Subject: [Hipsec] New HIP_TRANSFORM

From: Robert Moskowitz <[email-masked]>
Date: Tue, 15 Dec 2009 11:16:42 -0500

Here are my recommended changes to HIP_TRANSFORM.  But I need some 
clearification.

First the new list:

         Suite ID                          Value

         RESERVED                          0
         AES-CBC with HMAC-SHA1            1     ([RFC3602], [RFC2404])
         3DES-CBC with HMAC-SHA1           2     ([RFC2451], [RFC2404])
         3DES-CBC with HMAC-MD5            3     ([RFC2451], [RFC2403])
         BLOWFISH-CBC with HMAC-SHA1       4     ([RFC2451], [RFC2404])
         NULL-ENCRYPT with HMAC-SHA1       5     ([RFC2410], [RFC2404])
         NULL-ENCRYPT with HMAC-MD5        6     ([RFC2410], [RFC2403])
         NULL-ENCRYPT with HMAC-SHA2       7     ([RFC2410], [RFC4868])
         AES-CBC with HMAC-SHA2            8     ([RFC3602], [RFC4868])
         AES-CCM-8                         9     [RFC4309]
         AES-CCM-12                        10    [RFC4309]
         AES-CCM-16                        11    [RFC4309]
         AES-GCM with a 8 octet ICV        12    [RFC4106]
         AES-GCM with a 12 octet ICV       13    [RFC4106]
         AES-GCM with a 16 octet ICV       14    [RFC4106]

This is two changes: Adding SHA2 (SHA2-256) and CCM and GCM.

We make #8 and #7 the Mandatory implementations. (currently the SHA1 
versions).

That is according to 5.2.7.

But in 5.3.2, it only states:

"All implementations MUST support the AES [RFC3602] with HMAC-SHA-1-96 
[RFC2404]."

Whereas 5.3.3 states:

"All implementations MUST support the AES transform [RFC3602]."

Quite a bit of inconsistancy.  Does NULL go out of 5.2.7, or added to 
5.3?  5.3.3 will be updated to be the same as 5.3.2.

Finally as for the actual list.

Do we leave number spaces for HMAC-FOO where FOO is the NIST Hash 
winner?  So that #8 and #10 are reserved?

Do we include all IV sizes for CCM and GCM?  I thought about making CCM 
the Manditory for 15.4 devices, or rather for any device where CCM is 
the MACsec cipher, but I figured that AES-CBC is a subset of AES-CCM, so 
you SHOULD have all the code there for AES-CBC anyway.  So I would 
RECOMMEND a SHOULD for AES-CCM or AES-GCM when they are the underlying 
MACsec cipher (GCM is specified in 802.1AE).

Note that I removed the reference to the IKEv2 RFC, replacing it with 
the RFCs that it references...

Comments?  Corrections?  Improvements?