The AES-CBC Cipher Algorithm and Its Use with IPsec
Extracted elements (19)
AES was selected by NIST on the basis of security, public disclosure, royalty-free availability worldwide, support for 128/192/256-bit keys, computational efficiency across diverse hardware including smart cards, and simplicity of implementation.
CBC mode was chosen because it is well-defined, well-understood for symmetric ciphers, and is currently required for all other ESP ciphers, ensuring consistency across the ESP cipher suite.
Including the IV in each datagram (rather than deriving it from a counter) ensures decryption can be performed even when datagrams are dropped or reordered in transit, at the cost of 16 octets of overhead per packet.
The 16-octet block size of AES eliminates the need for additional padding to align the ESP Pad Length and Next Header fields on a 4-octet boundary, since a 16-octet multiple is also a 4-octet multiple.
HMAC-SHA-1 and HMAC-MD5 are currently considered sufficient strength to serve as IKE generators of 128-bit AES keys and as ESP authenticators for AES encryption using 128-bit keys, without requiring SHA-256/384/512.
All implementations MUST support the 128-bit key size for AES-CBC. Implementations MAY also support 192-bit and 256-bit key sizes.
If weak keys are discovered for AES, weak keys SHOULD be checked for and discarded when using manual key management. When using dynamic key management (e.g., IKE), weak key checks SHOULD NOT be performed as unnecessary complexity.
Implementations MUST NOT use a counter or other low-Hamming-distance source for IVs, to avoid CBC encryption of very similar plaintext blocks in different packets.
Padding MUST be added as specified in ESP such that the data to be encrypted (including ESP Pad Length and Next Header fields) has a length that is a multiple of 16 octets.
The IV field MUST be the same size as the block size (16 octets). The IV MUST be chosen at random and MUST be unpredictable.
The Key Length attribute MUST be specified in both a Phase 1 IKE exchange and a Phase 2 exchange, because AES supports variable key lengths.
When a 128-bit key is used, implementations MUST use 10 rounds; 192-bit keys MUST use 12 rounds; 256-bit keys MUST use 14 rounds.
AES-CBC uses a block size of 16 octets (128 bits) and an IV of the same size. The IV is XOR'd with the first plaintext block before encryption; subsequent blocks XOR the previous ciphertext block with the current plaintext before encryption.
AES supports three key sizes: 128, 192, and 256 bits, with 128 bits as the default. The number of rounds varies per key size: 10, 12, and 14 respectively.
The keying material provided by the key exchange protocol to the ESP algorithm must be at least as large as the key size; the cipher key is taken from the first <x> bits of that material.
IANA has assigned Encryption Algorithm ID 7 to AES-CBC for IKE Phase 1 negotiations, and ESP Transform Identifier 12 to ESP_AES for Phase 2 negotiations.
Implementations are encouraged to use the largest key sizes practical for their hardware/software configuration. A 128-bit key is considered secure for the foreseeable future, but performance trade-offs must account for both client and server sides of a secure channel.
Random IV values are necessary to prevent probable plaintext cryptanalysis. Using a counter or low-Hamming-distance source for IVs allows an attacker to exploit similarities between ciphertext blocks across packets.
The ESP payload consists of a 16-octet Initialization Vector followed by the encrypted payload (variable length, a multiple of 16 octets). The IV precedes the ciphertext directly within the ESP payload field.