The SEED Cipher Algorithm and Its Use with IPsec
Extracted elements (18)
Because SEED's 16-octet blocksize guarantees the ESP Pad Length and Next Header fields are right-aligned within a 4-octet word, no additional padding beyond the cipher's block-size requirement is needed to ensure 4-octet ciphertext boundary alignment.
CBC mode was chosen for SEED within ESP because it is well-defined, well-understood for symmetric ciphers, and is currently required for all other ESP ciphers, ensuring consistency across ESP cipher implementations.
Use of a randomly generated IV prevents generation of identical ciphertext from packets that have identical data spanning the first block of the cipher algorithm's block size, providing semantic security across packets.
For use of CBC mode in ESP with 64-bit ciphers, see RFC 2451. SEED-CBC follows the same structural conventions as other ESP CBC-mode ciphers but with a 128-bit (16-octet) block and IV size rather than 64-bit.
Additional padding MAY be included as specified in ESP, as long as the 16-octet blocksize is maintained.
HMAC-SHA-1 and HMAC-MD5 are currently considered of sufficient strength to serve both as IKE generators of 128-bit SEED keys and as ESP authenticators for SEED encryption using 128-bit keys.
Padding MUST be added as specified in ESP such that the data to be encrypted (including the ESP Pad Length and Next Header fields) has a length that is a multiple of 16 octets (the SEED block size).
The IV MUST be chosen at random and MUST be unpredictable. Including the IV in each datagram ensures decryption can be performed even when datagrams are dropped or reordered in transit.
To avoid CBC encryption of very similar plaintext blocks in different packets, implementations MUST NOT use a counter or other low-hamming distance source for IVs.
For IKE Phase 1 negotiations, the object identifier of SEED-CBC is id-seedCBC, defined under the KISA algorithm OID arc: { iso(1) member-body(2) korea(410) kisa(200004) algorithm(1) seedCBC(4) }.
SEED has no known weak keys as of the time this document was written, distinguishing it from ciphers such as DES which have documented weak key classes.
SEED is a 128-bit symmetric key block cipher with a 128-bit block size and 128-bit key length, using a 16-round Feistel structure. A 128-bit input is divided into two 64-bit blocks; the right 64-bit block is input to the round function with a 64-bit subkey derived from key scheduling.
SEED is used in CBC (Cipher Block Chaining) mode within ESP. This mode requires an IV the same size as the block size (16 octets). The IV is XOR'd with the first plaintext block before encryption; for successive blocks, the previous ciphertext block is XOR'd with the current plaintext.
SEED uses a block size of 16 octets (128 bits) and a key size of 128 bits with a 16-round Feistel structure; it supports only a single fixed key length with no variable key size attribute negotiation beyond the fixed 128-bit value.
The Key Length attribute for SEED in IKE Phase 2 is set to 128 bits, reflecting SEED's fixed 128-bit key size.
IANA has assigned ESP Transform Identifier (21) to ESP_SEED_CBC for use in IKE Phase 2 negotiations.
No security problem has been found on SEED. SEED is secure against all known attacks including Differential cryptanalysis, Linear cryptanalysis, and related key attacks. The best known attack is only an exhaustive search for the key, as evaluated by CRYPTREC.
The ESP payload for SEED-CBC consists of a 16-octet Initialization Vector followed by the encrypted payload (variable length, a multiple of 16 octets). The IV field MUST be the same size as the cipher's block size.