Subject: [Hipsec] clarifications to the base draft

From: [email-masked] (Miika Komu)
Date: Thu Apr 7 16:11:02 2005

Thomas asked for Jeff and me to make some (interop related) clarifications
to the text about ENCRYPTED and HMAC calculation. Here's what we came up:

6.2.16  ENCRYPTED

  <ascii graphics here>

  The ENCRYPTED parameter encapsulates another TLV, the encrypted data,
  which is also in TLV format. Consequently, the first fields in the
  encapsulated parameter(s) are Type and Length, allowing the contents to
  be easily parsed after decryption.

  Both the ENCRYPTED parameter and the encapsulated TLV(s) MUST be padded.
  The padding needed for the ENCRYPTED parameter is referred as the
  "outer" padding. Correspondingly, the padding for the parameter(s)
  encapsulated within the ENCRYPTED parameter is referred as the "inner"
  padding.

  The inner padding follows exactly the rules of Section 6.2.1. The outer
  padding also follows the same rules but with an exception. Namely, some
  algorithms require that the data to be encrypted must be a multiple of
  the cipher algorithm block size. In this case, the outer padding MUST
  include extra padding, as specified by the encryption algorithm. The
  size of the extra padding is selected so that the the length of the
  ENCRYPTED is the minimum value that is both multiple of eight and the
  cipher block size. The encryption algorithm may specify padding bytes
  other than zero; for example, AES [AES] uses the PKCS5 padding scheme
  [PKCS5] (see section 6.1.1) where the remaining n bytes to fill the
  block each have the value n.

  Note that the length of the cipher suite output may be smaller or larger
  than the length of the data to be encrypted, since the encryption
  process may compress the data or add additional padding to the data.

6.2.17  NOTIFY

  ..

8.3.1  HMAC calculation

  The following process applies both to the HMAC and HMAC_2 TLVs.  When
  processing HMAC_2, the difference is that the HMAC calculation
  includes a pseudo HOST_ID field containing the Responder's
  information as sent in the R1 packet earlier.

  Both the initiator and the responder should take some care when
  verifying or calculating the HMAC_2. Specifically, the responder should
  preserve other parameters than the HOST_ID when sending the R2. Also,
  the Initiator has to preserve the HOST_ID exactly as it was received in
  the R1 packet.

  The HMAC TLV is defined in Section 6.2.10 and HMAC_2 TLV in
  Section 6.2.11. HMAC calculation and verification process:

  ..

References:

  [PKCS5] ftp://ftp.rfc-editor.org/in-notes/rfc2898.txt
  [AES]   National Institute of Standards and Technology, U.S.
          Department of Commerce, "Advanced Encryption Standard",
          Federal Information Processing Standards Publication 197,
          Washington, DC, November 2001.

-- 
Miika Komu              [email-masked]          http://www.iki.fi/miika/