栏目搜索
 
 
 
 
你的位置:首页 > 协议大全 > RFC4106-The Use of GaloisCounter Mode (GCM) in IPsec Encapsulating Security Payload (ESP) >
 

RFC4106-The Use of GaloisCounter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)

发布者:[本站编辑] | 来源:[]

RFC4106-The Use of GaloisCounter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)_电脑维修资料库

network working group j. viegarequest for comments: 4106 secure software, inc.category: standards track d. mcgrewcisco systems, inc.june 2005the use of galois/counter mode (gcm)in ipsec encapsulating security payload (esp)status of this memothis document specifies an internet standards track protocol for theinternet community, and requests discussion and suggestions forimprovements. please refer to the current edition of the internetofficial protocol standards (std 1) for the standardization stateand status of this protocol. distribution of this memo is unlimited.copyright noticecopyright (c) the internet society (2005).abstractthis memo describes the use of the advanced encryption standard (aes)in galois/counter mode (gcm) as an ipsec encapsulating securitypayload (esp) mechanism to provide confidentiality and data originauthentication. this method can be efficiently implemented inhardware for speeds of 10 gigabits per second and above, and is alsowell-suited to software implementations.table of contents1. introduction ....................................................21.1. conventions used in this document ..........................22. aes-gcm .........................................................33. esp payload data ................................................33.1. initialization vector (iv) .................................33.2. ciphertext .................................................44. nonce format ....................................................45. aad construction ................................................56. integrity check value (icv) .....................................57. packet expansion ................................................68. ike conventions .................................................68.1. keying material and salt values ............................68.2. phase 1 identifier .........................................68.3. phase 2 identifier .........................................78.4. key length attribute .......................................79. test vectors ....................................................710. security considerations ........................................711. design rationale ...............................................812. iana considerations ............................................813. acknowledgements ...............................................914. normative references ...........................................915. informative references .........................................91. introductionthis document describes the use of aes in gcm mode (aes-gcm) as anipsec esp mechanism for confidentiality and data originauthentication. we refer to this method as aes-gcm-esp. thismechanism is not only efficient and secure, but it also enableshigh-speed implementations in hardware. thus, aes-gcm-esp allowsipsec connections that can make effective use of emerging 10-gigabitand 40-gigabit network devices.counter mode (ctr) has emerged as the preferred encryption method forhigh-speed implementations. unlike conventional encryption modessuch as cipher block chaining (cbc) and cipher block chaining messageauthentication code (cbc-mac), ctr can be efficiently implemented athigh data rates because it can be pipelined. the esp ctr protocoldescribes how this mode can be used with ipsec esp .unfortunately, ctr provides no data origin authentication, and thusthe esp ctr standard requires the use of a data origin authenticationalgorithm in conjunction with ctr. this requirement is problematic,because none of the standard data origin authentication algorithmscan be efficiently implemented for high data rates. gcm solves thisproblem, because under the hood, it combines ctr mode with a secure,parallelizable, and efficient authentication mechanism.this document does not cover implementation details of gcm. thosedetails can be found in , along with test vectors.1.1. conventions used in this documentthe key words must, must not, required, shall, shall not,should, should not, recommended, may, and optional in thisdocument are to be interpreted as described in .2. aes-gcmgcm is a block cipher mode of operation providing bothconfidentiality and data origin authentication. the gcmauthenticated encryption operation has four inputs: a secret key, aninitialization vector (iv), a plaintext, and an input for additionalauthenticated data (aad). it has two outputs, a ciphertext whoselength is identical to the plaintext, and an authentication tag. inthe following, we describe how the iv, plaintext, and aad are formedfrom the esp fields, and how the esp packet is formed from theciphertext and authentication tag.esp also defines an iv. for clarity, we refer to the aes-gcm iv as anonce in the context of aes-gcm-esp. the same nonce and keycombination must not be used more than once.because reusing an nonce/key combination destroys the securityguarantees of aes-gcm mode, it can be difficult to use this modesecurely when using statically configured keys. for safety's sake,implementations must use an automated key management system, such asthe internet key exchange (ike) , to ensure that thisrequirement is met.3. esp payload datathe esp payload data is comprised of an eight-octet initializationvector (iv), followed by the ciphertext. the payload field, asdefined in , is structured as shown in figure 1, along withthe icv associated with the payload.0 1 2 30 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| initialization vector || (8 octets) |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| |~ ciphertext (variable) ~| |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+figure 1: esp payload encrypted with aes-gcm.3.1. initialization vector (iv)the aes-gcm-esp iv field must be eight octets. for a given key, theiv must not repeat. the most natural way to implement this is with acounter, but anything that guarantees uniqueness can be used, such asa linear feedback shift register (lfsr). note that the encrypter canuse any iv generation method that meets the uniqueness requirement,without coordinating with the decrypter.3.2. ciphertextthe plaintext input to aes-gcm is formed by concatenating theplaintext data described by the next header field with the padding,the pad length, and the next header field. the ciphertext fieldconsists of the ciphertext output from the aes-gcm algorithm. thelength of the ciphertext is identical to that of the plaintext.implementations that do not seek to hide the length of the plaintextshould use the minimum amount of padding required, which will be lessthan four octets.4. nonce formatthe nonce passed to the gcm-aes encryption algorithm has thefollowing layout:0 1 2 30 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| salt |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| initialization vector || |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+figure 2: nonce formatthe components of the nonce are as follows:saltthe salt field is a four-octet value that is assigned at thebeginning of the security association, and then remains constantfor the life of the security association. the salt should beunpredictable (i.e., chosen at random) before it is selected, butneed not be secret. we describe how to set the salt for asecurity association established via the internet key exchange insection 8.1.initialization vectorthe iv field is described in section 3.1.5. aad constructionthe authentication of data integrity and data origin for the spi and(extended) sequence number fields is provided without encryption.this is done by including those fields in the aes-gcm additionalauthenticated data (aad) field. two formats of the aad are defined:one for 32-bit sequence numbers, and one for 64-bit extended sequencenumbers. the format with 32-bit sequence numbers is shown in figure3, and the format with 64-bit extended sequence numbers is shown infigure 4.0 1 2 30 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| spi |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| 32-bit sequence number |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+figure 3: aad format with 32-bit sequence number0 1 2 30 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| spi |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| 64-bit extended sequence number || |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+figure 4: aad format with 64-bit extended sequence number6. integrity check value (icv)the icv consists solely of the aes-gcm authentication tag.implementations must support a full-length 16-octet icv, and maysupport 8 or 12 octet icvs, and must not support other icv lengths.although esp does not require that an icv be present, aes-gcm-espintentionally does not allow a zero-length icv. this is because gcmprovides no integrity protection whatsoever when used with a zero-length authentication tag.7. packet expansionthe iv adds an additional eight octets to the packet, and the icvadds an additional 8, 12, or 16 octets. these are the only sourcesof packet expansion, other than the 10-13 octets taken up by the espspi, sequence number, padding, pad length, and next header fields (ifthe minimal amount of padding is used).8. ike conventionsthis section describes the conventions used to generate keyingmaterial and salt values, for use with aes-gcm-esp, using theinternet key exchange (ike) protocol. the identifiers andattributes needed to negotiate a security association using aes-gcm-esp are also defined.8.1. keying material and salt valuesike makes use of a pseudo-random function (prf) to derive keyingmaterial. the prf is used iteratively to derive keying material ofarbitrary size, called keymat. keying material is extracted from theoutput string without regard to boundaries.the size of the keymat for the aes-gcm-esp must be four octets longerthan is needed for the associated aes key. the keying material isused as follows:aes-gcm-esp with a 128 bit keythe keymat requested for each aes-gcm key is 20 octets. the first16 octets are the 128-bit aes key, and the remaining four octetsare used as the salt value in the nonce.aes-gcm-esp with a 192 bit keythe keymat requested for each aes-gcm key is 28 octets. the first24 octets are the 192-bit aes key, and the remaining four octetsare used as the salt value in the nonce.aes-gcm-esp with a 256 bit keythe keymat requested for each aes gcm key is 36 octets. the first32 octets are the 256-bit aes key, and the remaining four octetsare used as the salt value in the nonce.8.2. phase 1 identifierthis document does not specify the conventions for using aes-gcm forike phase 1 negotiations. for aes-gcm to be used in this manner, aseparate specification is needed, and an encryption algorithmidentifier needs to be assigned. implementations should use an ikephase 1 cipher that is at least as strong as aes-gcm. the use of aescbc with the same key size used by aes-gcm-esp isrecommended.8.3. phase 2 identifierfor ike phase 2 negotiations, iana has assigned three esp transformidentifiers for aes-gcm with an eight-byte explicit iv:18 for aes-gcm with an 8 octet icv;19 for aes-gcm with a 12 octet icv; and20 for aes-gcm with a 16 octet icv.8.4. key length attributebecause the aes supports three key lengths, the key length attributemust be specified in the ike phase 2 exchange . the keylength attribute must have a value of 128, 192, or 256.9. test vectorsappendix b of provides test vectors that will assistimplementers with aes-gcm mode.10. security considerationsgcm is provably secure against adversaries that can adaptively chooseplaintexts, ciphertexts, icvs, and the aad field, under standardcryptographic assumptions (roughly, that the output of the underlyingcipher, under a randomly chosen key, is indistinguishable from arandomly selected output). essentially, this means that, if usedwithin its intended parameters, a break of gcm implies a break of theunderlying block cipher. the proof of security for gcm is availablein .the most important security consideration is that the iv never repeatfor a given key. in part, this is handled by disallowing the use ofaes-gcm when using statically configured keys, as discussed insection 2.when ike is used to establish fresh keys between two peer entities,separate keys are established for the two traffic flows. if adifferent mechanism is used to establish fresh keys (one thatestablishes only a single key to encrypt packets), then there is ahigh probability that the peers will select the same iv values forsome packets. thus, to avoid counter block collisions, espimplementations that permit use of the same key for encrypting anddecrypting packets with the same peer must ensure that the two peersassign different salt values to the security association (sa).the other consideration is that, as with any encryption mode, thesecurity of all data protected under a given security associationdecreases slightly with each message.to protect against this problem, implementations must generate afresh key before encrypting 2^64 blocks of data with a given key.note that it is impossible to reach this limit when using 32-bitsequence numbers.note that, for each message, gcm calls the block cipher once for eachfull 16-octet block in the payload, once for any remaining octets inthe payload, and one additional time for computing the icv.clearly, smaller icv values are more likely to be subject to forgeryattacks. implementations should use as large a size as reasonable.11. design rationalethis specification was designed to be as similar to the aes-ccm esp and aes-ctr esp mechanisms as reasonable, whilepromoting simple, efficient implementations in both hardware andsoftware. we re-use the design and implementation experience fromthose standards.the major difference with ccm is that the ccm esp mechanism requiresan 11-octet nonce, whereas the gcm esp mechanism requires using a12-octet nonce. gcm is specially optimized to handle the 12-octetnonce case efficiently. nonces of other lengths would causeunnecessary, additional complexity and delays, particularly inhardware implementations. the additional octet of nonce is used toincrease the size of the salt.12. iana considerationsiana has assigned three esp transform identifiers for aes-gcm with aneight-byte explicit iv:18 for aes-gcm with an 8 octet icv;19 for aes-gcm with a 12 octet icv; and20 for aes-gcm with a 16 octet icv.13. acknowledgementsthis work is closely modeled after russ housley's aes-ccm transform. portions of this document are directly copied from thatwork in progress. we thank russ for his support of this work.additionally, the gcm mode of operation was originally conceived asan improvement to carter-wegman counter (cwc) mode , the firstunencumbered block cipher mode capable of supporting high-speedauthenticated encryption.14. normative references mcgrew, d. and j. viega, the galois/counter mode ofoperation (gcm), submission to nist. http://csrc.nist.gov/cryptotoolkit/modes/proposedmodes/gcm/gcm-spec.pdf, january 2004. bradner, s., key words for use in rfcs to indicaterequirement levels, bcp 14, rfc 2119, march 1997. kent, s. and r. atkinson, ip encapsulating securitypayload (esp), rfc 2406, november 1998. piper, d., the internet ip security domain ofinterpretation for isakmp, rfc 2407, november 1998. frankel, s., glenn, r. and s. kelly, the aes-cbc cipheralgorithm and its use with ipsec, rfc 3602, september2003.15. informative references housley, r., using aes ccm mode with ipsec esp, work inprogress. kohno, t., viega, j. and d. whiting, cwc: a high-performance conventional authenticated encryption mode,fast software encryption. http://eprint.iacr.org/2003/106.pdf, february 2004. harkins, d. and d. carrel, the internet key exchange(ike), rfc 2409, november 1998. housley, r., using advanced encryption standard (aes)counter mode with ipsec encapsulating security payload(esp), rfc 3686, january 2004.authors' addressesjohn viegasecure software, inc.4100 lafayette center dr., suite 100chantilly, va 20151usphone: (703) 814 4402email: viega@securesoftware.comdavid a. mcgrewcisco systems, inc.510 mccarthy blvd.milpitas, ca 95035usphone: (408) 525 8651email: mcgrew@cisco.comuri: http://www.mindspring.com/~dmcgrew/dam.htmfull copyright statementcopyright (c) the internet society (2005).this document is subject to the rights, licenses and restrictionscontained in bcp 78, and except as set forth therein, the authorsretain all their rights.this document and the information contained herein are provided on anas is basis and the contributor, the organization he/she representsor is sponsored by (if any), the internet society and the internetengineering task force disclaim all warranties, express or implied,including but not limited to any warranty that the use of theinformation herein will not infringe any rights or any impliedwarranties of merchantability or fitness for a particular purpose.intellectual propertythe ietf takes no position regarding the validity or scope of anyintellectual property rights or other rights that might be claimed topertain to the implementation or use of the technology described inthis document or the extent to which any license under such rightsmight or might not be available; nor does it represent that it hasmade any independent effort to identify any such rights. informationon the procedures with respect to rights in rfc documents can befound in bcp 78 and bcp 79.copies of ipr disclosures made to the ietf secretariat and anyassurances of licenses to be made available, or the result of anattempt made to obtain a general license or permission for the use ofsuch proprietary rights by implementers or users of thisspecification can be obtained from the ietf on-line ipr repository athttp://www.ietf.org/ipr.the ietf invites any interested party to bring to its attention anycopyrights, patents or patent applications, or other proprietaryrights that may cover technology that may be required to implementthis standard. please address the information to the ietf at ietf-ipr@ietf.org.acknowledgementfunding for the rfc editor function is currently provided by theinternet society.</t