Subject: [Ipsec] IKEv2 MAC includes 4 octets of zero ?

From: Mohan Parthasarathy <[email-masked]>
Date: Tue, 21 Jun 2005 18:25:55 -0700 (PDT)

Hi,

In section 3.1 of the IKEv2 draft, it states that:

IKE messages use UDP ports 500 and/or 4500, with one
IKE message per
   UDP datagram. Information from the beginning of the
packet through
   the UDP header is largely ignored except that the
IP addresses and
   UDP ports from the headers are reversed and used
for return packets.
   When sent on UDP port 500, IKE messages begin
immediately following
   the UDP header. When sent on UDP port 4500, IKE
messages have
   prepended four octets of zero.  These four octets
of zero are not
   part of the IKE message and are not included in any
of the length
   fields or checksums defined by IKE.

In the clarification draft,

       InitiatorSignedOctets = RealMessage1 |
NonceRData | MACedIDForI
       GenIKEHDR = [ four octets 0 if using port 4500
] | RealIKEHDR

Which is right ? Interestingly, both RFC 3947 and 3948
are slient about it.

-mohan

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked]
Date: Wed, 22 Jun 2005 15:44:53 +0300

Mohan Parthasarathy wrote:
>   IKE messages use UDP ports 500 and/or 4500, with one IKE
>   message per UDP datagram. Information from the beginning of
>   the packet through the UDP header is largely ignored except
>   that the IP addresses and UDP ports from the headers are
>   reversed and used for return packets.  When sent on UDP port
>   500, IKE messages begin immediately following the UDP
>   header. When sent on UDP port 4500, IKE messages have
>   prepended four octets of zero.  These four octets of zero are
>   not part of the IKE message and are not included in any of the
>   length fields or checksums defined by IKE.
> 
>   InitiatorSignedOctets = RealMessage1 | NonceRData | MACedIDForI
>   GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
> 

Both are right, if you check the text in clarifications draft
carefully:

  InitiatorSignedOctets = RealMessage1 | NonceRData | MACedIDForI
  GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
  RealIKEHDR =  SPIi | SPIr |  . . . | Length
  RealMessage1 = RealIKEHDR | RestOfMessage1
  [...]

The four zero octets are not part of RealMessage1, so they're not
part of InitiatorSignedOctets either.

Best regards,
Pasi