The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec
Extracted elements (20)
AES-XCBC-MAC-96 generates K1, K2, K3 from a single 128-bit key (rather than requiring the caller to supply 384 bits) because this approach is analogous to other authenticators used within IPsec, simplifying key management.
AES-XCBC-MAC-96 uses three derived keys (K1, K2, K3) so that the length of the input stream does not need to be known in advance. This is useful for systems that do one-pass assembly of large packets, and it distinguishes full final blocks from padded final blocks to ensure security across arbitrary message lengths.
Classic CBC-MAC is insecure for messages of varying lengths: it is trivial to produce forgeries for a second message given the MAC of a prior message. AES-XCBC-MAC-96 overcomes this by using the three-key XCBC construction, which is provably secure for messages of arbitrary length.
The 96-bit truncation length was selected because it is the default authenticator length specified in the AH specification and meets the security requirements described in XCBC-MAC-2. This aligns AES-XCBC-MAC-96 with other IPsec authenticators such as HMAC-SHA-1-96.
AES-XCBC-MAC-96 is used as an authentication mechanism within IPsec ESP and AH. The key and derived subkeys should be used for no purposes other than those specified in the algorithm; using them as keys in another cryptographic context will invalidate the security of the authentication algorithm.
As of the time of writing, there are no known issues that preclude the use of AES-XCBC-MAC-96 with any specific ESP cipher algorithm.
No implicit packet padding (as defined in the AH specification) is required when using AES-XCBC-MAC-96; padding requirements are handled internally by the XCBC algorithm itself.
A strong pseudo-random function MUST be used to generate the required 128-bit key for AES-XCBC-MAC-96.
For use with either ESP or AH, a truncated authenticator value using the first 96 bits MUST be supported. No other authenticator value lengths are supported by AES-XCBC-MAC-96.
If weak keys for AES-XCBC-MAC-96 are identified, their use MUST be rejected followed by a request for replacement keys or a newly negotiated Security Association.
Key lengths other than 128 bits MUST NOT be supported; only 128-bit keys are to be used by AES-XCBC-MAC-96.
The AES-XCBC-MAC-96 encryption MUST be accomplished using AES with a 128-bit key. For use with ESP or AH, a fixed key length of 128 bits MUST be supported.
AES-XCBC-MAC-96 is a CBC-MAC variant that derives three 128-bit subkeys (K1, K2, K3) from a single 128-bit secret key K by encrypting the constants 0x0101...01, 0x0202...02, and 0x0303...03 with K. K1 is used for all intermediate blocks, K2 for a full final block, and K3 for a padded final block.
AES-XCBC-MAC-96 processes messages in 128-bit blocks. For all blocks M[1] through M[n-1], it XORs each block with the previous ciphertext output and encrypts with K1. The final block M[n] is treated differently: if 128 bits, it is XORed with E[n-1] and K2 before encryption with K1; if less than 128 bits, it is padded with a '1' bit followed by '0' bits, then XORed with E[n-1] and K3 before encryption with K1.
AES-XCBC-MAC-96 requires 384 bits of keying material total (128 bits for the AES key plus 256 bits for K2 and K3), but this is derived from a single 128-bit input key using three AES encryption operations.
IANA assigned AH Transform Identifier 9 to AH_AES-XCBC-MAC and AH/ESP Authentication Algorithm Value 9 to AES-XCBC-MAC.
Data integrity and data origin authentication provided by AES-XCBC-MAC-96 are dependent upon the scope of distribution of the secret key; if the key is known only by source and destination, the algorithm provides both properties. Only a party with the identical key can verify the MAC.
Periodic key refreshment is a fundamental security practice for AES-XCBC-MAC-96; it helps against potential weaknesses of the function and keys, reduces information available to a cryptanalyst, and limits damage from a compromised key, even though current attacks do not necessitate a specific key-change frequency.
The security of AES-XCBC-MAC-96 is based on the strength of AES. Security also depends on the correctness of the implementation, the security of the key management mechanism, and the strength of the secret key. Test vectors are provided to assist in verifying implementation correctness.
AES-XCBC-MAC produces a 128-bit authenticator value; AES-XCBC-MAC-96 truncates this to 96 bits (the leftmost 96 bits of E[n]). Upon sending, the 96-bit truncated value is stored in the authenticator field; upon receipt, the full 128-bit value is computed and the first 96 bits are compared.