Networking Security – Should UDP Data Payloads Include a CRC?

data integritynetworkingSecurity

For a company I used to work for, I had to implement a socket receiver that mostly took data in UDP form over a local connection from some specialized sensor hardware. The data in question was a well-formed UDP packet, but interestingly, the data payload always ended with a CRC16 checksum formed using the rest of the data.

I implemented the check on my end, as per the spec, but I always wondered if this was necessary. After all, doesn't the UDP protocol itself carry a 16-bit CRC? Therefore, although UDP packets can be lost or out-of-order, I was under the impression that they can not be corrupted without being discarded by the network hardware before they reach the OS's processes. Or is there some special use-case I'm missing?

It's worth adding that I was working in the defence industry, which as I'm sure you can imagine, likes to be super-explicit about everything like this, so I'm wondering whether it was just a case of "security OCD"…

Best Answer

The UDP protocol does not guarantee that messages are delivered in order or delivered at all, but it does ensure that those messages which do get delivered are complete and unchanged by automatically including a 16-bit checksum. That means adding another 16-bit checksum on the application layer is usually redundant.

...usually....

First, with IPv4 (not IPv6), the checksum is optional. That means you might be using an exotic configuration which doesn't do checksum generation and validation (but in that case you should rather fix your network stack instead of jury-rigging this on the application layer).

Second, with a 16bit checksum there is a one in 65536 chance that a completely random message happens to have a valid checksum. When this margin of error is too large for your use-case (and in the defense industry I could imagine several where it is), adding another CRC-16 checksum would further reduce it. But in that case you might consider to use a proper message digest like SHA-256 instead of CRC-16. Or go all the way and use a real cryptographic signature. This protects not just against random corruption but also intentional corruption by an attacker.

Third, depending on where the data comes from and where it goes to, it might be corrupted before or after being sent over the network. In that case the additional checksum inside the message might protect the integrity of the message further than just between the two network hosts.