Subject: [Ipsec] IKEv2 PRF Keylengths confusion

From: "sudeep " <[email-masked]>
Date: 11 Jul 2006 20:17:52 -0000

Hi all,  

Incase of IKEv2 exchange, what is the maximum nonce size allowed? 
Incase of variable-key prf functions (like HMAC-SHA1) the key is 
constructed by concatenating initiator nonce and responder nonce. But 
according to rfc-2104, HMAC can take keys of lengths only upto 64 
Bytes. So what if both initiator and responder nonce add upto more 
than 64 Bytes? How do we truncate them to get correct key for HMAC. 
Does IKEv2 spec (rfc 4306) specify anything?

Please someone clarify me on this...

Thanks
Sudeep

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Scott Fluhrer" <[email-masked]>
Date: Tue, 11 Jul 2006 16:43:22 -0400

_____  

From: sudeep [mailto:[email-masked]] 
Sent: Tuesday, July 11, 2006 4:18 PM
To: [email-masked]
Subject: [Ipsec] IKEv2 PRF Keylengths confusion

Hi all,  

Bytes. 

This is incorrect: according to the RFC section 2:

Applications that use keys longer than B bytes will first hash the key using
H and then use the resultant L byte string as the actual key to HMAC.

And in section 3:

The key for HMAC can be of any length (keys longer than B bytes are first
hashed using H).

For example, if you are implementing HMAC-SHA1 and  if you get a key longer
than 64 bytes, you would run SHA1 on the key, and use the resulting 20 bytes
as K, which is xor'ed into the ipad/opad

  So what if both initiator and responder nonce add upto more 
than 64 Bytes? How do we truncate them to get correct key for HMAC. 
Does IKEv2 spec (rfc 4306) specify anything?

---

From: <[email-masked]>
Date: Wed, 12 Jul 2006 00:39:18 +0300

Hi,

See RFC 2104 Section 3: "The key for HMAC can be of any length (keys
longer than B bytes are first hashed using H)."

Best regards
Pasi

> -----Original Message-----
> From: ext sudeep [mailto:[email-masked]] 
> Sent: 11 July, 2006 23:18
> To: [email-masked]
> constructed by concatenating initiator nonce and responder
> nonce. But according to rfc-2104, HMAC can take keys of lengths only
> upto 64 Bytes. So what if both initiator and responder nonce add
> upto more than 64 Bytes? How do we truncate them to get correct key
> for HMAC.  Does IKEv2 spec (rfc 4306) specify anything?
>