Subject: [IPsec] question about RFC 4303 section 3.3.2.1

From: "Green, Mike" <[email-masked]>
Date: Fri, 6 Jun 2008 17:11:06 -0400

Sorry if this is the wrong forum:

Are the steps outlined in this section a MUST from an order of
operations standpoint? In other words, if you're encrypted the packet
using a non-chaining algorithm, is it possible to construct an ESP IPsec
packet by encrypting the payload before the header? Is possible even
using a chaining cipher algorithm to do that?  Thanks.

Mike Green

ph 602.822.4360

[email-masked] <mailto:[email-masked]> 

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Fri, 6 Jun 2008 17:27:54 -0400

At 5:11 PM -0400 6/6/08, Green, Mike wrote:
>Content-class: urn:content-classes:message
>Content-Type: multipart/alternative;
>	boundary="----_=_NextPart_001_01C8C819.D79D32A9"
>
>operations standpoint? In other words, if you're encrypted the 
>packet using a non-chaining algorithm, is it possible to construct 
>an ESP IPsec packet by encrypting the payload before the header? Is 
>possible even using a chaining cipher algorithm to do that?  Thanks.

One MUST perform encryption before the integrity check is applied, 
because the received will verify the integrity check before 
performing decryption. If one can perform the two in parallel, that's 
OK, so long as the receiver can perform the integrity check first. 
But, yes you could construct the ESP header after encrypting the 
payload (and the ESP trailer), so long as the ESP header is 
constructed before the integrity check is computed.

Steve

---

From: "Scott Fluhrer" <[email-masked]>
Date: Fri, 6 Jun 2008 18:41:28 -0400

_____  

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Green, Mike
Sent: Friday, June 06, 2008 5:11 PM
To: [email-masked]
Subject: [IPsec] question about RFC 4303 section 3.3.2.1

Are the steps outlined in this section a MUST from an order of operations
standpoint? In other words, if you're encrypted the packet using a
non-chaining algorithm, is it possible to construct an ESP IPsec packet by
encrypting the payload before the header? Is possible even using a chaining
cipher algorithm to do that?  Thanks. 

As Steve pointed out, you must do step 4 (the ICV computation) over the
encrypted packet, forcing you to do step 3 (the actual encryption) first
(or, if you're careful, in parallel).  However, you appear to be asking "do
I have to add the ESP header (and the outer IP header if tunnel mode) first,
or can I do that step after encrypting".

Well, nothing in step 3 depends on the header data.  You will need to know
exactly what you're encrypting (the padded packet in tunnel mode, the
padding packet minus the IP header in transport mode).  In addition, if your
encryption mode uses an IV or a nonce, then you'll need to select it before
encrypting, and then insert the selected value between the ESP header (SPI
and sequence number) and the actual encrypted data.

I also don't see any security weaknesses introduced by changing this order.

Mike Green

ph 602.822.4360

 <mailto:[email-masked]> [email-masked]