4543
PROPOSED STANDARD
The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH
Authors: D. McGrew, J. Viega
Date: May 2006
Working Group: NON WORKING GROUP
Stream: IETF
Abstract
This memo describes the use of the Advanced Encryption Standard (AES) Galois Message Authentication Code (GMAC) as a mechanism to provide data origin authentication, but not confidentiality, within the IPsec Encapsulating Security Payload (ESP) and Authentication Header (AH). GMAC is based on the Galois/Counter Mode (GCM) of operation, and can be efficiently implemented in hardware for speeds of 10 gigabits per second and above, and is also well-suited to software implementations. [STANDARDS-TRACK]
RFC 4543
PROPOSED STANDARD
Errata Exist
Network Working Group D. McGrew
Request for Comments: 4543 Cisco Systems, Inc.
Category: Standards Track J. Viega
McAfee, Inc.
May 2006
<span class="h1">The Use of Galois Message Authentication Code (GMAC) in</span>
<span class="h1">IPsec ESP and AH</span>
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
This memo describes the use of the Advanced Encryption Standard (AES)
Galois Message Authentication Code (GMAC) as a mechanism to provide
data origin authentication, but not confidentiality, within the IPsec
Encapsulating Security Payload (ESP) and Authentication Header (AH).
GMAC is based on the Galois/Counter Mode (GCM) of operation, and can
be efficiently implemented in hardware for speeds of 10 gigabits per
second and above, and is also well-suited to software
implementations.
<span class="grey">McGrew & Viega Standards Track [Page 1]</span><span id="page-2" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
Table of Contents
<a href="#section-1">1</a>. Introduction ....................................................<a href="#page-2">2</a>
<a href="#section-1.1">1.1</a>. Conventions Used in This Document ..........................<a href="#page-3">3</a>
<a href="#section-2">2</a>. AES-GMAC ........................................................<a href="#page-3">3</a>
<a href="#section-3">3</a>. The Use of AES-GMAC in ESP ......................................<a href="#page-3">3</a>
<a href="#section-3.1">3.1</a>. Initialization Vector ......................................<a href="#page-4">4</a>
<a href="#section-3.2">3.2</a>. Nonce Format ...............................................<a href="#page-4">4</a>
<a href="#section-3.3">3.3</a>. AAD Construction ...........................................<a href="#page-5">5</a>
<a href="#section-3.4">3.4</a>. Integrity Check Value (ICV) ................................<a href="#page-6">6</a>
<a href="#section-3.5">3.5</a>. Differences with AES-GCM-ESP ...............................<a href="#page-6">6</a>
<a href="#section-3.6">3.6</a>. Packet Expansion ...........................................<a href="#page-7">7</a>
<a href="#section-4">4</a>. The Use of AES-GMAC in AH .......................................<a href="#page-7">7</a>
<a href="#section-5">5</a>. IKE Conventions .................................................<a href="#page-8">8</a>
<a href="#section-5.1">5.1</a>. Phase 1 Identifier .........................................<a href="#page-8">8</a>
<a href="#section-5.2">5.2</a>. Phase 2 Identifier .........................................<a href="#page-8">8</a>
<a href="#section-5.3">5.3</a>. Key Length Attribute .......................................<a href="#page-9">9</a>
<a href="#section-5.4">5.4</a>. Keying Material and Salt Values ............................<a href="#page-9">9</a>
<a href="#section-6">6</a>. Test Vectors ....................................................<a href="#page-9">9</a>
<a href="#section-7">7</a>. Security Considerations ........................................<a href="#page-10">10</a>
<a href="#section-8">8</a>. Design Rationale ...............................................<a href="#page-11">11</a>
<a href="#section-9">9</a>. IANA Considerations ............................................<a href="#page-11">11</a>
<a href="#section-10">10</a>. Acknowledgements ..............................................<a href="#page-11">11</a>
<a href="#section-11">11</a>. References ....................................................<a href="#page-12">12</a>
<a href="#section-11.1">11.1</a>. Normative References .....................................<a href="#page-12">12</a>
<a href="#section-11.2">11.2</a>. Informative References ...................................<a href="#page-12">12</a>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
This document describes the use of AES-GMAC mode (AES-GMAC) as a
mechanism for data origin authentication in ESP [<a href="./rfc4303" title=""IP Encapsulating Security Payload (ESP)"">RFC4303</a>] and AH
[<a href="./rfc4302" title=""IP Authentication Header"">RFC4302</a>]. We refer to these methods as ENCR_NULL_AUTH_AES_GMAC and
AUTH_AES_GMAC, respectively. ENCR_NULL_AUTH_AES_GMAC is a companion
to the AES Galois/Counter Mode ESP [<a href="./rfc4106" title=""The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)"">RFC4106</a>], which provides
authentication as well as confidentiality. ENCR_NULL_AUTH_AES_GMAC
is intended for cases in which confidentiality is not desired. Like
GCM, GMAC is efficient and secure, and is amenable to high-speed
implementations in hardware. ENCR_NULL_AUTH_AES_GMAC and
AUTH_AES_GMAC are designed so that the incremental cost of
implementation, given an implementation is AES-GCM-ESP, is small.
This document does not cover implementation details of GCM or GMAC.
Those details can be found in [<a href="#ref-GCM" title=""The Galois/Counter Mode of Operation (GCM)"">GCM</a>], along with test vectors.
<span class="grey">McGrew & Viega Standards Track [Page 2]</span><span id="page-3" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Conventions Used in This Document</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. AES-GMAC</span>
GMAC is a block cipher mode of operation providing data origin
authentication. It is defined in terms of the GCM authenticated
encryption operation as follows. The GCM authenticated encryption
operation has four inputs: a secret key, an initialization vector
(IV), a plaintext, and an input for additional authenticated data
(AAD). It has two outputs, a ciphertext whose length is identical to
the plaintext and an authentication tag. GMAC is the special case of
GCM in which the plaintext has a length of zero. The (zero-length)
ciphertext output is ignored, of course, so that the only output of
the function is the Authentication Tag. In the following, we
describe how the GMAC IV and AAD are formed from the ESP and AH
fields, and how the ESP and AH packets are formed from the
Authentication Tag.
Below we refer to the AES-GMAC IV input as a nonce, in order to
distinguish it from the IV fields in the packets. The same nonce and
key combination MUST NOT be used more than once, since reusing a
nonce/key combination destroys the security guarantees of AES-GMAC.
Because of this restriction, it can be difficult to use this mode
securely when using statically configured keys. For the sake of good
security, implementations MUST use an automated key management
system, such as the Internet Key Exchange (IKE) (either version two
[<a href="./rfc4306" title=""Internet Key Exchange (IKEv2) Protocol"">RFC4306</a>] or version one [<a href="./rfc2409" title=""The Internet Key Exchange (IKE)"">RFC2409</a>]), to ensure that this requirement
is met.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. The Use of AES-GMAC in ESP</span>
The AES-GMAC algorithm for ESP is defined as an ESP "combined mode"
algorithm (see <a href="./rfc4303#section-3.2.3">Section 3.2.3 of [RFC4303]</a>), rather than an ESP
integrity algorithm. It is called ENCR_NULL_AUTH_AES_GMAC to
highlight the fact that it performs no encryption and provides no
confidentiality.
Rationale: ESP makes no provision for integrity transforms to
place an initialization vector within the Payload field; only
encryption transforms are expected to use IVs. Defining GMAC as
an encryption transform avoids this issue, and allows GMAC to
benefit from the same pipelining as does GCM.
<span class="grey">McGrew & Viega Standards Track [Page 3]</span><span id="page-4" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
Like all ESP combined modes, it is registered in IKEv2 as an
encryption transform, or "Type 1" transform. It MUST NOT be used in
conjunction with any other ESP encryption transform (within a
particular ESP encapsulation). If confidentiality is desired, then
GCM ESP [<a href="./rfc4106" title=""The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)"">RFC4106</a>] SHOULD be used instead.
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>. Initialization Vector</span>
With ENCR_NULL_AUTH_AES_GMAC, an explicit Initialization Vector (IV)
is included in the ESP Payload, at the outset of that field. The IV
MUST be eight octets long. For a given key, the IV MUST NOT repeat.
The most natural way to meet this requirement is to set the IV using
a counter, but implementations are free to set the IV field in any
way that guarantees uniqueness, such as a linear feedback shift
register (LFSR). Note that the sender can use any IV generation
method that meets the uniqueness requirement without coordinating
with the receiver.
<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a>. Nonce Format</span>
The nonce passed to the AES-GMAC authentication algorithm has the
following layout:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Salt |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initialization Vector |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: Nonce Format
The components of the nonce are as follows:
Salt
The salt field is a four-octet value that is assigned at the
beginning of the security association, and then remains constant
for the life of the security association. The salt SHOULD be
unpredictable (i.e., chosen at random) before it is selected, but
need not be secret. We describe how to set the salt for a
Security Association established via the Internet Key Exchange in
<a href="#section-5.4">Section 5.4</a>.
Initialization Vector
The IV field is described in <a href="#section-3.1">Section 3.1</a>.
<span class="grey">McGrew & Viega Standards Track [Page 4]</span><span id="page-5" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
<span class="h3"><a class="selflink" id="section-3.3" href="#section-3.3">3.3</a>. AAD Construction</span>
Data integrity and data origin authentication are provided for the
SPI, (Extended) Sequence Number, Authenticated Payload, Padding, Pad
Length, and Next Header fields. This is done by including those
fields in the AES-GMAC Additional Authenticated Data (AAD) field.
Two formats of the AAD are defined: one for 32-bit sequence numbers,
and one for 64-bit extended sequence numbers. The format with 32-bit
sequence numbers is shown in Figure 2, and the format with 64-bit
extended sequence numbers is shown in Figure 3.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| SPI |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 32-bit Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Authenticated Payload (variable) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Padding (0-255 bytes) |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | Pad Length | Next Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: AAD Format with 32-bit Sequence Number
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| SPI |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 64-bit Extended Sequence Number |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Authenticated Payload (variable) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Padding (0-255 bytes) |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | Pad Length | Next Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: AAD Format with 64-bit Extended Sequence Number
<span class="grey">McGrew & Viega Standards Track [Page 5]</span><span id="page-6" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
The use of 32-bit sequence numbers vs. 64-bit extended sequence
numbers is determined by the security association (SA) management
protocol that is used to create the SA. For IKEv2 [<a href="./rfc4306" title=""Internet Key Exchange (IKEv2) Protocol"">RFC4306</a>] this is
negotiated via Transform Type 5, and the default for ESP is to use
64-bit extended sequence numbers in the absence of negotiation (e.g.,
see <a href="./rfc4303#section-2.2.1">Section 2.2.1 of [RFC4303]</a>).
<span class="h3"><a class="selflink" id="section-3.4" href="#section-3.4">3.4</a>. Integrity Check Value (ICV)</span>
The ICV consists solely of the AES-GMAC Authentication Tag. The
Authentication Tag MUST NOT be truncated, so the length of the ICV is
16 octets.
<span class="h3"><a class="selflink" id="section-3.5" href="#section-3.5">3.5</a>. Differences with AES-GCM-ESP</span>
In this section, we highlight the differences between this
specification and AES-GCM-ESP [<a href="./rfc4106" title=""The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)"">RFC4106</a>]. The essential difference is
that in this document, the AAD consists of the SPI, Sequence Number,
and ESP Payload, and the AES-GCM plaintext is zero-length, while in
AES-GCM-ESP, the AAD consists only of the SPI and Sequence Number,
and the AES-GCM plaintext consists of the ESP Payload. These
differences are illustrated in Figure 4. This figure shows the case
in which the Extended Sequence Number option is not used. When that
option is exercised, the Sequence Number field in the figure would be
replaced with the Extended Sequence Number.
Importantly, ENCR_NULL_AUTH_AES_GMAC is *not* equivalent to AES-GCM-
ESP with encryption "turned off". However, the ICV computations
performed in both cases are similar because of the structure of the
GHASH function [<a href="#ref-GCM" title=""The Galois/Counter Mode of Operation (GCM)"">GCM</a>].
<span class="grey">McGrew & Viega Standards Track [Page 6]</span><span id="page-7" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
+-> +-----------------------+ <-+
AES-GCM-ESP | | SPI | |
AAD -------+ +-----------------------+ |
| | Sequence Number | |
+-> +-----------------------+ |
| Authentication | |
| IV | |
+->+-> +-----------------------+ +
AES-GCM-ESP | | | |
Plaintext -+ ~ ESP Payload ~ |
| | | |
| +-----------+-----+-----+ |
| | Padding | PL | NH | |
+----> +-----------+-----+-----+ <-+
|
ENCR_NULL_AUTH_AES_GMAC AAD --+
Figure 4: Differences between ENCR_NULL_AUTH_AES_GMAC and AES-GCM-ESP
<span class="h3"><a class="selflink" id="section-3.6" href="#section-3.6">3.6</a>. Packet Expansion</span>
The IV adds an additional eight octets to the packet and the ICV adds
an additional 16 octets. These are the only sources of packet
expansion, other than the 10-13 bytes taken up by the ESP SPI,
Sequence Number, Padding, Pad Length, and Next Header fields (if the
minimal amount of padding is used).
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. The Use of AES-GMAC in AH</span>
In AUTH_AES_GMAC, the AH Authentication Data field consists of the IV
and the Authentication Tag, as shown in Figure 5. Unlike the usual
AH case, the Authentication Data field contains both an input to the
authentication algorithm (the IV) and the output of the
authentication algorithm (the tag). No padding is required in the
Authentication Data field, because its length is a multiple of 64
bits.
<span class="grey">McGrew & Viega Standards Track [Page 7]</span><span id="page-8" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Initialization Vector (IV) |
| (8 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| Integrity Check Value (ICV) (16 octets) |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 5: The AUTH_AES_GMAC Authentication Data Format
The IV is as described in <a href="#section-3.1">Section 3.1</a>. The Integrity Check Value
(ICV) is as described in <a href="#section-3.4">Section 3.4</a>.
The GMAC Nonce input is formed as described in <a href="#section-3.2">Section 3.2</a>. The GMAC
AAD input consists of the authenticated data as defined in <a href="./rfc4302#section-3.1">Section</a>
<a href="./rfc4302#section-3.1">3.1 of [RFC4302]</a>. These values are provided as to that algorithm,
along with the secret key, and the resulting authentication tag given
as output is used to form the ICV.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. IKE Conventions</span>
This section describes the conventions used to generate keying
material and salt values for use with ENCR_NULL_AUTH_AES_GMAC and
AUTH_AES_GMAC using the Internet Key Exchange (IKE) versions one
[<a href="./rfc2409" title=""The Internet Key Exchange (IKE)"">RFC2409</a>] and two [<a href="./rfc4306" title=""Internet Key Exchange (IKEv2) Protocol"">RFC4306</a>].
<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a>. Phase 1 Identifier</span>
This document does not specify the conventions for using AES-GMAC for
IKE Phase 1 negotiations. For AES-GMAC to be used in this manner, a
separate specification would be needed, and an Encryption Algorithm
Identifier would need to be assigned. Implementations SHOULD use an
IKE Phase 1 cipher that is at least as strong as AES-GMAC. The use
of AES-CBC [<a href="./rfc3602" title=""The AES-CBC Cipher Algorithm and Its Use with IPsec"">RFC3602</a>] with the same AES key size as used by
ENCR_NULL_AUTH_AES_GMAC or AUTH_AES_GMAC is RECOMMENDED.
<span class="h3"><a class="selflink" id="section-5.2" href="#section-5.2">5.2</a>. Phase 2 Identifier</span>
For IKE Phase 2 negotiations, IANA has assigned identifiers as
described in <a href="#section-9">Section 9</a>.
<span class="grey">McGrew & Viega Standards Track [Page 8]</span><span id="page-9" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
<span class="h3"><a class="selflink" id="section-5.3" href="#section-5.3">5.3</a>. Key Length Attribute</span>
AES-GMAC can be used with any of the three AES key lengths. The way
that the key length is indicated is different for AH and ESP.
For AH, each key length has its own separate integrity transform
identifier and algorithm name (<a href="#section-9">Section 9</a>). The IKE Key Length
attribute MUST NOT be used with these identifiers. This transform
MUST NOT be used with ESP.
For ESP, there is a single encryption transform identifier (which
represents the combined transform) (<a href="#section-9">Section 9</a>). The IKE Key Length
attribute MUST be used with each use of this identifier to indicate
the key length. The Key Length attribute MUST have a value of 128,
192, or 256.
<span class="h3"><a class="selflink" id="section-5.4" href="#section-5.4">5.4</a>. Keying Material and Salt Values</span>
IKE makes use of a pseudo-random function (PRF) to derive keying
material. The PRF is used iteratively to derive keying material of
arbitrary size, called KEYMAT. Keying material is extracted from the
output string without regard to boundaries.
The size of the KEYMAT for the ENCR_NULL_AUTH_AES_GMAC and
AUTH_AES_GMAC MUST be four octets longer than is needed for the
associated AES key. The keying material is used as follows:
ENCR_NULL_AUTH_AES_GMAC with a 128-bit key and AUTH_AES_128_GMAC
The KEYMAT requested for each AES-GMAC key is 20 octets. The
first 16 octets are the 128-bit AES key, and the remaining four
octets are used as the salt value in the nonce.
ENCR_NULL_AUTH_AES_GMAC with a 192-bit key and AUTH_AES_192_GMAC
The KEYMAT requested for each AES-GMAC key is 28 octets. The
first 24 octets are the 192-bit AES key, and the remaining four
octets are used as the salt value in the nonce.
ENCR_NULL_AUTH_AES_GMAC with a 256-bit key and AUTH_AES_256_GMAC
The KEYMAT requested for each AES-GMAC key is 36 octets. The
first 32 octets are the 256-bit AES key, and the remaining four
octets are used as the salt value in the nonce.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. Test Vectors</span>
<a href="#appendix-B">Appendix B</a> of [<a href="#ref-GCM" title=""The Galois/Counter Mode of Operation (GCM)"">GCM</a>] provides test vectors that will assist
implementers with AES-GMAC.
<span class="grey">McGrew & Viega Standards Track [Page 9]</span><span id="page-10" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. Security Considerations</span>
Since the authentication coverage is different between AES-GCM-ESP
and this specification (see Figure 4), it is worth pointing out that
both specifications are secure. In ENCR_NULL_AUTH_AES_GMAC, the IV
is not included in either the plaintext or the additional
authenticated data. This does not adversely affect security, because
the IV field only provides an input to the GMAC IV, which is not
required to be authenticated (see [<a href="#ref-GCM" title=""The Galois/Counter Mode of Operation (GCM)"">GCM</a>]). In AUTH_AES_GMAC, the IV
is included in the additional authenticated data. This fact has no
adverse effect on security; it follows from the property that GMAC is
secure even against attacks in which the adversary can manipulate
both the IV and the message. Even an adversary with these powerful
capabilities cannot forge an authentication tag for any message
(other than one that was submitted to the chosen-message oracle).
Since such an adversary could easily choose messages that contain the
IVs with which they correspond, there are no security problems with
the inclusion of the IV in the AAD.
GMAC is provably secure against adversaries that can adaptively
choose plaintexts, ICVs and the AAD field, under standard
cryptographic assumptions (roughly, that the output of the underlying
cipher under a randomly chosen key is indistinguishable from a
randomly selected output). Essentially, this means that, if used
within its intended parameters, a break of GMAC implies a break of
the underlying block cipher. The proof of security is available in
[<a href="#ref-GCMP" title=""The Security and Performance of the Galois/Counter Mode (GCM)"">GCMP</a>].
The most important security consideration is that the IV never
repeats for a given key. In part, this is handled by disallowing the
use of AES-GMAC when using statically configured keys, as discussed
in <a href="#section-2">Section 2</a>.
When IKE is used to establish fresh keys between two peer entities,
separate keys are established for the two traffic flows. If a
different mechanism is used to establish fresh keys, one that
establishes only a single key to protect packets, then there is a
high probability that the peers will select the same IV values for
some packets. Thus, to avoid counter block collisions, ESP or AH
implementations that permit use of the same key for protecting
packets with the same peer MUST ensure that the two peers assign
different salt values to the security association (SA).
The other consideration is that, as with any block cipher mode of
operation, the security of all data protected under a given security
association decreases slightly with each message.
<span class="grey">McGrew & Viega Standards Track [Page 10]</span><span id="page-11" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
To protect against this problem, implementations MUST generate a
fresh key before processing 2^64 blocks of data with a given key.
Note that it is impossible to reach this limit when using 32-bit
Sequence Numbers.
Note that, for each message, GMAC calls the block cipher only once.
<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>. Design Rationale</span>
This specification was designed to be as similar to AES-GCM-ESP
[<a href="./rfc4106" title=""The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)"">RFC4106</a>] as possible. We re-use the design and implementation
experience from that specification. We include all three AES key
sizes since AES-GCM-ESP supports all of those sizes, and the larger
key sizes provide future users with more high-security options.
<span class="h2"><a class="selflink" id="section-9" href="#section-9">9</a>. IANA Considerations</span>
IANA has assigned the following IKEv2 parameters. For the use of AES
GMAC in AH, the following integrity (type 3) transform identifiers
have been assigned:
"9" for AUTH_AES_128_GMAC
"10" for AUTH_AES_192_GMAC
"11" for AUTH_AES_256_GMAC
For the use of AES-GMAC in ESP, the following encryption (type 1)
transform identifier has been assigned:
"21" for ENCR_NULL_AUTH_AES_GMAC
<span class="h2"><a class="selflink" id="section-10" href="#section-10">10</a>. Acknowledgements</span>
Our discussions with Fabio Maino and David Black significantly
improved this specification, and Tero Kivinen provided us with useful
comments. Steve Kent provided guidance on ESP interactions. This
work is closely modeled after AES-GCM, which itself is closely
modeled after Russ Housley's AES-CCM transform [<a href="./rfc4309" title=""Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)"">RFC4309</a>].
Additionally, the GCM mode of operation was originally conceived as
an improvement to the CWC mode [<a href="#ref-CWC" title=""CWC: A high- performance conventional authenticated encryption mode"">CWC</a>] in which Doug Whiting and Yoshi
Kohno participated. We express our thanks to Fabio, David, Tero,
Steve, Russ, Doug, and Yoshi.
<span class="grey">McGrew & Viega Standards Track [Page 11]</span><span id="page-12" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
<span class="h2"><a class="selflink" id="section-11" href="#section-11">11</a>. References</span>
<span class="h3"><a class="selflink" id="section-11.1" href="#section-11.1">11.1</a>. Normative References</span>
[<a id="ref-GCM">GCM</a>] McGrew, D. and J. Viega, "The Galois/Counter Mode of
Operation (GCM)", Submission to NIST. <a href="http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/gcm/">http://</a>
<a href="http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/gcm/">csrc.nist.gov/CryptoToolkit/modes/proposedmodes/gcm/</a>
gcm-spec.pdf, January 2004.
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
[<a id="ref-RFC3602">RFC3602</a>] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC Cipher
Algorithm and Its Use with IPsec", <a href="./rfc3602">RFC 3602</a>, September
2003.
<span class="h3"><a class="selflink" id="section-11.2" href="#section-11.2">11.2</a>. Informative References</span>
[<a id="ref-CWC">CWC</a>] Kohno, T., Viega, J., and D. Whiting, "CWC: A high-
performance conventional authenticated encryption mode",
Fast Software Encryption.
<a href="http://eprint.iacr.org/2003/106.pdf">http://eprint.iacr.org/2003/106.pdf</a>, February 2004.
[<a id="ref-GCMP">GCMP</a>] McGrew, D. and J. Viega, "The Security and Performance of
the Galois/Counter Mode (GCM)", Proceedings of INDOCRYPT
'04, <a href="http://eprint.iacr.org/2004/193">http://eprint.iacr.org/2004/193</a>, December 2004.
[<a id="ref-RFC2409">RFC2409</a>] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", <a href="./rfc2409">RFC 2409</a>, November 1998.
[<a id="ref-RFC4106">RFC4106</a>] Viega, J. and D. McGrew, "The Use of Galois/Counter Mode
(GCM) in IPsec Encapsulating Security Payload (ESP)", <a href="./rfc4106">RFC</a>
<a href="./rfc4106">4106</a>, June 2005.
[<a id="ref-RFC4302">RFC4302</a>] Kent, S., "IP Authentication Header", <a href="./rfc4302">RFC 4302</a>, December
2005.
[<a id="ref-RFC4303">RFC4303</a>] Kent, S., "IP Encapsulating Security Payload (ESP)", <a href="./rfc4303">RFC</a>
<a href="./rfc4303">4303</a>, December 2005.
[<a id="ref-RFC4306">RFC4306</a>] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", <a href="./rfc4306">RFC</a>
<a href="./rfc4306">4306</a>, December 2005.
[<a id="ref-RFC4309">RFC4309</a>] Housley, R., "Using Advanced Encryption Standard (AES) CCM
Mode with IPsec Encapsulating Security Payload (ESP)", <a href="./rfc4309">RFC</a>
<a href="./rfc4309">4309</a>, December 2005.
<span class="grey">McGrew & Viega Standards Track [Page 12]</span><span id="page-13" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
Authors' Addresses
David A. McGrew
Cisco Systems, Inc.
510 McCarthy Blvd.
Milpitas, CA 95035
US
Phone: (408) 525 8651
EMail: [email protected]
URI: <a href="http://www.mindspring.com/~dmcgrew/dam.htm">http://www.mindspring.com/~dmcgrew/dam.htm</a>
John Viega
McAfee, Inc.
1145 Herndon Parkway, Suite 500
Herndon, VA 20170
EMail: [email protected]
<span class="grey">McGrew & Viega Standards Track [Page 13]</span><span id="page-14" ></span>
<span class="grey"><a href="./rfc4543">RFC 4543</a> GMAC in IPsec ESP and AH May 2006</span>
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a>, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and <a href="https://www.rfc-editor.org/bcp/bcp79">BCP 79</a>.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
<a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
[email protected].
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
McGrew & Viega Standards Track [Page 14]
Annotations
Select text to annotate