Subject: [IPsec] SHA-2 in 240x-series IPsec

From: Dan McDonald <[email-masked]>
Date: Thu, 10 Jan 2008 15:04:53 -0500

RFC 4868 is supposed to be used in both 240x AH/ESP *and* 430x AH/ESP,
correct?  I'm assuming it is, because 4868 talks about IKEv1 also.

I ask because there are some implementations out there that have SHA-2
support, but with truncation to 96 bits, not 128, 192, and 256.

Thanks,
Dan

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 11 Jan 2008 15:00:43 -0500

>support, but with truncation to 96 bits, not 128, 192, and 256.

You are right that 4686 requires HMAC values be truncated to no less 
than 1/2 the size of the hash function value, which means they are 
all bigger than the 96 bits that are typically used in the AH/ESP/IKE 
v1 context.

There is no constraint that precludes use of bigger than 96-bit ICVs 
with AH and ESP v1, although 2002 and 2406 cite the 96-bit truncated 
HMACs as the only mandatory-to-implement algorithms for the version 1 
of AH and ESP. RFC 2407 does not define transform IDs for using 
SHA2+, but the IANA registry for the ISAKMP DOI does assign values 
for SHA2-256, 384 and 512. Unfortunately, there is no reference to a 
document for these values, in the registry, just Marcus Leechs's name 
and e-mail address!

So an obvious question is what do implementers who support these DOI 
values do (in the IKEv1 context), and what do they cite as the basis 
for doing whatever they do?

Steve