Subject: [Ipsec] Question about PRFs with fixed size key

From: [email-masked]
Date: Thu, 27 Jan 2005 09:42:50 +0200

Hi,

Section 2.15 of draft-ietf-ipsec-ikev2-17 says that "If the
negotiated prf takes a fixed size key, the shared secret MUST be
of that fixed size".

I found some earlier mails about this topic (from May 2003), and
got the understanding that this means that if the shared secret
is not of that fixed size, it simply can't be used, period; and
there's no padding, truncation, or other processing to make it
the correct size.

Could some of the IKEv2 gurus confirm that this interpretation
is indeed correct?

(This would imply that PRF_AES128_CBC can't be used with EAP
authentication, since RFC 3748 says that MSK is at least 64
octets (512 bytes), while PRF_AES128_CBC requires a 128-bit
key.)

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 27 Jan 2005 13:43:36 +0200

> there's no padding, truncation, or other processing to make it

That is my interpretation of the above text from the draft. The shared
secret MUST be exactly of that given size tobe able to be used in the

AUTH = prf(prf(Shared-secret, "Key Pad for IKEv2"), <msg octets>)

if PRF requires fixed key size.

> Could some of the IKEv2 gurus confirm that this interpretation

Yes, I think it is correct.

> octets (512 bytes), while PRF_AES128_CBC requires a 128-bit

I think the section 2.16 should be modified so that says that if fixed
length of the shared secret is required the MSK is truncated or padded
with zeros to get the shared secret used in the section 2.15.

The text in the 2.15 is mostly meant that if the adminstrator
configures the shared secret to be used with PRF_AES128_CBC in the
IKEv2, he should also configure the shared secret with proper length.
As the 2.16 was added nobody realized that in that case the shared
secret is not configured by the adminstrator but coming from the MSK. 
-- 
[email-masked]

---

From: Jari Arkko <[email-masked]>
Date: Thu, 27 Jan 2005 16:21:02 +0200

Tero Kivinen wrote:
> That is my interpretation of the above text from the draft.

Based on reading the text, that's also my interpretation.

> with zeros to get the shared secret used in the section 2.15.

I would support this suggestion.

> secret is not configured by the adminstrator but coming from the MSK. 

Right.

--Jari