Summary

  • RFC 6528 keeps TCP's advancing sequence-space discipline but hides the relationship between connections by adding a keyed function of the local and remote addresses and ports.
  • The design reduces blind, off-path prediction without becoming authentication; secret rotation, TIME-WAIT behavior, NAT leakage and ephemeral-port selection remain part of the control surface.

An initial sequence number has two jobs that pull in opposite directions. It should move forward so a new incarnation of a connection does not accept an old segment. It should also refuse to reveal where the next connection will begin. A single visible clock satisfies the first instinct while betraying the second.

RFC 793 suggested a global 32-bit generator that advanced by one roughly every four microseconds. The lifecycle problem was real, but RFC 6528 points out that TIME-WAIT and TCP's quiet-time rule already carry much of the stale-segment burden. Some BSD-derived stacks nevertheless used rising ISNs as a heuristic for admitting rapid reincarnations of the same connection. The clock therefore became both a compatibility habit and a prediction surface.

That predictability mattered because an off-path attacker did not always need to observe the reply. If the next server ISN could be estimated from a previous connection, the attacker could forge the final ACK of a three-way handshake and exploit a service that trusted the source address. The historical remote-login example has mostly yielded to SSH, but RFC 6528 notes that address-based trust still survives in other systems. The protocol defect and the application trust defect reinforced each other.

Selecting every ISN independently at random would frustrate prediction, but it could also break reincarnation heuristics that expect monotonic movement. Retaining state for every closed connection would restore safety at a memory cost. RFC 6528 chooses a third route: preserve progression inside a connection identity while making different identities look unrelated.

A private offset for every conversation

The recommendation is compact: ISN = M + F(localip, localport, remoteip, remoteport, secretkey). M is the four-microsecond timer. F is a pseudorandom function over the connection's four-tuple and a secret. The timer retains an advancing component; the keyed offset gives each local-address, local-port, remote-address and remote-port combination its own apparent sequence space.

The critical property is not that the function looks complicated. F must not be computable from outside. Otherwise an ISN observed on one connection becomes material for predicting another. The tuple is not secret, so protection rests on the key and on a function whose output cannot be reconstructed without it.

This separation avoids storing the history of every dead connection. Reusing a four-tuple still follows a progressing space because M advances, while a different tuple receives another offset. The mechanism is therefore not randomness pasted onto TCP; it is a compromise between sequence-space continuity and cross-connection opacity.

The secret has a lifecycle

RFC 6528 says a 128-bit key should be adequate for its threat model and allows a true random or per-host secret. It identifies rotation moments rather than one universal interval: bootstrap, elapsed time, or sufficient use. Those events are operational decisions, not harmless housekeeping.

Changing the secret changes the sequence space for reincarnated connections. If a system rotates without retaining dead-connection state, it may have to observe a quiet period of two maximum segment lifetimes. A security control that ignores TIME-WAIT can damage the lifecycle property it was meant to preserve.

The RFC discusses MD5 as an acceptable implementation option for this narrow off-path-guessing problem, while telling implementers to weigh stronger functions. That statement is bounded to this design and its 2012 threat model. It is not an endorsement of MD5 for authentication, signatures or any setting where its known weaknesses are decisive, nor evidence of what current operating systems deploy.

Good ISNs remain a palliative measure. An eavesdropper who sees the opening exchange learns the sequence state, and an on-path attacker already has stronger leverage. RFC 6528 names IPsec and TCP-AO as cryptographic authentication boundaries. It also records two adjacent effects: distinct ISN spaces may help count hosts behind a NAT, while randomized ephemeral ports make the target four-tuple harder to guess.

The sole source is RFC 6528, published on the Standards Track in February 2012. It obsoletes RFC 1948 and updates RFC 793. It specifies a way to reduce blind sequence prediction; it does not report current implementation defaults, key-rotation practice or attack frequency.