some packets. Thus, to avoid counter block collisions, ESP or AH
implementations that permit use of the same key for protecting
packets with the same peer MUST ensure that the two peers assign
different salt values to the security association (SA).
The other consideration is that, as with any block cipher mode of
operation, the security of all data protected under a given security
association decreases slightly with each message.
To protect against this problem, implementations MUST generate a
fresh key before processing 2^64 blocks of data with a given key.
Note that it is impossible to reach this limit when using 32-bit
Sequence Numbers.
Note that, for each message, GMAC calls the block cipher only once.
8. Design Rationale
This specification was designed to be as similar to AES-GCM-ESP
[RFC4106] as possible. We re-use the design and implementation
experience from that specification. We include all three AES key
sizes since AES-GCM-ESP supports all of those sizes, and the larger
key sizes provide future users with more high-security options.
9. IANA Considerations
IANA has assigned the following IKEv2 parameters. For the use of AES
GMAC in AH, the following integrity (type 3) transform identifiers
have been assigned:
"9" for AUTH_AES_128_GMAC
"10" for AUTH_AES_192_GMAC
"11" for AUTH_AES_256_GMAC
For the use of AES-GMAC in ESP, the following encryption (type 1)
transform identifier has been assigned:
"21" for ENCR_NULL_AUTH_AES_GMAC
10. Acknowledgements
Our discussions with Fabio Maino and David Black significantly
improved this specification, and Tero Kivinen provided us with useful
comments. Steve Kent provided guidance on ESP interactions. This
work is closely modeled after AES-GCM, which itself is closely
modeled after Russ Housley’s AES-CCM transform [RFC4309].
Additionally, the GCM mode of operation was originally conceived as
an improvement to the CWC mode [CWC] in which Doug Whiting and Yoshi
Kohno participated. We express our thanks to Fabio, David, Tero,
Steve, Russ, Doug, and Yoshi.
11. References
11.1. Normative References
[GCM] McGrew, D. and J. Viega, "The Galois/Counter Mode of
Operation (GCM)", Submission to NIST. http://
csrc.nist.gov/CryptoToolkit/modes/proposedmodes/gcm/
gcm-spec.pdf, January 2004.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3602] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC Cipher
Algorithm and Its Use with IPsec", RFC 3602, September
2003.
11.2. Informative References
[CWC] Kohno, T., Viega, J., and D. Whiting, "CWC: A high-
performance conventional authenticated encryption mode",
Fast Software Encryption.
http://eprint.iacr.org/2003/106.pdf, February 2004.
[GCMP] McGrew, D. and J. Viega, "The Security and Performance of
the Galois/Counter Mode (GCM)", Proceedings of INDOCRYPT
’04, http://eprint.iacr.org/2004/193, December 2004.
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.
[RFC4106] Viega, J. and D. McGrew, "The Use of Galois/Counter Mode
(GCM) in IPsec Encapsulating Security Payload (ESP)", RFC
4106, June 2005.
[RFC4302] Kent, S., "IP Authentication Header", RFC 4302, December
2005.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
4303, December 2005.
[RFC4306] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", RFC
4306, December 2005.
[RFC4309] Housley, R., "Using Advanced Encryption Standard (AES) CCM
Mode with IPsec Encapsulating Security Payload (ESP)", RFC
4309, December 2005.
Authors’ Addresses
David A. McGrew
Cisco Systems, Inc.
510 McCarthy Blvd.
Milpitas, CA 95035
US
Phone: (408) 525 8651
EMail: mcgrew@cisco.com
URI: http://www.mindspring.com/~dmcgrew/dam.htm
John Viega
McAfee, Inc.
1145 Herndon Parkway, Suite 500
Herndon, VA 20170
EMail: viega@list.org
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).