Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)
RFC 4309

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 05

Network Working Group                                         R. Housley
Request for Comments: 4309                                Vigil Security
Category: Standards Track                                  December 2005

           Using Advanced Encryption Standard (AES) CCM Mode
            with IPsec Encapsulating Security Payload (ESP)

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2005).

Abstract

   This document describes the use of Advanced Encryption Standard (AES)
   in Counter with CBC-MAC (CCM) Mode, with an explicit initialization
   vector (IV), as an IPsec Encapsulating Security Payload (ESP)
   mechanism to provide confidentiality, data origin authentication, and
   connectionless integrity.

Table of Contents

   1. Introduction ....................................................2
      1.1. Conventions Used in This Document ..........................2
   2. AES CCM Mode ....................................................2
   3. ESP Payload .....................................................4
      3.1. Initialization Vector (IV) .................................4
      3.2. Encrypted Payload ..........................................4
      3.3. Authentication Data ........................................5
   4. Nonce Format ....................................................5
   5. AAD Construction ................................................6
   6. Packet Expansion ................................................7
   7. IKE Conventions .................................................7
      7.1. Keying Material and Salt Values ............................7
      7.2. Phase 1 Identifier .........................................8
      7.3. Phase 2 Identifier .........................................8
      7.4. Key Length Attribute .......................................8
   8. Test Vectors ....................................................8
   9. Security Considerations .........................................8
   10. Design Rationale ...............................................9

Housley                     Standards Track                     [Page 1]
RFC 4309           Using AEC CCM Mode with IPsec ESP       December 2005

   11. IANA Considerations ...........................................11
   12. Acknowledgements ..............................................11
   13. References ....................................................11
      13.1. Normative References .....................................11
      13.2. Informative References ...................................12

1.  Introduction

   The Advanced Encryption Standard (AES) [AES] is a block cipher, and
   it can be used in many different modes.  This document describes the
   use of AES in CCM (Counter with CBC-MAC) mode (AES CCM), with an
   explicit initialization vector (IV), as an IPsec Encapsulating
   Security Payload (ESP) [ESP] mechanism to provide confidentiality,
   data origin authentication, and connectionless integrity.

   This document does not provide an overview of IPsec.  However,
   information about how the various components of IPsec and the way in
   which they collectively provide security services is available in
   [ARCH] and [ROAD].

1.1.  Conventions Used in This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [STDWORDS].

2.  AES CCM Mode

   CCM is a generic authenticate-and-encrypt block cipher mode [CCM].
   In this specification, CCM is used with the AES [AES] block cipher.

   AES CCM has two parameters:

      M  M indicates the size of the integrity check value (ICV).  CCM
         defines values of 4, 6, 8, 10, 12, 14, and 16 octets; However,
         to maintain alignment and provide adequate security, only the
         values that are a multiple of four and are at least eight are
         permitted.  Implementations MUST support M values of 8 octets
         and 16 octets, and implementations MAY support an M value of 12
         octets.

      L  L indicates the size of the length field in octets.  CCM
         defines values of L between 2 octets and 8 octets.  This
         specification only supports L = 4.  Implementations MUST
         support an L value of 4 octets, which accommodates a full
         Jumbogram [JUMBO]; however, the length includes all of the
         encrypted data, which also includes the ESP Padding, Pad
         Length, and Next Header fields.

Housley                     Standards Track                     [Page 2]