1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
|
<pre>Network Working Group J. Schiller
Request for Comments: 4307 Massachusetts Institute of Technology
Category: Standards Track December 2005
<span class="h1">Cryptographic Algorithms for Use in the</span>
<span class="h1">Internet Key Exchange Version 2 (IKEv2)</span>
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
The IPsec series of protocols makes use of various cryptographic
algorithms in order to provide security services. The Internet Key
Exchange (IKE (<a href="./rfc2409">RFC 2409</a>) and IKEv2) provide a mechanism to negotiate
which algorithms should be used in any given association. However,
to ensure interoperability between disparate implementations, it is
necessary to specify a set of mandatory-to-implement algorithms to
ensure that there is at least one algorithm that all implementations
will have available. This document defines the current set of
algorithms that are mandatory to implement as part of IKEv2, as well
as algorithms that should be implemented because they may be promoted
to mandatory at some future time.
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
The Internet Key Exchange protocol provides for the negotiation of
cryptographic algorithms between both endpoints of a cryptographic
association. Different implementations of IPsec and IKE may provide
different algorithms. However, the IETF desires that all
implementations should have some way to interoperate. In particular,
this requires that IKE define a set of mandatory-to-implement
algorithms because IKE itself uses such algorithms as part of its own
negotiations. This requires that some set of algorithms be specified
as "mandatory-to-implement" for IKE.
<span class="grey">Schiller Standards Track [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc4307">RFC 4307</a> IKEv2 Cryptographic Algorithms December 2005</span>
The nature of cryptography is that new algorithms surface
continuously and existing algorithms are continuously attacked. An
algorithm believed to be strong today may be demonstrated to be weak
tomorrow. Given this, the choice of mandatory-to-implement algorithm
should be conservative so as to minimize the likelihood of it being
compromised quickly. Thought should also be given to performance
considerations as many uses of IPsec will be in environments where
performance is a concern.
Finally, we need to recognize that the mandatory-to-implement
algorithm(s) may need to change over time to adapt to the changing
world. For this reason, the selection of mandatory-to-implement
algorithms was removed from the main IKEv2 specification and placed
in this document. As the choice of algorithm changes, only this
document should need to be updated.
Ideally, the mandatory-to-implement algorithm of tomorrow should
already be available in most implementations of IPsec by the time it
is made mandatory. To facilitate this, we will attempt to identify
those algorithms (that are known today) in this document. There is
no guarantee that the algorithms we believe today may be mandatory in
the future will in fact become so. All algorithms known today are
subject to cryptographic attack and may be broken in the future.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Requirements Terminology</span>
Keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", and
"MAY" that appear in this document are to be interpreted as described
in [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
We define some additional terms here:
SHOULD+ This term means the same as SHOULD. However, it is likely
that an algorithm marked as SHOULD+ will be promoted at
some future time to be a MUST.
SHOULD- This term means the same as SHOULD. However, an algorithm
marked as SHOULD- may be deprecated to a MAY in a future
version of this document.
MUST- This term means the same as MUST. However, we expect at
some point that this algorithm will no longer be a MUST in
a future document. Although its status will be determined
at a later time, it is reasonable to expect that if a
future revision of a document alters the status of a MUST-
algorithm, it will remain at least a SHOULD or a SHOULD-.
<span class="grey">Schiller Standards Track [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc4307">RFC 4307</a> IKEv2 Cryptographic Algorithms December 2005</span>
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Algorithm Selection</span>
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>. IKEv2 Algorithm Selection</span>
<span class="h4"><a class="selflink" id="section-3.1.1" href="#section-3.1.1">3.1.1</a>. Encrypted Payload Algorithms</span>
The IKEv2 Encrypted Payload requires both a confidentiality algorithm
and an integrity algorithm. For confidentiality, implementations
MUST- implement 3DES-CBC and SHOULD+ implement AES-128-CBC. For
integrity, HMAC-SHA1 MUST be implemented.
<span class="h4"><a class="selflink" id="section-3.1.2" href="#section-3.1.2">3.1.2</a>. Diffie-Hellman Groups</span>
There are several Modular Exponential (MODP) groups that are defined
for use in IKEv2. They are defined in both the [<a href="#ref-IKEv2" title=""Internet Key Exchange (IKEv2) Protocol"">IKEv2</a>] base document
and in the MODP extensions document. They are identified by group
number. Any groups not listed here are considered as "MAY be
implemented".
Group Number Bit Length Status Defined
2 1024 MODP Group MUST- [<a href="./rfc2409" title=""The Internet Key Exchange (IKE)"">RFC2409</a>]
14 2048 MODP Group SHOULD+ [<a href="./rfc3526" title=""More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)"">RFC3526</a>]
<span class="h4"><a class="selflink" id="section-3.1.3" href="#section-3.1.3">3.1.3</a>. IKEv2 Transform Type 1 Algorithms</span>
IKEv2 defines several possible algorithms for Transfer Type 1
(encryption). These are defined below with their implementation
status.
Name Number Defined In Status
RESERVED 0
ENCR_3DES 3 [<a href="./rfc2451" title=""The ESP CBC-Mode Cipher Algorithms"">RFC2451</a>] MUST-
ENCR_NULL 11 [<a href="./rfc2410" title=""The NULL Encryption Algorithm and Its Use With IPsec"">RFC2410</a>] MAY
ENCR_AES_CBC 12 [<a href="#ref-AES-CBC" title=""The AES-CBC Cipher Algorithm and Its Use with IPsec"">AES-CBC</a>] SHOULD+
ENCR_AES_CTR 13 [<a href="#ref-AES-CTR" title=""Using Advanced Encryption Standard (AES) Counter Mode With IPsec Encapsulating Security Payload (ESP)"">AES-CTR</a>] SHOULD
<span class="h4"><a class="selflink" id="section-3.1.4" href="#section-3.1.4">3.1.4</a>. IKEv2 Transform Type 2 Algorithms</span>
Transfer Type 2 Algorithms are pseudo-random functions used to
generate random values when needed.
Name Number Defined In Status
RESERVED 0
PRF_HMAC_MD5 1 [<a href="./rfc2104" title=""HMAC: Keyed-Hashing for Message Authentication"">RFC2104</a>] MAY
PRF_HMAC_SHA1 2 [<a href="./rfc2104" title=""HMAC: Keyed-Hashing for Message Authentication"">RFC2104</a>] MUST
PRF_AES128_CBC 4 [<a href="#ref-AESPRF" title=""The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)"">AESPRF</a>] SHOULD+
<span class="grey">Schiller Standards Track [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc4307">RFC 4307</a> IKEv2 Cryptographic Algorithms December 2005</span>
<span class="h4"><a class="selflink" id="section-3.1.5" href="#section-3.1.5">3.1.5</a>. IKEv2 Transform Type 3 Algorithms</span>
Transfer Type 3 Algorithms are Integrity algorithms used to protect
data against tampering.
Name Number Defined In Status
NONE 0
AUTH_HMAC_MD5_96 1 [<a href="./rfc2403" title=""The Use of HMAC-MD5-96 within ESP and AH"">RFC2403</a>] MAY
AUTH_HMAC_SHA1_96 2 [<a href="./rfc2404" title=""The Use of HMAC-SHA-1-96 within ESP and AH"">RFC2404</a>] MUST
AUTH_AES_XCBC_96 5 [<a href="#ref-AES-MAC" title=""The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec"">AES-MAC</a>] SHOULD+
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Security Considerations</span>
The security of cryptographic-based systems depends on both the
strength of the cryptographic algorithms chosen and the strength of
the keys used with those algorithms. The security also depends on
the engineering of the protocol used by the system to ensure that
there are no non-cryptographic ways to bypass the security of the
overall system.
This document concerns itself with the selection of cryptographic
algorithms for the use of IKEv2, specifically with the selection of
"mandatory-to-implement" algorithms. The algorithms identified in
this document as "MUST implement" or "SHOULD implement" are not known
to be broken at the current time, and cryptographic research so far
leads us to believe that they will likely remain secure into the
foreseeable future. However, this isn't necessarily forever. We
would therefore expect that new revisions of this document will be
issued from time to time that reflect the current best practice in
this area.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Normative References</span>
[<a id="ref-RFC2409">RFC2409</a>] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", <a href="./rfc2409">RFC 2409</a>, November 1998.
[<a id="ref-IKEv2">IKEv2</a>] Kaufman, C., Ed., "Internet Key Exchange (IKEv2)
Protocol", <a href="./rfc4306">RFC 4306</a>, December 2005.
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
[<a id="ref-RFC3526">RFC3526</a>] Kivinen, T. and M. Kojo, "More Modular Exponential
(MODP) Diffie-Hellman groups for Internet Key Exchange
(IKE)", <a href="./rfc3526">RFC 3526</a>, May 2003.
[<a id="ref-RFC2451">RFC2451</a>] Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
Algorithms", <a href="./rfc2451">RFC 2451</a>, November 1998.
<span class="grey">Schiller Standards Track [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc4307">RFC 4307</a> IKEv2 Cryptographic Algorithms December 2005</span>
[<a id="ref-RFC2410">RFC2410</a>] Glenn, R. and S. Kent, "The NULL Encryption Algorithm
and Its Use With IPsec", <a href="./rfc2410">RFC 2410</a>, November 1998.
[<a id="ref-AES-CBC">AES-CBC</a>] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC
Cipher Algorithm and Its Use with IPsec", <a href="./rfc3602">RFC 3602</a>,
September 2003.
[<a id="ref-AES-CTR">AES-CTR</a>] Housley, R., "Using Advanced Encryption Standard (AES)
Counter Mode With IPsec Encapsulating Security Payload
(ESP)", <a href="./rfc3686">RFC 3686</a>, January 2004.
[<a id="ref-RFC2104">RFC2104</a>] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC:
Keyed-Hashing for Message Authentication", <a href="./rfc2104">RFC 2104</a>,
February 1997.
[<a id="ref-AESPRF">AESPRF</a>] Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
Internet Key Exchange Protocol (IKE)", <a href="./rfc3664">RFC 3664</a>, January
2004.
[<a id="ref-RFC2403">RFC2403</a>] Madson, C. and R. Glenn, "The Use of HMAC-MD5-96 within
ESP and AH", <a href="./rfc2403">RFC 2403</a>, November 1998.
[<a id="ref-RFC2404">RFC2404</a>] Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96
within ESP and AH", <a href="./rfc2404">RFC 2404</a>, November 1998.
[<a id="ref-AES-MAC">AES-MAC</a>] Frankel, S. and H. Herbert, "The AES-XCBC-MAC-96
Algorithm and Its Use With IPsec", <a href="./rfc3566">RFC 3566</a>, September
2003.
Author's Address
Jeffrey I. Schiller
Massachusetts Institute of Technology
Room W92-190
77 Massachusetts Avenue
Cambridge, MA 02139-4307
USA
Phone: +1 (617) 253-0161
EMail: jis@mit.edu
<span class="grey">Schiller Standards Track [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc4307">RFC 4307</a> IKEv2 Cryptographic Algorithms December 2005</span>
Full Copyright Statement
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions
contained in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a>, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and <a href="https://www.rfc-editor.org/bcp/bcp79">BCP 79</a>.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
<a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Schiller Standards Track [Page 6]
</pre>
|
