Summary

  • A sender randomly selected one of two ECN-capable markings. Congestion changed either into the same CE value, removing information a receiver would need to fabricate an entirely clean feedback history.
  • The returned nonce sum was a cumulative one-bit check, not authentication, a congestion count or proof that a particular receiver had lied. Honest congestion required checking to stop and later resynchronize.
  • The experiment ended after limited deployment, not because its basic mechanism had been disproved. Releasing its reserved codepoint made room for different specified uses without eliminating coexistence obligations.

A retirement notice without a mathematical failure

The unusually useful sentence in the retirement story is the one that refuses to call the experiment broken. In January 2018, RFC 8311 said that ECN Nonce worked as specified. It also said that the mechanism had not reached widespread use. Both observations could be true, and together they mattered more than a simple verdict of success or failure.

The resource at issue was small: an interpretation of one codepoint in the two-bit Explicit Congestion Notification field. Keeping that interpretation available exclusively for an experiment nevertheless had a cost. Other experiments wanted the space, and other ways of checking congestion feedback were being considered. Publication alone could not establish that preserving the old reservation was the best use of it.

To understand what was being retired, start not with a dishonest receiver but with an honest router. The router's ordinary congestion mark deliberately discarded a distinction. The ECN Nonce sender retained that distinction elsewhere. This unequal access to information was the experiment's entire opportunity.

One output, two possible histories

The classic ECN framework in RFC 3168, published in September 2001, uses four encodings. Not-ECT is 00; ECT(1) is 01; ECT(0) is 10; Congestion Experienced, or CE, is 11. An ECN-capable packet can be marked CE rather than discarded when a router signals congestion. The TCP receiver echoes that condition with ECE, and the sender uses CWR to indicate its congestion response.

At classic ECN routers, both ECT values indicate that the packet can carry a congestion mark. A router changing ECT(0) to CE produces the same final value as one changing ECT(1) to CE. A receiver inspecting CE therefore cannot recover which ECT value the sender originally chose. The application data can arrive intact while that distinction disappears.

RFC 3540, the June 2003 Experimental specification by N. Spring, D. Wetherall and D. Ely, turned the distinction into a randomly chosen bit. The sender chose unpredictably between ECT(0) and ECT(1), retaining its own record. Routers could keep applying ordinary congestion marking; they did not have to participate in a new challenge protocol or decide whether the receiver deserved trust.

Suppose a receiver wanted to conceal a CE mark. Reporting that everything had arrived without congestion would also require reporting the right random history. Yet the packet no longer contained all that history. The sender could compare the feedback with what it had actually sent. A claim of clean delivery became testable without adding a central witness.

This was an information test, not an identity system. Nothing in the mark established who controlled a receiver, authenticated the path or made an uncooperative sender behave. The design addressed a particular mismatch between a sender's decisions and the congestion information supplied to it.

Why the answer had to remember earlier packets

Simply returning the random value from the latest packet would leave a gap. TCP acknowledgments can be delayed or lost, and a cumulative acknowledgment can cover several segments. If omitted acknowledgments also erased the obligation to account for earlier random values, evidence could disappear through the feedback schedule itself.

The nonce sum instead accumulated values modulo two: a parity, or XOR, result carried in the NS flag. It started at one. As the cumulative acknowledgment advanced over in-order data, the receiver incorporated the relevant nonce values. The sender kept expected cumulative sums indexed by original packet ending sequence numbers so that it could match an acknowledgment to the appropriate expectation.

Out-of-order data did not immediately alter the cumulative result; it contributed when the cumulative acknowledgment advanced over it. Nor did the specification define a separate nonce proof for every SACK block. Segment boundaries and acknowledgment progression were part of the interpretation. An isolated NS flag, detached from that history, was not a useful certificate.

One unseen unbiased random bit leaves a receiver with a one-in-two chance of guessing the correct parity. That is a useful uncertainty, but it is not certain detection on the first attempt. Additional independent erased randomness can create further detection opportunities. Repeated acknowledgments dependent on the same missing bit must not automatically be counted as fresh independent trials. The mechanism does not license an unconditional confidence calculation based merely on how many ACKs an observer has collected.

The sum also says little about the quantity of congestion. Parity compresses information; it does not count all marked packets or timestamp each mark. Better integrity and more detailed feedback are different design objectives, even when both improve the sender's decisions.

The honest case breaks the sum too

Erasure does not distinguish motives. An honest receiver seeing CE has also lost the original nonce value. RFC 3540 therefore has the receiver ignore missing nonce values, effectively treating them as zero, while setting ECE. The sender suspends nonce checking during the associated congestion recovery.

After reducing its window and sending new data with CWR, the sender can resynchronize when the relevant new-data acknowledgment arrives. The receiver's returned sum supplies the new reference; a one-bit offset can implement the adjustment. This does not reconstruct the erased bit. It prevents an admitted gap in the old history from making subsequent valid exchanges appear inconsistent forever.

Resynchronization is consequently part of the assurance, not an exemption bolted on to rescue a fragile detector. Without it, the very event ECN was meant to report would cause honest behavior to fail the test. Any account that presents the nonce as “wrong answer means cheating” has omitted the state in which the answer is being interpreted.

The 2003 rules also made retransmissions Not-ECT, with no nonce, and required synchronization to account for sender-selected non-ECT intervals. Those are historical conditions of this experiment. They should not be projected as a timeless prohibition on ECN experiments involving retransmissions or control packets; RFC 8311 subsequently relaxed those experimentation constraints.

A local response is not a finding of culpability

Checking and reacting were separate choices. RFC 3540 made checking optional and described the response to an incorrect nonce sum as local policy. When a sender acted on an incorrect result, the specification discussed at least the response appropriate to ECE, with potentially stronger reductions or ceasing to send ECT packets. It did not create a uniform punishment procedure.

There were concrete reasons to preserve that distinction. An unmarked IPv4 fragment could reveal the original nonce even if another fragment had been marked, weakening protection against concealment. Partial-segment acknowledgments required interpretation at the original segment boundary. IPv6 header bit errors could corrupt ECN information and produce an incorrect sum. A mismatch could reflect interference or error somewhere along the signaling path; it did not identify the person or organization responsible.

The random sequence did not have to meet cryptographic-strength requirements, but it could not be readily predictable from previously observed bits. Reusing the sequence for another purpose would undermine its intended information boundary. The specification explicitly supplied no additional connection-integrity protection. Even support detection was narrower than the word negotiation suggests: nonzero NS in initial handshake responses let the sender infer support, but the document said this was not negotiation.

These limitations do not make the experiment empty. They identify what its evidence could support. A sender could question a clean-feedback claim and adjust its own behavior. That is materially different from authenticating all feedback, attributing malice or enforcing a global conduct rule.

Deployment had to earn the reservation

By November 2006, RFC 4774 was examining alternate ECN semantics: how to identify them, deploy incrementally and coexist with classic or non-ECN routers and competing traffic. The question was not simply whether another encoding could be invented. It was whether independent implementations could agree on what an observed mark meant.

The August 2015 requirements in RFC 7560 considered more accurate congestion feedback and its integrity. They reported no known TCP-stack deployment using the nonce at that time, while treating honest cooperation and integrity as requirements that could be addressed by more than one mechanism. More feedback did not automatically require preservation of this particular check.

RFC 8311's later account acknowledged deployment in limited environments. It also reported a study using 2014 data: none of 581,711 tested IPv4 servers used both ECT values after ECN negotiation; four of 17,028 IPv6 servers did so, a result compatible with either nonce use or erroneous remarking. These are dated sample observations reported by that RFC, not a current Internet census or an independently reproduced measurement here.

The resulting decision concluded the experiment and explained RFC 3540's reclassification from Experimental to Historic. It did not assert that no implementation had ever existed. Rather, limited deployment no longer justified reserving ECT(1) solely for the nonce when alternative experiments and integrity approaches were available. The experiments enabled by RFC 8311 still needed appropriate IETF-stream Experimental RFCs and still faced congestion-control and coexistence responsibilities.

A later, distinct use appears in the January 2023 Experimental RFC 9331: ECT(1) identifies L4S traffic under that specification. The current IANA ECN Field registry retains the four encodings and points to the relevant experimental documents for ECT(1). A modern trace containing that value is therefore not, by itself, evidence of the old nonce exchange. This later specification demonstrates a change in meaning; it does not establish universal deployment, performance or safety.

The experiment's durable contribution is a bounded way to reason about trust. Keep evidence where the decision is made, test only what that evidence can establish, and admit the intervals where a valid test is impossible. Its retirement adds a parallel rule for shared protocol space: a working idea can deserve a place in history without retaining an indefinite claim on future choices.