3.1. Overview

The BIB-HMAC-SHA2 security context provides a keyed-hash Message Authentication Code (MAC) over a set of plaintext information. This context uses the Secure Hash Algorithm 2 (SHA-2) discussed in [SHS] combined with the Hashed Message Authentication Code (HMAC) keyed hash discussed in [RFC2104]. The combination of HMAC and SHA-2 as the integrity mechanism for this security context was selected for two reasons:¶

1. The use of symmetric keys allows this security context to be used in places where an asymmetric-key infrastructure (such as a public key infrastructure) might be impractical.¶
2. The combination HMAC-SHA2 represents a well-supported and well-understood integrity mechanism with multiple implementations available.¶

BIB-HMAC-SHA2 supports three variants of HMAC-SHA, based on the supported length of the SHA-2 hash value. These variants correspond to HMAC 256/256, HMAC 384/384, and HMAC 512/512 as defined in Table 7 ("HMAC Algorithm Values") of [RFC8152]. The selection of which variant is used by this context is provided as a security context parameter.¶

The output of the HMAC MUST be equal to the size of the SHA2 hashing function: 256 bits for SHA-256, 384 bits for SHA-384, and 512 bits for SHA-512.¶

The BIB-HMAC-SHA2 security context MUST have the security context identifier specified in Section 5.1.¶

3.2. Scope

The scope of BIB-HMAC-SHA2 is the set of information used to produce the plaintext over which a keyed hash is calculated. This plaintext is termed the "Integrity-Protected Plaintext (IPPT)". The content of the IPPT is constructed as the concatenation of information whose integrity is being preserved from the BIB-HMAC-SHA2 security source to its security acceptor. There are five types of information that can be used in the generation of the IPPT, based on how broadly the concept of integrity is being applied. These five types of information, whether they are required, and why they are important for integrity are discussed as follows.¶

Security target contents

The contents of the block-type-specific data field of the security target MUST be included in the IPPT. Including this information protects the security target data and is considered the minimal, required set of information for an integrity service on the security target.¶

IPPT scope

The determination of which optional types of information were used when constructing the IPPT MUST always be included in the IPPT. Including this information ensures that the scope of the IPPT construction at a security source matches the scope of the IPPT construction at security verifiers and security acceptors.¶

Primary block

The primary block identifies a bundle, and once created, the contents of this block are immutable. Changes to the primary block associated with the security target indicate that the security target (and BIB) might no longer be in the correct bundle.¶

For example, if a security target and associated BIB are copied from one bundle to another bundle, the BIB might still contain a verifiable signature for the security target unless information associated with the bundle primary block is included in the keyed hash carried by the BIB.¶

Including this information in the IPPT protects the integrity of the association of the security target with a specific bundle.¶

Other fields of the security target

The other fields of the security target include block identification and processing information. Changing this information changes how the security target is treated by nodes in the network even when the "user data" of the security target are otherwise unchanged.¶

For example, if the block processing control flags of a security target are different at a security verifier than they were originally set at the security source, then the policy for handling the security target has been modified.¶

Including this information in the IPPT protects the integrity of the policy and identification of the security target data.¶

Other fields of the BIB

The other fields of the BIB include block identification and processing information. Changing this information changes how the BIB is treated by nodes in the network, even when other aspects of the BIB are unchanged.¶

For example, if the block processing control flags of the BIB are different at a security verifier than they were originally set at the security source, then the policy for handling the BIB has been modified.¶

Including this information in the IPPT protects the integrity of the policy and identification of the security service in the bundle.¶

The scope of the BIB-HMAC-SHA2 security context is configured using an optional security context parameter.¶

3.3. Parameters

BIB-HMAC-SHA2 can be parameterized to select SHA-2 variants, communicate key information, and define the scope of the IPPT.¶

3.6. Security Processing Considerations

An HMAC calculated over the same IPPT with the same key will always have the same value. This regularity can lead to practical side-channel attacks whereby an attacker could produce known plaintext, guess at an HMAC tag, and observe the behavior of a verifier. With a modest number of trials, a side-channel attack could produce an HMAC tag for attacker-provided plaintext without the attacker ever knowing the HMAC key.¶

A common method of observing the behavior of a verifier is precise analysis of the timing associated with comparisons. Therefore, one way to prevent behavior analysis of this type is to ensure that any comparisons of the supplied and expected authentication tag occur in constant time.¶

A constant-time comparison function SHOULD be used for the comparison of authentication tags by any implementation of this security context. In cases where such a function is difficult or impossible to use, the impact of side-channel attacks (in general) and timing attacks (specifically) need to be considered as part of the implementation.¶

3.8. Processing

4.1. Overview

The BCB-AES-GCM security context replaces the block-type-specific data field of its security target with ciphertext generated using the Advanced Encryption Standard (AES) cipher operating in Galois/Counter Mode (GCM) [AES-GCM]. The use of AES-GCM was selected as the cipher suite for this confidentiality mechanism for several reasons:¶

1. The selection of a symmetric-key cipher suite allows for relatively smaller keys than asymmetric-key cipher suites.¶
2. The selection of a symmetric-key cipher suite allows this security context to be used in places where an asymmetric-key infrastructure (such as a public key infrastructure) might be impractical.¶
3. The use of the Galois/Counter Mode produces ciphertext with the same size as the plaintext making the replacement of target block information easier as length fields do not need to be changed.¶
4. The AES-GCM cipher suite provides authenticated encryption, as required by the BPSec protocol.¶

Additionally, the BCB-AES-GCM security context generates an authentication tag based on the plaintext value of the block-type-specific data and other additional authenticated data (AAD) that might be specified via parameters to this security context.¶

This security context supports two variants of AES-GCM, based on the supported length of the symmetric key. These variants correspond to A128GCM and A256GCM as defined in Table 9 ("Algorithm Value for AES-GCM") of [RFC8152].¶

The BCB-AES-GCM security context MUST have the security context identifier specified in Section 5.1.¶

4.2. Scope

There are two scopes associated with BCB-AES-GCM: the scope of the confidentiality service and the scope of the authentication service. The first defines the set of information provided to the AES-GCM cipher for the purpose of producing ciphertext. The second defines the set of information used to generate an authentication tag.¶

The scope of the confidentiality service defines the set of information provided to the AES-GCM cipher for the purpose of producing ciphertext. This MUST be the full set of plaintext contained in the block-type-specific data field of the security target.¶

The scope of the authentication service defines the set of information used to generate an authentication tag carried with the security block. This information contains all data protected by the confidentiality service and the scope flags used to identify other optional information; it MAY include other information (additional authenticated data), as follows.¶

Primary block

The primary block identifies a bundle, and once created, the contents of this block are immutable. Changes to the primary block associated with the security target indicate that the security target (and BCB) might no longer be in the correct bundle.¶

For example, if a security target and associated BCB are copied from one bundle to another bundle, the BCB might still be able to decrypt the security target even though these blocks were never intended to exist in the copied-to bundle.¶

Including this information as part of additional authenticated data ensures that the security target (and security block) appear in the same bundle at the time of decryption as at the time of encryption.¶

Other fields of the security target

The other fields of the security target include block identification and processing information. Changing this information changes how the security target is treated by nodes in the network even when the "user data" of the security target are otherwise unchanged.¶

For example, if the block processing control flags of a security target are different at a security verifier than they were originally set at the security source, then the policy for handling the security target has been modified.¶

Including this information as part of additional authenticated data ensures that the ciphertext in the security target will not be used with a different set of block policy than originally set at the time of encryption.¶

Other fields of the BCB

The other fields of the BCB include block identification and processing information. Changing this information changes how the BCB is treated by nodes in the network, even when other aspects of the BCB are unchanged.¶

For example, if the block processing control flags of the BCB are different at a security acceptor than they were originally set at the security source, then the policy for handling the BCB has been modified.¶

Including this information as part of additional authenticated data ensures that the policy and identification of the security service in the bundle has not changed.¶

The scope of the BCB-AES-GCM security context is configured using an optional security context parameter.¶

4.3. Parameters

BCB-AES-GCM can be parameterized to specify the AES variant, initialization vector, key information, and identify additional authenticated data.¶

4.7. Canonicalization Algorithms

This section defines the canonicalization algorithms used to prepare the inputs used to generate both the ciphertext and the authentication tag.¶

In all cases, the canonical form of any portion of an extension block MUST be created as described in [RFC9172]. The canonicalization algorithms defined in [RFC9172] adhere to the canonical forms for extension blocks defined in [RFC9171] but resolve ambiguities related to how values are represented in CBOR.¶

4.8. Processing

5.2. Integrity Scope Flags

The BIB-HMAC-SHA2 security context has an Integrity Scope Flags field for which IANA has created and now maintains a new registry named "BPSec BIB-HMAC-SHA2 Integrity Scope Flags" on the "Bundle Protocol" registry page. Table 9 shows the initial values for this registry.¶

The registration policy for this registry is Specification Required [RFC8126].¶

The value range is unsigned 16-bit integer.¶

5.3. AAD Scope Flags

The BCB-AES-GCM security context has an AAD Scope Flags field for which IANA has created and now maintains a new registry named "BPSec BCB-AES-GCM AAD Scope Flags" on the "Bundle Protocol" registry page. Table 10 shows the initial values for this registry.¶

The registration policy for this registry is Specification Required.¶

The value range is unsigned 16-bit integer.¶

5.4. Guidance for Designated Experts

New assignments within the "BPSec BIB-HMAC-SHA2 Integrity Scope Flags" and "BPSec BCB-AES-GCM AAD Scope Flags" registries require review by a Designated Expert (DE). This section provides guidance to the DE when performing their reviews. Specifically, a DE is expected to perform the following activities.¶

• Ascertain the existence of suitable documentation (a specification) as described in [RFC8126] and verify that the document is permanently and publicly available.¶
• Ensure that any changes to the "BPSec BIB-HMAC-SHA2 Integrity Scope Flags" registry clearly state how new assignments interact with existing flags and how the inclusion of new assignments affects the construction of the IPPT value.¶
• Ensure that any changes to the "BPSec BCB-AES-GCM AAD Scope Flags" registry clearly state how new assignments interact with existing flags and how the inclusion of new assignments affects the construction of the AAD input to the BCB-AES-GCM mechanism.¶
• Ensure that any processing changes proposed with new assignments do not alter any required behavior in this specification.¶

6.1. Key Management

The delayed and disrupted nature of Delay-Tolerant Networking (DTN) complicates the process of key management because there might not be reliable, timely, round-trip exchange between security sources, security verifiers, and security acceptors in the network. This is true when there is a substantial signal propagation delay between nodes, when nodes are in a highly challenged communications environment, and when nodes do not support bidirectional communication.¶

In these environments, key establishment protocols that rely on round-trip information exchange might not converge on a shared secret in a timely manner (or at all). Also, key revocation or key verification mechanisms that rely on access to a centralized authority (such as a certificate authority) might similarly fail in the stressing conditions of DTN.¶

For these reasons, the default security contexts described in this document rely on symmetric-key cryptographic mechanisms because asymmetric-key infrastructure (such as a public key infrastructure) might be impractical in this environment.¶

BPSec assumes that "key management is handled as a separate part of network management" [RFC9172]. This assumption is also made by the security contexts defined in this document, which do not define new protocols for key derivation, exchange of KEKs, revocation of existing keys, or the security configuration or policy used to select certain keys for certain security operations.¶

Nodes using these security contexts need to perform the following kinds of activities, independent of the construction, transmission, and processing of BPSec security blocks.¶

• Establish shared KEKs with other nodes in the network using an out-of-band mechanism. This might include pre-sharing of KEKs or the use of older key establishment mechanisms prior to the exchange of BPSec security blocks.¶
• Determine when a key is considered exhausted and no longer to be used in the generation, verification, or acceptance of a security block.¶
• Determine when a key is considered invalid and no longer to be used in the generation, verification, or acceptance of a security block. Such revocations can be based on a variety of mechanisms, including local security policy, time relative to the generation or use of the key, or other mechanisms specified through network management.¶
• Determine, through an out-of-band mechanism such as local security policy, what keys are to be used for what security blocks. This includes the selection of which key should be used in the evaluation of a security block received by a security verifier or a security acceptor.¶

The failure to provide effective key management techniques appropriate for the operational networking environment can result in the compromise of those unmanaged keys and the loss of security services in the network.¶

6.2. Key Handling

Once generated, keys should be handled as follows.¶

• It is strongly RECOMMENDED that implementations protect keys both when they are stored and when they are transmitted.¶
• In the event that a key is compromised, any security operations using a security context associated with that key SHOULD also be considered compromised. This means that the BIB-HMAC-SHA2 security context SHOULD NOT be treated as providing integrity when used with a compromised key, and BCB-AES-GCM SHOULD NOT be treated as providing confidentiality when used with a compromised key.¶
• The same key, whether a KEK or a wrapped key, MUST NOT be used for different algorithms as doing so might leak information about the key.¶
• A KEK MUST NOT be used to encrypt keys for different security contexts. Any KEK used by a security context defined in this document MUST only be used to wrap keys associated with security operations using that security context. This means that a compliant security source would not use the same KEK to wrap keys for both the BIB-HMAC-SHA2 and BCB-AES-GCM security contexts. Similarly, any compliant security verifier or security acceptor would not use the same KEK to unwrap keys for different security contexts.¶

6.3. AES GCM

There are a significant number of considerations related to the use of the GCM mode of AES to provide a confidentiality service. These considerations are provided in Section 4.6 as part of the documentation of the BCB-AES-GCM security context.¶

The length of the ciphertext produced by the GCM mode of AES will be equal to the length of the plaintext input to the cipher suite. The authentication tag also produced by this cipher suite is separate from the ciphertext. However, it should be noted that implementations of the AES-GCM cipher suite might not separate the concept of ciphertext and authentication tag in their Application Programming Interface (API).¶

Implementations of the BCB-AES-GCM security context can either keep the length of the target block unchanged by holding the authentication tag in a BCB security result or alter the length of the target block by including the authentication tag with the ciphertext replacing the block-type-specific data field of the target block. Implementations MAY use the authentication tag security result in cases where keeping target block length unchanged is an important processing concern. In all cases, the ciphertext and authentication tag MUST be processed in accordance with the API of the AES-GCM cipher suites at the security source and security acceptor.¶

6.4. AES Key Wrap

The AES-KW algorithm used by the security contexts in this document does not use a per-invocation initialization vector and does not require any key padding. Key padding is not needed because wrapped keys used by these security contexts will always be multiples of 8 bytes. The length of the wrapped key can be determined by inspecting the security context parameters. Therefore, a key can be unwrapped using only the information present in the security block and the KEK provided by local security policy at the security verifier or security acceptor.¶

6.5. Bundle Fragmentation

Bundle fragmentation might prevent security services in a bundle from being verified after a bundle is fragmented and before the bundle is re-assembled. Examples of potential issues include the following.¶

• If a security block and its security target do not exist in the same fragment, then the security block cannot be processed until the bundle is re-assembled. If a fragment includes an encrypted target block, but not its BCB, then a receiving Bundle Protocol Agent (BPA) will not know that the target block has been encrypted.¶
• A security block can be cryptographically bound to a bundle by setting the integrity scope flags (for BIB-HMAC-SHA2) or the AAD scope flags (for BCB-AES-GCM) to include the bundle primary block. When a security block is cryptographically bound to a bundle, it cannot be processed even if the security block and target both coexist in the fragment. This is because fragments have different primary blocks than the original bundle.¶
• If security blocks and their target blocks are repeated in multiple fragments, policy needs to determine how to deal with issues where a security operation verifies in one fragment but fails in another fragment. This might happen, for example, if a BIB block becomes corrupted in one fragment but not in another fragment.¶

Implementors should consider how security blocks are processed when a BPA fragments a received bundle. For example, security blocks and their targets could be placed in the same fragment if the security block is not otherwise cryptographically bound to the bundle being fragmented. Alternatively, if security blocks are cryptographically bound to a bundle, then a fragmenting BPA should consider encapsulating the bundle first and then fragmenting the encapsulating bundle.¶

A.1. Example 1 - Simple Integrity

This example shows the addition of a BIB to a sample bundle to provide integrity for the payload block.¶

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Payload Block                         |   1   |    1   |
+----------------------------------------+-------+--------+

[
  7,           / BP version            /
  0,           / flags                 /
  0,           / CRC type              /
  [2, [1,2]],  / destination (ipn:1.2) /
  [2, [2,1]],  / source      (ipn:2.1) /
  [2, [2,1]],  / report-to   (ipn:2.1) /
  [0, 40],     / timestamp             /
  1000000      / lifetime              /
]

0x88070000820282010282028202018202820201820018281a000f4240

0x526561647920746f2067656e657261746520612033322d62797465207061796c6f
6164

[
  1,                       / type code: Payload block       /
  1,                       / block number                   /
  0,                       / block processing control flags /
  0,                       / CRC type                       /
  h'526561647920746f206765 / type-specific-data: payload    /
  6e657261746520612033322d
  62797465207061796c6f6164'
]

0x85010100005823526561647920746f2067656e657261746520612033322d627974
65207061796c6f6164

0x9f88070000820282010282028202018202820201820018281a000f424085010100
005823526561647920746f2067656e657261746520612033322d6279746520706179
6c6f6164ff

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Block Integrity Block                 |   11  |    2   |
|  OP(bib-integrity, target=1)           |       |        |
+----------------------------------------+-------+--------+
|  Payload Block                         |   1   |    1   |
+----------------------------------------+-------+--------+

 Key         : h'1a2b1a2b1a2b1a2b1a2b1a2b1a2b1a2b'
 SHA Variant : HMAC 512/512
 Scope Flags : 0x00
 Payload Data: h'526561647920746f2067656e65726174
                 6520612033322d62797465207061796c
                 6f6164'
 IPPT        : h'005823526561647920746f2067656e65
                 7261746520612033322d627974652070
                 61796c6f6164'
 Signature   : h'3bdc69b3a34a2b5d3a8554368bd1e808
                 f606219d2a10a846eae3886ae4ecc83c
                 4ee550fdfb1cc636b904e2f1a73e303d
                 cd4b6ccece003e95e8164dcc89a156e1'

[1],           / Security Target        - Payload block       /
1,             / Security Context ID    - BIB-HMAC-SHA2       /
1,             / Security Context Flags - Parameters Present  /
[2,[2, 1]],    / Security Source        - ipn:2.1             /
[              / Security Parameters    - 2 Parameters        /
   [1, 7],     / SHA Variant            - HMAC 512/512        /
   [3, 0x00]   / Scope Flags            - No Additional Scope /
],
[              / Security Results: 1 Result                   /
  [            / Target 1 Results                             /
    [1, h'3bdc69b3a34a2b5d3a8554368bd1e808         / MAC      /
          f606219d2a10a846eae3886ae4ecc83c
          4ee550fdfb1cc636b904e2f1a73e303d
          cd4b6ccece003e95e8164dcc89a156e1']
  ]
]

0x810101018202820201828201078203008181820158403bdc69b3a34a2b5d3a8554
368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550fdfb1cc636b904e2f1a7
3e303dcd4b6ccece003e95e8164dcc89a156e1

[
  11, / type code    /
  2,  / block number /
  0,  / flags        /
  0,  / CRC type     /
  h'810101018202820201828201078203008181820158403bdc69b3a34a
  2b5d3a8554368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550
  fdfb1cc636b904e2f1a73e303dcd4b6ccece003e95e8164dcc89a156e1'
]

0x850b0200005856810101018202820201828201078203008181820158403bdc69b3
a34a2b5d3a8554368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550fdfb1c
c636b904e2f1a73e303dcd4b6ccece003e95e8164dcc89a156e1

0x9f88070000820282010282028202018202820201820018281a000f4240850b0200
005856810101018202820201828201078203008181820158403bdc69b3a34a2b5d3a
8554368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550fdfb1cc636b904e2
f1a73e303dcd4b6ccece003e95e8164dcc89a156e185010100005823526561647920
746f2067656e657261746520612033322d62797465207061796c6f6164ff

A.2. Example 2 - Simple Confidentiality with Key Wrap

This example shows the addition of a BCB to a sample bundle to provide confidentiality for the payload block. AES key wrap is used to transmit the symmetric key used to generate the security results for this service.¶

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Payload Block                         |   1   |    1   |
+----------------------------------------+-------+--------+

0x88070000820282010282028202018202820201820018281a000f4240

0x85010100005823526561647920746f2067656e657261746520612033322d627974
65207061796c6f6164

0x9f88070000820282010282028202018202820201820018281a000f424085010100
005823526561647920746f2067656e657261746520612033322d6279746520706179
6c6f6164ff

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Block Confidentiality Block           |   12  |    2   |
|  OP(bcb-confidentiality, target=1)     |       |        |
+----------------------------------------+-------+--------+
|  Payload Block (Encrypted)             |   1   |    1   |
+----------------------------------------+-------+--------+

 Content Encryption
                Key: h'71776572747975696f70617364666768'
 Key Encryption Key: h'6162636465666768696a6b6c6d6e6f70'
                 IV: h'5477656c7665313231323132'
        AES Variant: A128GCM
    AES Wrapped Key: h'69c411276fecddc4780df42c8a2af892
                       96fabf34d7fae700'
        Scope Flags: 0x00
       Payload Data: h'526561647920746f2067656e65726174
                       6520612033322d62797465207061796c
                       6f6164'
                AAD: h'00'
 Authentication Tag: h'efa4b5ac0108e3816c5606479801bc04'
 Payload Ciphertext: h'3a09c1e63fe23a7f66a59c7303837241
                       e070b02619fc59c5214a22f08cd70795
                       e73e9a'

[1],               / Security Target        - Payload block       /
2,                 / Security Context ID    - BCB-AES-GCM         /
1,                 / Security Context Flags - Parameters Present  /
[2,[2, 1]],        / Security Source        - ipn:2.1             /
[                  / Security Parameters    - 4 Parameters        /
  [1, h'5477656c7665313231323132'], / Initialization Vector       /
  [2, 1],                           / AES Variant - A128GCM       /
  [3, h'69c411276fecddc4780df42c8a  / AES wrapped key             /
        2af89296fabf34d7fae700'],
  [4, 0x00]                         / Scope Flags - No extra scope/
],
[                                   /  Security Results: 1 Result /
  [                                 /  Target 1 Results           /
    [1, h'efa4b5ac0108e3816c5606479801bc04']  / Payload Auth. Tag /
  ]
]

0x8101020182028202018482014c5477656c76653132313231328202018203581869
c411276fecddc4780df42c8a2af89296fabf34d7fae7008204008181820150efa4b5
ac0108e3816c5606479801bc04

[
  12, / type code                                          /
  2,  / block number                                       /
  1,  / flags - block must be replicated in every fragment /
  0,  / CRC type                                           /
  h'8101020182028202018482014c5477656c766531323132313282020182035818
    69c411276fecddc4780df42c8a2af89296fabf34d7fae7008204008181820150
    efa4b5ac0108e3816c5606479801bc04'
]

0x850c02010058508101020182028202018482014c5477656c766531323132313282
02018203581869c411276fecddc4780df42c8a2af89296fabf34d7fae70082040081
81820150efa4b5ac0108e3816c5606479801bc04

0x9f88070000820282010282028202018202820201820018281a000f4240850c0201
0058508101020182028202018482014c5477656c7665313231323132820201820358
1869c411276fecddc4780df42c8a2af89296fabf34d7fae7008204008181820150ef
a4b5ac0108e3816c5606479801bc04850101000058233a09c1e63fe23a7f66a59c73
03837241e070b02619fc59c5214a22f08cd70795e73e9aff

A.3. Example 3 - Security Blocks from Multiple Sources

This example shows the addition of a BIB and BCB to a sample bundle. These two security blocks are added by two different nodes. The BCB is added by the source endpoint, and the BIB is added by a forwarding node.¶

The resulting bundle contains a BCB to encrypt the Payload Block and a BIB to provide integrity to the primary block and Bundle Age Block.¶

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Extension Block: Bundle Age Block     |   7   |    2   |
+----------------------------------------+-------+--------+
|  Payload Block                         |   1   |    1   |
+----------------------------------------+-------+--------+

0x88070000820282010282028202018202820201820018281a000f4240

[
  7,      / type code: Bundle Age Block    /
  2,      / block number                   /
  0,      / block processing control flags /
  0,      / CRC type                       /
  <<300>> / type-specific-data: age        /
]

0x85070200004319012c

0x85010100005823526561647920746f2067656e657261746520612033322d627974
65207061796c6f6164

0x9f88070000820282010282028202018202820201820018281a000f424085070200
004319012c85010100005823526561647920746f2067656e65726174652061203332
2d62797465207061796c6f6164ff

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Block Integrity Block                 |   11  |    3   |
|  OP(bib-integrity, targets=0, 2)       |       |        |
+----------------------------------------+-------+--------+
|  Block Confidentiality Block           |   12  |    4   |
|  OP(bcb-confidentiality, target=1)     |       |        |
+----------------------------------------+-------+--------+
|  Extension Block: Bundle Age Block     |   7   |    2   |
+----------------------------------------+-------+--------+
|  Payload Block (Encrypted)             |   1   |    1   |
+----------------------------------------+-------+--------+

                Key: h'1a2b1a2b1a2b1a2b1a2b1a2b1a2b1a2b'
        SHA Variant: HMAC 256/256
        Scope Flags: 0x00
 Primary Block Data: h'88070000820282010282028202018202
                       820201820018281a000f4240'
 Bundle Age Block
               Data: h'4319012c'
 Primary Block IPPT: h'00581c88070000820282010282028202
                       018202820201820018281a000f4240'
Bundle Age Block
               IPPT: h'004319012c'
 Primary Block
          Signature: h'cac6ce8e4c5dae57988b757e49a6dd14
                       31dc04763541b2845098265bc817241b'
 Bundle Age Block
          Signature: h'3ed614c0d97f49b3633627779aa18a33
                       8d212bf3c92b97759d9739cd50725596'

[0, 2],         / Security Targets                             /
1,              / Security Context ID    - BIB-HMAC-SHA2       /
1,              / Security Context Flags - Parameters Present  /
[2,[3, 0]],     / Security Source        - ipn:3.0             /
[               / Security Parameters    - 2 Parameters        /
   [1, 5],      / SHA Variant            - HMAC 256            /
   [3, 0]       / Scope Flags            - No Additional Scope /
],
[               / Security Results: 2 Results                  /
   [            / Primary Block Results                        /
       [1, h'cac6ce8e4c5dae57988b757e49a6dd14
             31dc04763541b2845098265bc817241b']       / MAC    /
    ],
    [           / Bundle Age Block Results                     /
       [1, h'3ed614c0d97f49b3633627779aa18a33
             8d212bf3c92b97759d9739cd50725596']       / MAC    /
    ]
]

0x8200020101820282030082820105820300828182015820cac6ce8e4c5dae57988b
757e49a6dd1431dc04763541b2845098265bc817241b81820158203ed614c0d97f49
b3633627779aa18a338d212bf3c92b97759d9739cd50725596

[
  11, / type code    /
  3,  / block number /
  0,  / flags        /
  0,  / CRC type     /
  h'8200020101820282030082820105820300828182015820cac6ce8e4c5dae5798
  8b757e49a6dd1431dc04763541b2845098265bc817241b81820158203ed614c0d9
  7f49b3633627779aa18a338d212bf3c92b97759d9739cd50725596'
]

0x850b030000585c8200020101820282030082820105820300828182015820cac6ce
8e4c5dae57988b757e49a6dd1431dc04763541b2845098265bc817241b8182015820
3ed614c0d97f49b3633627779aa18a338d212bf3c92b97759d9739cd50725596

 Content Encryption
                Key: h'71776572747975696f70617364666768'
                 IV: h'5477656c7665313231323132'
        AES Variant: A128GCM
        Scope Flags: 0x00
       Payload Data: h'526561647920746f2067656e65726174
                       6520612033322d62797465207061796c
                       6f6164'
                AAD: h'00'
 Authentication Tag: h'efa4b5ac0108e3816c5606479801bc04'
 Payload Ciphertext: h'3a09c1e63fe23a7f66a59c7303837241
                       e070b02619fc59c5214a22f08cd70795
                       e73e9a'

[1],             / Security Target        - Payload block      /
2,               / Security Context ID    - BCB-AES-GCM        /
1,               / Security Context Flags - Parameters Present /
[2,[2, 1]],      / Security Source        - ipn:2.1            /
[                / Security Parameters    - 3 Parameters       /
  [1, h'5477656c7665313231323132'],    / Initialization Vector /
  [2, 1],                              / AES Variant - AES 128 /
  [4, 0]                   / Scope Flags - No Additional Scope /
],
[                                 / Security Results: 1 Result /
  [
     [1, h'efa4b5ac0108e3816c5606479801bc04'] / Payload Auth. Tag /
  ]
]

0x8101020182028202018382014c5477656c76653132313231328202018204008181
820150efa4b5ac0108e3816c5606479801bc04

[
  12, / type code                                          /
  4,  / block number                                       /
  1,  / flags - block must be replicated in every fragment /
  0,  / CRC type                                           /
  h'8101020182028202018382014c5477656c766531323132313282020182040081
    81820150efa4b5ac0108e3816c5606479801bc04'
]

0x850c04010058348101020182028202018382014c5477656c766531323132313282
02018204008181820150efa4b5ac0108e3816c5606479801bc04

0x9f88070000820282010282028202018202820201820018281a000f4240850b0300
00585c8200020101820282030082820105820300828182015820cac6ce8e4c5dae57
988b757e49a6dd1431dc04763541b2845098265bc817241b81820158203ed614c0d9
7f49b3633627779aa18a338d212bf3c92b97759d9739cd50725596850c0401005834
8101020182028202018382014c5477656c7665313231323132820201820400818182
0150efa4b5ac0108e3816c5606479801bc0485070200004319012c85010100005823
3a09c1e63fe23a7f66a59c7303837241e070b02619fc59c5214a22f08cd70795e73e
9aff

A.4. Example 4 - Security Blocks with Full Scope

This example shows the addition of a BIB and BCB to a sample bundle. A BIB is added to provide integrity over the payload block, and a BCB is added for confidentiality over the payload and BIB.¶

The integrity scope and additional authentication data will bind the primary block, target header, and the security header.¶

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Payload Block                         |   1   |    1   |
+----------------------------------------+-------+--------+

0x88070000820282010282028202018202820201820018281a000f4240

0x85010100005823526561647920746f2067656e657261746520612033322d627974
65207061796c6f6164

0x9f88070000820282010282028202018202820201820018281a000f424085010100
005823526561647920746f2067656e657261746520612033322d6279746520706179
6c6f6164ff

                  Block                    Block   Block
                in Bundle                  Type    Number
+========================================+=======+========+
|  Primary Block                         |  N/A  |    0   |
+----------------------------------------+-------+--------+
|  Block Integrity Block (Encrypted)     |   11  |    3   |
|  OP(bib-integrity, target=1)           |       |        |
+----------------------------------------+-------+--------+
|  Block Confidentiality Block           |   12  |    2   |
|  OP(bcb-confidentiality, targets=1, 3) |       |        |
+----------------------------------------+-------+--------+
|  Payload Block (Encrypted)             |   1   |    1   |
+----------------------------------------+-------+--------+

               Key: h'1a2b1a2b1a2b1a2b1a2b1a2b1a2b1a2b'
       SHA Variant: HMAC 384/384
       Scope Flags: 0x07  (all additional headers)
Primary Block Data: h'88070000820282010282028202018202
                      820201820018281a000f4240'
      Payload Data: h'526561647920746f2067656e65726174
                      6520612033322d62797465207061796c
                      6f6164'
    Payload Header: h'010100'
        BIB Header: h'0b0300'
              IPPT: h'07880700008202820102820282020182
                      02820201820018281a000f4240010100
                      0b03005823526561647920746f206765
                      6e657261746520612033322d62797465
                      207061796c6f6164'
 Payload Signature: h'f75fe4c37f76f046165855bd5ff72fbf
                      d4e3a64b4695c40e2b787da005ae819f
                      0a2e30a2e8b325527de8aefb52e73d71,

[1],           / Security Target          - Payload block          /
1,             / Security Context ID      - BIB-HMAC-SHA2          /
1,             / Security Context Flags   - Parameters Present     /
[2,[2, 1]],    / Security Source          - ipn:2.1                /
[              / Security Parameters      - 2 Parameters           /
   [1, 6],     / SHA Variant              - HMAC 384/384           /
   [3, 0x07]   / Scope Flags              - All additional headers /
],
[              / Security Results: 1 Result                        /
  [            / Target 1 Results                                  /
    [1, h'f75fe4c37f76f046165855bd5ff72fbf         / MAC           /
          d4e3a64b4695c40e2b787da005ae819f
          0a2e30a2e8b325527de8aefb52e73d71']
  ]
]

0x81010101820282020182820106820307818182015830f75fe4c37f76f046165855
bd5ff72fbfd4e3a64b4695c40e2b787da005ae819f0a2e30a2e8b325527de8aefb52
e73d71

[
  11, / type code    /
  3,  / block number /
  0,  / flags        /
  0,  / CRC type     /
  h'81010101820282020182820106820307818182015830f75fe4c37f76f0461658
    55bd5ff72fbfd4e3a64b4695c40e2b787da005ae819f0a2e30a2e8b325527de8
    aefb52e73d71'
]

0x850b030000584681010101820282020182820106820307818182015830f75fe4c3
7f76f046165855bd5ff72fbfd4e3a64b4695c40e2b787da005ae819f0a2e30a2e8b3
25527de8aefb52e73d71

               Key: h'71776572747975696f70617364666768
                      71776572747975696f70617364666768'
                IV: h'5477656c7665313231323132'
       AES Variant: A256GCM
       Scope Flags: 0x07  (All additional headers)
      Payload Data: h'526561647920746f2067656e65726174
                      6520612033322d62797465207061796c
                      6f6164'
          BIB Data: h'81010101820282020182820106820307
                      818182015830f75fe4c37f76f0461658
                      55bd5ff72fbfd4e3a64b4695c40e2b78
                      7da005ae819f0a2e30a2e8b325527de8
                      aefb52e73d71'
 Primary Block Data: h'88070000820282010282028202018202
                       820201820018281a000f4240'
     Payload Header: h'010100'
         BIB Header: h'0b0300'
         BCB Header: h'0c0201'
        Payload AAD: h'07880700008202820102820282020182
                       02820201820018281a000f4240010100
                       0c0201'
            BIB AAD: h'07880700008202820102820282020182
                       02820201820018281a000f42400b0300
                       0c0201'
     Payload Block
Authentication Tag: h'd2c51cb2481792dae8b21d848cede99b'
               BIB
Authentication Tag: h'220ffc45c8a901999ecc60991dd78b29'
Payload Ciphertext: h'90eab6457593379298a8724e16e61f83
                      7488e127212b59ac91f8a86287b7d076
                      30a122'
    BIB Ciphertext: h'438ed6208eb1c1ffb94d952175167df0
                      902902064a2983910c4fb2340790bf42
                      0a7d1921d5bf7c4721e02ab87a93ab1e
                      0b75cf62e4948727c8b5dae46ed2af05
                      439b88029191'

[3, 1],          / Security Targets                            /
2,               / Security Context ID    - BCB-AES-GCM        /
1,               / Security Context Flags - Parameters Present /
[2,[2, 1]],      / Security Source        - ipn:2.1            /
[                / Security Parameters    - 3 Parameters       /
  [1, h'5477656c7665313231323132'],    / Initialization Vector /
  [2, 3],                              / AES Variant - AES 256 /
  [4, 0x07]            / Scope Flags - All headers in SHA hash /
],
[                                / Security Results: 2 Results /
  [
     [1, h'220ffc45c8a901999ecc60991dd78b29']  / BIB Auth. Tag /
  ],
  [
     [1, h'd2c51cb2481792dae8b21d848cede99b'] / Payload Auth. Tag /
  ]
]

0x820301020182028202018382014c5477656c766531323132313282020382040782
81820150220ffc45c8a901999ecc60991dd78b2981820150d2c51cb2481792dae8b2
1d848cede99b

[
  12, / type code                                          /
  2,  / block number                                       /
  1,  / flags - block must be replicated in every fragment /
  0,  / CRC type                                           /
  h'820301020182028202018382014c5477656c7665313231323132820203820407
    8281820150220ffc45c8a901999ecc60991dd78b2981820150d2c51cb2481792
    dae8b21d848cede99b'
]

0x850c0201005849820301020182028202018382014c5477656c7665313231323132
8202038204078281820150220ffc45c8a901999ecc60991dd78b2981820150d2c51c
b2481792dae8b21d848cede99b

0x9f88070000820282010282028202018202820201820018281a000f4240850b0300
005846438ed6208eb1c1ffb94d952175167df0902902064a2983910c4fb2340790bf
420a7d1921d5bf7c4721e02ab87a93ab1e0b75cf62e4948727c8b5dae46ed2af0543
9b88029191850c0201005849820301020182028202018382014c5477656c76653132
313231328202038204078281820150220ffc45c8a901999ecc60991dd78b29818201
50d2c51cb2481792dae8b21d848cede99b8501010000582390eab6457593379298a8
724e16e61f837488e127212b59ac91f8a86287b7d07630a122ff