The Use of HMAC-MD5-96 within ESP and AH
Extracted elements (14)
A 128-bit key length was chosen based on RFC 2104 recommendations: keys shorter than the authenticator length decrease security strength, while keys longer than the authenticator length do not significantly increase security strength.
HMAC-MD5-96 does not require implicit packet padding as defined in AH, because MD5 padding requirements are handled internally by the MD5 algorithm per RFC 1321.
The 96-bit authenticator length was selected because it is the default authenticator length specified in the AH specification and meets the security requirements described in RFC 2104.
As of the time of writing, there are no known issues precluding the use of HMAC-MD5-96 with any specific ESP cipher algorithm.
RFC 2202 contains test vectors and example code to assist in verifying the correctness of HMAC-MD5-96 implementations, ensuring interoperability across participating systems.
A strong pseudo-random function MUST be used to generate the required 128-bit HMAC-MD5-96 key.
For use with either ESP or AH, a fixed key length of 128-bits MUST be supported. Key lengths other than 128-bits MUST NOT be supported.
HMAC-MD5-96 operates on 64-byte blocks of data and produces a 128-bit authenticator value, truncated to 96 bits for use in ESP or AH. The truncated value is stored in the authenticator field; upon receipt the full 128-bit value is computed and the first 96 bits compared.
Hash truncation provides additional security; specifications including HMAC are strongly encouraged to perform hash truncation. RFC 2104 discusses the security benefits of truncation.
If weak keys for HMAC are ever identified, use of those keys must be rejected and replacement keys or a newly negotiated Security Association must be requested. At the time of writing, no weak keys for HMAC were known.
Periodic key refreshment is a fundamental security practice recommended for HMAC-MD5-96: it guards against potential weaknesses, reduces information available to a cryptanalyst, and limits damage from an exposed key, even though current attacks do not mandate a specific rekeying frequency.
The birthday attack, the strongest known attack against HMAC, is impractical for HMAC-MD5-96: a successful attack would require processing 2**64 blocks, which is infeasible unless the underlying hash had collisions after only 2**30 blocks.
The security of HMAC-MD5-96 is based primarily on the strength of HMAC and secondarily on MD5. MD5 has been shown to be less collision-resistant than originally thought; however, HMAC does not depend on strong collision resistance, and at the time of writing no practical cryptographic attacks against HMAC-MD5-96 were known.
The authenticator field carries a 96-bit (12-byte) truncated HMAC-MD5 value, derived by computing the full 128-bit HMAC-MD5 output and retaining only the first 96 bits.