Subject: [Ipsec] Clarification on rfc4543

From: "Ray Savarda" <[email-masked]>
Date: Thu, 22 Jun 2006 15:46:44 -0400

Excuse me if this has been asked/answered already, but I spent a fair
amount of time looking and didn't find any previous conversations
regarding it anywhere online.
 
In RFC4543, Section 3.5, Figure 4, it (to me, anyway) clearly shows the
IV included in the ICV calculation for ENCR_NULL_AUTH_AES_GMAC. 
Section 3.3 also specifies that the AAD includes the payload, and 3.1
specifies that the IV is included in the ESP payload, collectively
implying the IV is included in the AAD.
 
However, in section 7, second sentence, we have:
" In ENCR_NULL_AUTH_AES_GMAC, the IV is not included in either the
plaintext or the additional authenticated data."

Am I misinterpreting something? 
 
Also, is it correct to assume that in AH mode, since the IV is present
at the beginning of the ICV field in the AH header, that it is also
included in the ICV calculation for that mode? 
 
Lastly (bear with me), any chance there are a couple sample test vectors
available somewhere that would help ensure there is no ambiguity in the
interpretation of these new ESP/AH Algorithms? 
 
Thanks!
Ray
 
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec