Subject: [IPsec] IV in ESP packets for AES-CBC and AES-CTR methods

From: ss murthy nittala <[email-masked]>
Date: Mon, 11 May 2009 19:40:22 +0530

Hi,
Is it required for IV to be randomly generated for each ESP packet in 
case of AES-CTR and AES-CBC methods?

AES-CTR:My understanding is that IV is to be generated randomly for 
the first packet.For each new outgoing packet increment IV and use it.

AES-CBC:Is it required for IV to be randomly generated for each of 
the outgoing ESP packets?In any case i think the packet shall include IV.

Thanks
-ns murthy

---

From: Dan McDonald <[email-masked]>
Date: Mon, 11 May 2009 10:11:21 -0400

> case of AES-CTR and AES-CBC methods?

I don't know about AES-CTR, but definitely in AES-CBC.

> AES-CBC:Is it required for IV to be randomly generated for each of the 
> outgoing ESP packets?In any case i think the packet shall include IV.

The AES-CBC packets include an IV of 16 bytes (i.e. one AES block) which must
be randomly generated.

Dan

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 11 May 2009 17:30:33 +0300

>From RFC3686:

   The AES-CTR IV field MUST be eight octets.  The IV MUST be chosen by
   the encryptor in a manner that ensures that the same IV value is used
   only once for a given key.  The encryptor can generate the IV in any
   manner that ensures uniqueness.  Common approaches to IV generation
   include incrementing a counter for each packet and linear feedback
   shift registers (LFSRs).

I.e. it MUST be unique, but there is no other requirements for it.
Incremental counter is one commonly used method.

>From RFC3602:

   The IV field MUST be the same size as the block size of the cipher
   algorithm being used.  The IV MUST be chosen at random, and MUST be
   unpredictable.
...
   To avoid CBC encryption of very similar plaintext blocks in different
   packets, implementations MUST NOT use a counter or other low-Hamming
   distance source for IVs.

I.e. it MUST be unpredictable, i.e. randomly generated is good. Using
the final ciphertext block of the previous message is NOT acceptable.
-- 
[email-masked]

---

From: ss murthy nittala <[email-masked]>
Date: Mon, 11 May 2009 20:22:05 +0530

The following sentence present in RFC 3602 creates some doubts 
whether IV in each packet is mandatory or not?

"Including the IV in each datagram ensures that decryption of each
  received datagram can be performed, even when some datagrams are
  dropped, or datagrams are re-ordered in transit."

Thanks
-ns murthy

---

From: Paul Koning <[email-masked]>
Date: Mon, 11 May 2009 10:59:55 -0400

>>>>> "ss" == ss murthy nittala <[email-masked]> writes:

 ss> The following sentence present in RFC 3602 creates some doubts
 ss> whether IV in each packet is mandatory or not?

 ss> "Including the IV in each datagram ensures that decryption of
 ss> each received datagram can be performed, even when some datagrams
 ss> are dropped, or datagrams are re-ordered in transit."

It's mandatory.  The paragraph you quoted is simply an explanation of
why this is so.

Note the first paragraph of that section, which says "the ESP payload
is made up of the IV followed...".  There isn't any option in that
statement. 

	   paul

---

From: Dan McDonald <[email-masked]>
Date: Mon, 11 May 2009 10:50:16 -0400

On Mon, May 11, 2009 at 08:22:05PM +0530, ss murthy nittala wrote:
>
> The following sentence present in RFC 3602 creates some doubts whether IV 
> in each packet is mandatory or not?
>

Nothing vague about it at all!  In fact, this paragraph strengthens the
argument Tero made in his note:  Using the previous cipher-text block is a
Bad Idea (TM).

An IP datagram is self-contained, and the IV is mandatory because you can't
start a CBC decryption without one, and there's no other way to get an IV.

Dan

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 11 May 2009 08:13:27 -0700

At 8:22 PM +0530 5/11/09, ss murthy nittala wrote:
>The following sentence present in RFC 3602 creates some doubts whether IV in each packet is mandatory or not?
>

That is poor wording on the part of the RFC. It should read something like "The reason that the IV is included in each datagram is to ensure..."

--Paul Hoffman, Director
--VPN Consortium

---

From: Stephen Kent <[email-masked]>
Date: Mon, 11 May 2009 15:05:06 -0400

At 7:40 PM +0530 5/11/09, ss murthy nittala wrote:
>Hi,
>Is it required for IV to be randomly generated for each ESP packet 
>in case of AES-CTR and AES-CBC methods?
>

Even for CTR mode, an explicit IV MUST be included with each packet, 
because the receiver does not know what method of counter value 
generation the sender has elected to employ.

Steve