Subject: [Hipsec] ESP_TRANSFORM (64-bit sequence number)

From: [email-masked] (Petri Jokela)
Date: Fri Jan 23 05:36:01 2004

The need for 64-bit sequence numbers was indicated with the E-bit in the 
HIP header. As discussed earlier on the HIPSEC list, this bit is now 
removed from the header and moved to the ESP_TRANSFORM parameter.

/petri

The new version of the ESP_TRANSFORM parameter:

6.2.7 ESP_TRANSFORM

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |             Type              |             Length            |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |E|          Reserved           |           Suite-ID #1         |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |          Suite-ID #2          |           Suite-ID #3         |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |          Suite-ID #n          |             Padding           |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

       Type           19
       Length         length in octets, excluding Type, Length, and 		 
                    padding
       E              One if the ESP transform requires 64-bit sequence
                      numbers
       Reserved       zero when sent, ignored when received
       Suite-ID       defines the ESP Suite to be used

    The following Suite-IDs are defined ([16],[19]):

          Suite-ID                          Value

          RESERVED                          0
          ESP-AES-CBC with HMAC-SHA1        1
          ESP-3DES-CBC with HMAC-SHA1       2
          ESP-3DES-CBC with HMAC-MD5        3
          ESP-BLOWFISH-CBC with HMAC-SHA1   4
          ESP-NULL with HMAC-SHA1           5
          ESP-NULL with HMAC-MD5            6

    There MUST NOT be more than six (6) ESP Suite-IDs in one
    ESP_TRANSFORM TLV. The limited number of Suite-IDs sets the maximum
    size of ESP_TRANSFORM TLV. The ESP_TRANSFORM MUST contain at least
    one of the mandatory Suite-IDs.

    Mandatory implementations: ESP-3DES-CBC with HMAC-SHA1 and ESP-NULL
    with HMAC-SHA1.

-- 
Petri Jokela                        Tel:    +358 9 299 2413
Research scientist                  Fax:    +358 9 299 3535
NomadicLab, Ericsson Research       Mobile: +358 44 299 2413
Oy L M Ericsson Ab                  email: [email-masked]