Subject: [Ipsec] Cryptographically Protected Message ID in IKEv2

From: "Salekul Islam" <[email-masked]>
Date: Thu, 22 Feb 2007 18:31:13 +0000

Hi All,

In RFC 4306 Section 2.2, it is stated that,

"Note that Message IDs are cryptographically protected and provide 
protection against message replays."

Message ID is sent as one of the fields of HDR payload, which is not 
cryptographically protected (as I understand). Am I missing something or 
getting the wrong definition of "cryptographically protected"?

I hope someone will clarify my understanding.

Regards,

Salekul

_________________________________________________________________
Free Alerts : Be smart - let your information find you ! 
http://alerts.live.com/Alerts/Default.aspx

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 22 Feb 2007 10:46:51 -0800

Please see at the end of Section 3.14:

"Integrity Checksum Data is the cryptographic checksum of the
       entire message starting with the Fixed IKE Header through the Pad
       Length.  The checksum MUST be computed over the encrypted message.
       Its length is determined by the integrity algorithm negotiated."

All messages other than those in the IKE_SA_INIT exchange have an SK 
payload and are integrity protected as described above.  Hope that 
helps.  Replay protection and liveness guarantee for the initial 
exchange is provided through the nonces and their inclusion in the AUTH 
payload computation (see Section 3.9).

regards,
Lakshminath