precomputation attack, then the theoretical strength of AES Counter
mode (and any other block cipher mode) is limited to 2^(n/2) bits,
where n is the number of bits in the key. The use of long keys is
the best countermeasure to precomputation attacks. The unpredictable
nonce value in the counter block significantly increases the size of
the table that the attacker must compute to mount a successful
precomputation attack.
Rekeying with Quick Mode results in new keys to protect GigaBeam
radio link frames; however, these keys are generated from the same
Diffie-Hellman shared secret. In order to limit the amount of data
that would be exposed by the disclosure of this Diffie-Hellman shared
secret or the associated Diffie-Hellman private key, implementations
should periodically rekey using a new Phase 1 exchange.
Diffie-Hellman exponents used in IKE Phase 1 should be erased from
memory immediately after use. Likewise, AES and HMAC-SHA-1 keying
material should be erased from memory when it is no longer needed.
This security solution makes use of IKEv1 [IKE]. IKEv1 was selected
over IKEv2 [IKEv2] primarily due to the availability of an
implementation for the processing environment. The use of IKEv2
would provide some useful capabilities, such as Diffie-Hellman group
negotiation. These additional capabilities would not significantly
improve the security of the overall key management solution that runs
on the two-node IP network.
6. IANA Considerations
IANA has assigned one IPsec Security Protocol Identifier in
http://www.iana.org/assignments/isakmp-registry for
PROTO_GIGABEAM_RADIO. It was assigned the value 5.
7. Informative References
[CBC] Dworkin, M., "Recommendation for Block Cipher Modes of
Operation: Methods and Techniques," NIST Special
Publication 800-38A, December 2001.
[ESP] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
4303, December 2005.
[ESP-CBC] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC Cipher
Algorithm and Its Use with IPsec", RFC 3602, September
2003.
[ESP-GCM] Viega, J. and D. McGrew, "The Use of Galois/Counter Mode
(GCM) in IPsec Encapsulating Security Payload (ESP)", RFC
4106, June 2005.
[ESP-HMAC] Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96 within
ESP and AH", RFC 2404, November 1998.
[GCM] McGrew, D. and J. Viega, "The Galois/Counter Mode of
Operation (GCM)", Submission to NIST.
http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/
gcm/gcm-spec.pdf, January 2004. [Soon: NIST SP 800-38D.]
[HMAC] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, February
1997.
[IKE] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.
[IKEv2] Kaufman, C., "The Internet Key Exchange (IKEv2) Protocol",
RFC 2306, December 2005.
[IPDOI] Piper, D., "The Internet IP Security Domain of
Interpretation for ISAKMP", RFC 2407, November 1998.
[MODP] Kivinen, T. and M. Kojo. "More Modular Exponential (MODP)
Diffie-Hellman groups for Internet Key Exchange (IKE)",
RFC 3526, May 2003.
[OAKLEY] Orman, H., "The Oakley Key Determination Protocol", RFC
2412, November 1998.
[PKCS1] Kaliski, B., "PKCS #1: RSA Encryption Version 1.5", RFC
2313, March 1998.
[PKIX1] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
X.509 Public Key Infrastructure Certificate and
Certificate Revocation List (CRL) Profile", RFC 3280,
April 2002.
[PPP] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51,
RFC 1661, July 1994.
8. Acknowledgements
The authors thank Bob Sutherland and Dave Marcellas for their
contributions and review.
Authors’ Addresses
Russell Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA 20170
USA
EMail: housley@vigilsec.com
Alan Corry
GigaBeam Corporation
470 Springpark Place, Suite 900
Herndon, VA 20170
USA
EMail: publications@gigabeam.com
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).