Subject: [IPsec] Hash in NAT_DETECTION_SOURCE_IP

From: "sumit agarwal" <[email-masked]>
Date: Tue, 20 May 2008 00:15:44 +0530

Hi,

I have a doubt on hash Calculation for NAT notification during IKE_SA_INIT
exchange.
While the IKEv2 RFC states

NAT_DETECTION_SOURCE_IP                  16388

            This notification is used by its recipient to determine
            whether the source is behind a NAT box.  *The data associated
            with this notification is a SHA-1 digest of the SPIs (in the
            order they appear in the header), IP address, and port on
            which this packet was sent.*

Does it mean that while sending the NAT_DETECTION_SOURCE_IP  or
NAT_DETECTION_DESTINATION_IP in the first message of IKE_SA_INIT exchange,
where the responder cookie is 0.The responder cookie should be kept out of
Hash calculation or the Hash should be calculated with responder cookie as
0?

With warm regards,
Sumit
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: ns srinivasa murthy <[email-masked]>
Date: Tue, 20 May 2008 11:17:56 +0530

Responder cookie should be taken into account while calculating the 
Hash even if it zero.

-nsmurthy

At 12:15 AM 5/20/2008, sumit agarwal wrote:
>Hi,
>
>I have a doubt on hash Calculation for NAT notification during 
>IKE_SA_INIT exchange.
>             whether the source is behind a NAT box.  The data associated
>             which this packet was sent.
>
>where the responder cookie is 0.The responder cookie should be kept 
>out of Hash calculation or the Hash should be calculated with 
>responder cookie as 0?
>
>With warm regards,
>Sumit
>
>
>

********************************************************************************
This email message (including any attachments) is for the sole use of the intended recipient(s) 
and may contain confidential, proprietary and privileged information. Any unauthorized review, 
use, disclosure or distribution is prohibited. If you are not the intended recipient, 
please immediately notify the sender by reply email and destroy all copies of the original message. 
Thank you.
 
Intoto Inc.

---

From: <[email-masked]>
Date: Tue, 20 May 2008 09:30:30 +0200

When the IKE initiator includes a NAT_DETECTION_SOURCE_IP payload, that
payload
contains the SHA1 value (20 bytes) over a string consisting of
    8 bytes of SPI-Initiator
    8 bytes of SPI-Responder (which is zero in the IKE_SA_INIT request)
    4 bytes of IPv4 source address (or 16 bytes of IPv6 source address)
    2 bytes of UDP source port
The COOKIE payload is not included in this calculation or in other
calculations (as sender) or
verifications (as receivers) for NAT_DETECTION_*_IP.
 
Christian

________________________________

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of sumit agarwal
	Sent: 19. maj 2008 20:46
	To: [email-masked]
	Subject: [IPsec] Hash in NAT_DETECTION_SOURCE_IP

	Hi,

	
	            This notification is used by its recipient to
determine
	            whether the source is behind a NAT box.  The data
associated
	            with this notification is a SHA-1 digest of the SPIs
(in the
	            order they appear in the header), IP address, and
port on
	            which this packet was sent.  
	 
	Does it mean that while sending the NAT_DETECTION_SOURCE_IP  or
NAT_DETECTION_DESTINATION_IP in the first message of IKE_SA_INIT
exchange, 
	where the responder cookie is 0.The responder cookie should be
kept out of Hash calculation or the Hash should be calculated with
responder cookie as 0?
	 
	With warm regards,
	Sumit

---

From: "balaji raghavan" <[email-masked]>
Date: Tue, 20 May 2008 09:58:38 +0200

RFC 4306
"
   The Internet Security Association and Key Management
   Protocol (ISAKMP) [MSST98] fixed message header includes two eight-
   octet fields titled "cookies", and that syntax is used by both IKEv1
   and IKEv2 though in IKEv2 they are referred to as the IKE SPI and
   there is a new separate field in a Notify payload holding the cookie.
"

I guess by responder cookie you meant "SPI-responder" in IKEv1 lingo
and not the notify (COOKIE) payload. :)

-Balaji

On Tue, May 20, 2008 at 9:30 AM,
<[email-masked]> wrote:
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> sumit agarwal
> Sent: 19. maj 2008 20:46
> To: [email-masked]