The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
obsoleted by
- rfc-4434 — The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
Extracted elements (7)
AES-XCBC-MAC produces a 96-bit output, which is appropriate for a MAC but too short for a long-lived PRF in IKE v1 or v2. A 96-bit PRF output creates keys more vulnerable to brute-force attack than a 128-bit PRF output, motivating the creation of AES-XCBC-PRF-128.
AES-XCBC-PRF-128 is constructed by simply omitting the truncation step (section 4.3) of AES-XCBC-MAC, retaining the full 128-bit value after section 4.2. This minimizes the delta from the existing standard and reuses its security analysis.
Test vectors from section 4.6 of RFC 3566 may be used for AES-XCBC-PRF-128, but only those labeled 'AES-XCBC-MAC' (128-bit), not those labeled 'AES-XCBC-MAC-96' (truncated to 96 bits).
Implementations of AES-XCBC-PRF-128 MUST NOT perform the truncation step defined in section 4.3 of RFC 3566 (AES-XCBC-MAC); processing stops after section 4.2, yielding the full 128-bit output.
AES-XCBC-PRF-128 is a pseudo-random function for IKE derived from AES-XCBC-MAC-96 (RFC 3566). It produces a 128-bit output rather than the 96-bit MAC output, making it suitable as a long-lived PRF for IKE key derivation.
The RFC 3566 test vectors show the full 128-bit MAC value before truncation; AES-XCBC-PRF-128 uses the full (non-truncated) MAC value, so implementors must ensure they do not apply the 96-bit truncation when operating in PRF mode.
The security of AES-XCBC-PRF-128 rests on the strength of AES; at time of publication no known practical cryptographic attacks existed against AES or AES-XCBC-MAC-PRF. Strength also depends on key management quality, secret key strength, and correctness of implementations.