Subject: [IPsec] question about the use of AES-XCBC in IKEv1 for NAT-D payloads

From: Scott C Moonen <[email-masked]>
Date: Tue, 7 Jul 2009 11:16:58 -0400

Generally, for authentication and PRF purposes, IKEv1 uses HMAC forms of 
authentication algorithms.  For most algorithms (e.g., MD5, SHA1, etc.) 
there is both a non-keyed form of the hash and also a keyed HMAC form. 
This doesn't seem to be true for AES-XCBC, which is explicitly defined as 
a keyed hash function.

RFC 3947 documents the use of a non-keyed hash for generating a NAT-D 
payload.  It says that "this uses the negotiated HASH algorithm".  What 
hash algorithm should one use if AES-XCBC is being used for 
authentication?

(Fortunately, IKEv2 does not have this problem; it explicitly specifies 
the use of SHA-1 for the NAT_DETECTION_* payloads.)

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://scott.andstuff.org/
http://www.linkedin.com/in/smoonen

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 7 Jul 2009 23:03:45 +0300

> This doesn't seem to be true for AES-XCBC, which is explicitly defined as 

AES-XCBC cannot be used with IKEv1. It can be used for ESP/AH as
http://www.iana.org/assignments/isakmp-registry registry has values
for it, but http://www.iana.org/assignments/ipsec-registry registry
which is used for IKEv1 SA itself does not have any entries for
AES-XCBC. 

> hash algorithm should one use if AES-XCBC is being used for 

As AES-XCBC cannot be used for IKEv1 SA itself, you use the normal
negotiated Hash algorithm for that IKEv1 SA. If AES-XCBC would be
added for IKEv1 SAs also, then it would be added as PRF not as Hash
algorith, and then IKEv1 SAs using it would have one Hash algorithm
(MD5, Sha1 or similar) and one PRF negotiated. Hash algorithm would be
used for example when generating the NAT-D payloads, and PRF would be
used for generating key material and calculating message
authentication codes for the IKEv1 packets.

Of course I might be remembering wrong, as writing comments about
protocol obsoleted 4 years ago while on vacation might cause that...
-- 
[email-masked]

---

From: Scott C Moonen <[email-masked]>
Date: Tue, 7 Jul 2009 16:52:09 -0400

Tero,

> which is used for IKEv1 SA itself does not have any entries for

Aah, ok, I think I was confusing the isakmp and ipsec registries.  Thank 
you.

I was going to say that RFC 4308 is therefore incoherent.  But I now see 
that Paul wrote an erratum documenting the use of SHA-1 for IKEv1.

From:
Tero Kivinen <[email-masked]>
To:
Scott C Moonen/Raleigh/IBM@IBMUS
Cc:
[email-masked]
Date:
07/07/2009 04:09 PM
Subject:
[IPsec] question about the use of AES-XCBC in IKEv1 for NAT-D   payloads