The Advanced Encryption Standard-Cipher-based Message Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128) Algorithm for the Internet Key Exchange Protocol (IKE)
A pseudo-random function built on AES-CMAC that lets IKEv2 use AES with keys of any length.
Song, J., Poovendran, R., Lee, J., and T. Iwata, "The Advanced Encryption Standard-Cipher-based Message Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128) Algorithm for the Internet Key Exchange Protocol (IKE)", RFC 4615, DOI 10.17487/RFC4615, August 2006, <https://www.rfc-editor.org/info/rfc4615>.
@misc{rfc4615,
series = {Request for Comments},
number = 4615,
howpublished = {RFC 4615},
publisher = {RFC Editor},
doi = {10.17487/RFC4615},
url = {https://www.rfc-editor.org/info/rfc4615},
author = {J. Song and R. Poovendran and J. Lee and T. Iwata},
title = {{The Advanced Encryption Standard-Cipher-based Message Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128) Algorithm for the Internet Key Exchange Protocol (IKE)}},
pagetotal = 7,
year = 2006,
month = aug,
} RFC text
Contents
Network Working Group J. Song
Request for Comments: 4615 R. Poovendran
Category: Standards Track University of Washington
J. Lee
Samsung Electronics
T. Iwata
Nagoya University
August 2006
The Advanced Encryption Standard-Cipher-based
Message Authentication Code-Pseudo-Random Function-128
(AES-CMAC-PRF-128) Algorithm for the
Internet Key Exchange Protocol (IKE)
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
Some implementations of IP Security (IPsec) may want to use a
pseudo-random function (PRF) based on the Advanced Encryption
Standard (AES). This memo describes such an algorithm, called
AES-CMAC-PRF-128. It supports fixed and variable key sizes.
Table of Contents
1. Introduction ....................................................2
2. Basic Definitions ...............................................2
3. The AES-CMAC-PRF-128 Algorithm ..................................2
4. Test Vectors ....................................................4
5. Security Considerations .........................................4
6. IANA Considerations .............................................5
7. Acknowledgements ................................................5
8. References ......................................................5
8.1. Normative References .......................................5
8.2. Informative References .....................................5
1. Introduction
[RFC4493] describes a method to use the Advanced Encryption Standard
(AES) as a Message Authentication Code (MAC) that has a 128-bit
output length. The 128-bit output is useful as a long-lived pseudo-
random function (PRF). This document specifies a PRF that supports
fixed and variable key sizes for IKEv2 [RFC4306] Key Derivation
Function (KDF) and authentication.
2. Basic Definitions
VK Variable-length key for AES-CMAC-PRF-128, denoted
by VK.
0^128 The string that consists of 128 zero-bits, which is
equivalent to 0x00000000000000000000000000000000 in
hexadecimal notation.
AES-CMAC The AES-CMAC algorithm with a 128-bit long key described
in section 2.4 of [RFC4493].
3. The AES-CMAC-PRF-128 Algorithm
The AES-CMAC-PRF-128 algorithm is identical to AES-CMAC defined in
[RFC4493] except that the 128-bit key length restriction is removed.
IKEv2 [RFC4306] uses PRFs for multiple purposes, most notably for
generating keying material and authentication of the IKE_SA. The
IKEv2 specification differentiates between PRFs with fixed key sizes
and those with variable key sizes.
When using AES-CMAC-PRF-128 as the PRF described in IKEv2, AES-CMAC-
PRF-128 is considered to take fixed size (16 octets) keys for
generating keying material but it takes variable key sizes for
authentication.
That is, when generating keying material, "half the bits must come
from Ni and half from Nr, taking the first bits of each" as described
in IKEv2, section 2.14; but for authenticating with shared secrets
(IKEv2, section 2.16), the shared secret does not have to be 16
octets and the length may vary.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ AES-CMAC-PRF-128 +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ +
+ Input : VK (Variable-length key) +
+ : M (Message, i.e., the input data of the PRF) +
+ : VKlen (length of VK in octets) +
+ : len (length of M in octets) +
+ Output : PRV (128-bit Pseudo-Random Variable) +
+ +
+-------------------------------------------------------------------+
+ Variable: K (128-bit key for AES-CMAC) +
+ +
+ Step 1. If VKlen is equal to 16 +
+ Step 1a. then +
+ K := VK; +
+ Step 1b. else +
+ K := AES-CMAC(0^128, VK, VKlen); +
+ Step 2. PRV := AES-CMAC(K, M, len); +
+ return PRV; +
+ +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Figure 1. The AES-CMAC-PRF-128 Algorithm
In step 1, the 128-bit key, K, for AES-CMAC is derived as follows:
o If the key, VK, is exactly 128 bits, then we use it as-is.
o If it is longer or shorter than 128 bits, then we derive the key,
K, by applying the AES-CMAC algorithm using the 128-bit all-zero
string as the key and VK as the input message. This step is
described in step 1b.
In step 2, we apply the AES-CMAC algorithm using K as the key and M
as the input message. The output of this algorithm is returned.
4. Test Vectors
------------------------------------------------------------
Test Case AES-CMAC-PRF-128 with 20-octet input
Key : 00010203 04050607 08090a0b 0c0d0e0f edcb
Key Length : 18
Message : 00010203 04050607 08090a0b 0c0d0e0f 10111213
PRF Output : 84a348a4 a45d235b abfffc0d 2b4da09a
Test Case AES-CMAC-PRF-128 with 20-octet input
Key : 00010203 04050607 08090a0b 0c0d0e0f
Key Length : 16
Message : 00010203 04050607 08090a0b 0c0d0e0f 10111213
PRF Output : 980ae87b 5f4c9c52 14f5b6a8 455e4c2d
Test Case AES-CMAC-PRF-128 with 20-octet input
Key : 00010203 04050607 0809
Key Length : 10
Message : 00010203 04050607 08090a0b 0c0d0e0f 10111213
PRF Output : 290d9e11 2edb09ee 141fcf64 c0b72f3d
------------------------------------------------------------
5. Security Considerations
The security provided by AES-CMAC-PRF-128 is based upon the strength
of AES and AES-CMAC. At the time of this writing, there are no known
practical cryptographic attacks against AES or AES-CMAC. However, as
is true with any cryptographic algorithm, part of its strength lies
in the secret key, VK, and the correctness of the implementation in
all of the participating systems. The key, VK, needs to be chosen
independently and randomly based on RFC 4086 [RFC4086], and both
keys, VK and K, should be kept safe and periodically refreshed.
Section 4 presents test vectors that assist in verifying the
correctness of the AES-CMAC-PRF-128 code.
If VK is longer than 128 bits and it is shortened to meet the AES-128
key size, then some entropy might be lost. However, as long as VK is
longer than 128 bits, then the new key, K, preserves sufficient
entropy, i.e., the entropy of K is about 128 bits.
Therefore, we recommend the use of VK that is longer than or equal to
128 bits, and we discourage the use of VK that is shorter than or
equal to 64 bits, because of the small entropy.
6. IANA Considerations
IANA has allocated a value of 8 for IKEv2 Transform Type 2 (Pseudo-
Random Function) to the PRF_AES128_CMAC algorithm.
7. Acknowledgements
Portions of this text were borrowed from [RFC3664] and [RFC4434].
Many thanks to Russ Housley and Paul Hoffman for suggestions and
guidance. We also thank Alfred Hoenes for many useful comments.
We acknowledge support from the following grants: Collaborative
Technology Alliance (CTA) from US Army Research Laboratory,
DAAD19-01-2-0011; Presidential Award from Army Research Office,-
W911NF-05-1-0491; ONR YIP N00014-04-1-0479. Results do not reflect
any position of the funding agencies.
8. References
8.1. Normative References
[RFC4493] Song, JH., Poovendran, R., Lee, J., and T. Iwata, "The
AES-CMAC Algorithm", RFC 4493, June 2006.
[RFC4306] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", RFC
4306, December 2005.
[RFC4086] Eastlake, D., 3rd, Schiller, J., and S. Crocker,
"Randomness Requirements for Security", BCP 106, RFC 4086,
June 2005.
8.2. Informative References
[RFC3664] Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
Internet Key Exchange Protocol (IKE)", RFC 3664, January
2004.
[RFC4434] Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
Internet Key Exchange Protocol (IKE)", RFC 4434, February
2006.
Authors' Addresses
JunHyuk Song
Samsung Electronics
University of Washington
Phone: (206) 853-5843
EMail: junhyuk.song@samsung.com, junhyuk.song@gmail.com
Radha Poovendran
Network Security Lab
University of Washington
Phone: (206) 221-6512
EMail: radha@ee.washington.edu
Jicheol Lee
Samsung Electronics
Phone: +82-31-279-3605
EMail: jicheol.lee@samsung.com
Tetsu Iwata
Nagoya University
EMail: iwata@cse.nagoya-u.ac.jp
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
AI ELI5
On this page
§1Why a New PRF for IKEv2
RFC 4493 describes how to use the Advanced Encryption Standard (AES) as a Message Authentication Code with a 128-bit output. That 128-bit output is useful as a long-lived pseudo-random function (PRF).
This document specifies a PRF that supports fixed and variable key sizes, for use in the key derivation function and for authentication in IKEv2 (RFC 4306). It is meant for IPsec implementations that want an AES-based PRF.
IKE needs a mixing recipe that turns secrets into random-looking values. This one is built from AES.
§2Fixed and Variable Key Sizes
AES-CMAC-PRF-128 is identical to AES-CMAC from RFC 4493, except that the 128-bit key length restriction is removed. The RFC names the variable-length key VK.
IKEv2 uses PRFs for several purposes, mainly generating keying material and authenticating the IKE_SA, and it distinguishes PRFs with fixed key sizes from those with variable key sizes. AES-CMAC-PRF-128 is treated as taking fixed-size keys of 16 octets when generating keying material, but variable key sizes for authentication.
When generating keying material, half the bits must come from Ni and half from Nr, taking the first bits of each. When authenticating with shared secrets, the secret does not have to be 16 octets long.
Sometimes the recipe wants a key of one exact size. Other times, like with a password you picked, the key can be any length, and the recipe has to cope.
§3The Algorithm
The inputs are the variable-length key VK, the message M, and their lengths in octets, VKlen and len. The output is PRV, a 128-bit pseudo-random value. A working variable K is a 128-bit key for AES-CMAC.
- Step 1: if
VKlenis 16, thenK := VK. OtherwiseK := AES-CMAC(0^128, VK, VKlen), which uses the 128-bit all-zero string as the key and VK as the message. - Step 2:
PRV := AES-CMAC(K, M, len), and return PRV.
So a key of exactly 128 bits is used as it is, and a key that is longer or shorter is first turned into a 128-bit key.
If your key already fits, use it. If not, run it through a squisher that always gives the right size, then do the real mixing.
Input : VK (variable-length key), M (message), VKlen, len
Output : PRV (128-bit pseudo-random variable)
Variable: K (128-bit key for AES-CMAC)
Step 1. If VKlen is equal to 16
Step 1a. then K := VK;
Step 1b. else K := AES-CMAC(0^128, VK, VKlen);
Step 2. PRV := AES-CMAC(K, M, len);
return PRV;§4Test Vectors
The RFC gives three test cases, all with the same 20-octet message, so implementers can check their code. They use a key of 18 octets, one of 16 octets and one of 10 octets, which exercise both branches of step 1.
For the 16-octet key 000102030405060708090a0b0c0d0e0f, the expected output is 980ae87b5f4c9c5214f5b6a8455e4c2d.
These are practice problems with the answers in the back of the book, so you can check that your recipe works.
§5Security Considerations
The security of AES-CMAC-PRF-128 rests on the strength of AES and AES-CMAC. At the time of writing, the RFC says there were no known practical cryptographic attacks against either. Part of the strength also lies in the secret key VK and in correct implementations. VK needs to be chosen independently and randomly, based on RFC 4086, and both VK and K should be kept safe and periodically refreshed.
If VK is longer than 128 bits and is shortened to fit, some entropy might be lost, but K keeps about 128 bits of entropy. The RFC recommends VK of at least 128 bits and discourages VK of 64 bits or fewer, because of the small entropy.
A good lock needs a good key. Pick a long, truly random key, keep it safe and swap it now and then.
§6IANA Allocation
IANA allocated the value 8 for IKEv2 Transform Type 2 (Pseudo-Random Function) to the PRF_AES128_CMAC algorithm. That is the number two IKEv2 peers use to agree on this PRF.
The algorithm got its own number, 8, so two computers can say which recipe they mean.