Subject: [Ipsec] Revising RFC 3664 (AES-XCBC-PRF-128)

From: Paul Hoffman <[email-masked]>
Date: Wed, 30 Mar 2005 13:41:21 -0800

Greetings again. One of the issues in the IKEv2 clarifications shows 
that we cannot currently use AES-XCBC-PRF-128 in almost any 
circumstance, even though the WG decided it was a SHOULD+. This is 
due to the fact that the base spec for it requires that the keys be 
exactly 128 bits. That might make sense for a MAC, but not for a PRF: 
none of our other PRFs make this requirement.

Thus, I'm proposing a short revision to AES-XCBC-PRF-128 (but not 
AES-XCBC-MAC-96). It actually causes no bits-on-the-wire differences 
from the current AES-XCBC-PRF-128; it just prevents rejection of many 
keys and tells how to handle those that would currently be rejected.

Comments are welcome.

>A New Internet-Draft is available from the on-line Internet-Drafts 
>directories.
>
>	Title		: The AES-XCBC-PRF-128 Algorithm for the Internet Key
>			  Exchange Protocol (IKE)
>	Author(s)	: P. Hoffman
>	Filename	: draft-hoffman-rfc3664bis-00.txt
>	Pages		: 4
>	Date		: 2005-3-30
>
>Some implementations of IP Security (IPsec) may want to use a
>    pseudo-random function derived from the Advanced Encryption Standard
>    (AES).  This document describes such an algorithm, called AES-XCBC-
>    PRF-128.
>
>A URL for this Internet-Draft is:
>http://www.ietf.org/internet-drafts/draft-hoffman-rfc3664bis-00.txt

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Fukumoto Atsushi <[email-masked]>
Date: Thu, 31 Mar 2005 13:32:50 +0900

draft-hoffman-rfc3664bis-00.txt states:
   o  The key length restriction of exactly 128 bits in [AES-XCBC-MAC]
      is changed.  The key for the AES-XCBC-PRF-128 algorithm is created
      using the formula in [HMAC-definition].  This brings
      AES-XCBC-PRF-128 in alignment with HMAC-SHA1 and HMAC-MD5 when
      used as PRFs in IKE.

I didn't understand which formula in [HMAC-definition] (RFC2104) this
is refering to.  RFC2104 states:
   The authentication key K can be of any length up to B, the
   block length of the hash function.  Applications that use keys longer
   than B bytes will first hash the key using H and then use the
   resultant L byte string as the actual key to HMAC.

But this assumes H to accept an arbitrary length of octets as its only
input.  What is the H for the case of AES-XCBC-PRF-128?

					FUKUMOTO Atsushi
					[email-masked]