draft-traviss-evil-byte-00 · Internet-Draft

The Evil Byte

A Security Octet for the IPv4 and IPv6 Headers. One bit was never going to be enough — this document obsoletes the RFC 3514 evil bit and replaces it with a full eight-bit Evil Rating, computed on the path and enforced by everyone.

Obsoletes: RFC 3514 (if approved)  ·  Intended status: Standards Track  ·  Target: 1 April 2027

Read the draft Try the formula How this becomes an RFC
--
/ 255

Your Evil Rating, as computed by this MITM

assessing…

Computed live, on this request, from Section 4: your network, transport, TLS version, a real reverse-DNS lookup, and the local time at your connection. No payload was read — see Section 4.5.2.

Abstract

Firewalls, intrusion detection systems, and similar devices continue to have difficulty distinguishing packets that have malicious intent from those that are merely unusual. RFC 3514 addressed this problem by defining a security flag in the IPv4 header, the “evil bit”, to be set by the sender of any packet with malicious intent. Twenty-four years of operational experience have shown that senders cannot be relied upon to set it, and that a single bit cannot express the range of Evil now observed on the Internet.

This document obsoletes the evil bit and replaces it with the Evil Byte: an eight-bit Evil Rating carried in every IPv4 and IPv6 packet, computed and set not by the sender but by a Morality-Inspecting Trusted Middleman (MITM) on the path, from a weighted product of the sender's Autonomous System, choice of protocols, content, name, and the time of day. Servers reject requests from Evil clients; clients discard responses from Evil servers; and the Evil of every Autonomous System is continuously re-estimated by an Elo rating system operated by a central Evil Rating Authority.

Design goals

Five goals, from Section 1.2 of the draft.

Resolution

Eight bits instead of one — a 128-fold improvement, or in the units of RFC 3514, seven more bits.

Independence

Computed by a third party on the path who has no stake in the outcome, not by the sender.

Consequence

Evil packets are refused, by servers and clients alike. An Evil Rating nobody acts on is just a statistic.

Memory

The Evil of a network accumulates over time and is shared with everyone, like a credit score.

Incentive

Deployment of IPv6 is rewarded, since nothing else has worked.

What's actually in it

Fourteen sections and five appendices. Some of the load-bearing parts:

§4 — the formula

ER = clamp(floor(16 × F_tamper × ∏ F_i^w_i + 0.5), 1, 255), across Autonomous System, protocol, transport, content, name, and time factors.

§6 — the Evil Rating Authority

A single central Elo system that rates every Autonomous System on Earth from the outcome of every exchange it hears about.

§7 — 666 Evil

A new HTTP 6xx status class, with a teapot-shaped fallback for servers that validate their status codes.

Appendix A — reference implementation

A complete, dependency-free Python module. This site's formula page is a faithful port of it.

Appendix C — test vectors

Nineteen worked examples, including what happens to a Meta Platforms request over QUIC at 3 a.m.

§9 — Avian carriers

How a MITM rates, and re-marks, a datagram taped to a pigeon.

Get involved

The draft is version -00 and has not yet been submitted to the IETF. It needs readers before it needs a sponsor.

Read the full draft See the road to publication