Subject: [Ipsec] AES for Quick Mode in IKE?

From: Russ Magee <[email-masked]>
Date: Tue, 11 Jan 2005 15:25:29 -0700

Hello,

According to RFC3602, Section 7.:

7.  IANA Considerations

    IANA has assigned Encryption Algorithm ID 7 to AES-CBC.
    IANA has assigned ESP Transform Identifier 12 to ESP_AES.

Am I correct in interpreting this to mean that AES-CBC, if used for 
encryption in IKE, uses Encryption Algorithm ID 7 [RFC2409, Appendix A]?

There appears to be no RFC detailing specifically how AES-CBC should be 
used in IKE, so can anyone please shed details on

1) How keying material is generated and used to yield keys during Phase
    1 for use in Quick Mode for AES-CBC. The RFCs would imply that it
    should be done identically to 3DES, feeding a PRF repeatedly and
    concatenating the results as described in [RFC2409, 5.3].

2) What other vendors (if any) have already implemented AES in IKE
    and details on their implementation that would affect
    interoperability.

Thanks very much,
-Russ Magee
  Wind River Systems

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Dan McDonald <[email-masked]>
Date: Tue, 11 Jan 2005 19:02:40 -0500

> encryption in IKE, uses Encryption Algorithm ID 7 [RFC2409, Appendix A]?

Yes.

>    concatenating the results as described in [RFC2409, 5.3].

I believe that is correct.  (Historical note - people should've specified
this with Blowfish, instead of fixing interoperable Blowfish at 128 bits.)

>    and details on their implementation that would affect

We haven't enabled AES in IKE yet, but it should be straightforward -
(esp. given our IKE code's lineage).

The biggest obstacle I see to interop is properly handling the Key Length
attribute in both Phase 1 and 2.  Also, to get your biggest security bang for
your buck, you should probably be using one of the newer and larger
Diffie-Hellman groups, as well as one of the SHA2 hashes.

I'm sure the testing event coming up in February will cover AES in IKEv1.

Dan

---

From: Joern Sierwald <[email-masked]>
Date: Wed, 12 Jan 2005 11:49:01 +0100

>    and details on their implementation that would affect

F-Secure (myself actually) has implemented AES for IKE and ESP,
and I have found it to be quite trivial. I have just added AES
to the list of algorithms. It doesn't need any special treatment,
compared to blowfish for instance. Maybe that's why nobody
bothered to write a document about it.

Jörn

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Wed, 12 Jan 2005 07:03:52 -0800

At 7:02 PM -0500 1/11/05, Dan McDonald wrote:
>We haven't enabled AES in IKE yet, but it should be straightforward

Many vendors find it so. VPNC has 19 products fully interoperating 
with AES, and are about to add more; see 
<http://www.vpnc.org/testing.html>.

--Paul Hoffman, Director
--VPN Consortium