla, E. and A. Schiffman, "The Secure HyperText Transfer Protocol", RFC 2660, August 1999.

[S/MIME] Ramsdell, B., Editor, "S/MIME Version 3 Message Specification", RFC 2633, June 1999.

[TELNET] Postel, J. and J. Reynolds, "Telnet Protocol Specification", STD 8, RFC 854, May 1983.

[TLS] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", RFC 2246, January 1999.

[TLSEXT] Blake-Wilson, S., Nystrom, M., Hopwood, D. and J. Mikkelsen, "Transport Layer Security (TLS) Extensions", RFC 3546, May 2003.

[TCPSYN] "TCP SYN Flooding and IP Spoofing Attacks", CERT Advisory CA-1996-21, 19 September 1996, CERT. http://www.cert.org/advisories/CA-1996-21.html

[UPGRADE] Khare, R. and S. Lawrence, "Upgrading to TLS Within HTTP/1.1", RFC 2817, May 2000.

[URL] Berners-Lee, T., Masinter, M. and M. McCahill, "Uniform Resource Locators (URL)", RFC 1738, December 1994.

[VRRP] Knight, S., Weaver, D., Whipple, D., Hinden, R., Mitzel, D., Hunt, P., Higginson, P., Shand, M. and A. Lindemn, "Virtual Router Redundancy Protocol", RFC 2338, April 1998.