The Camellia Cipher Algorithm and Its Use With IPsec
Extracted elements (17)
Camellia was designed to follow the same API as AES, so only Phase 1 and Phase 2 identifiers differ from AES-CBC in IKE interactions; all other IKE considerations are identical to those for AES.
Including the IV in each datagram ensures that each received datagram can be decrypted even when some datagrams are dropped or re-ordered in transit, which is a necessary property for ESP use over IP.
Currently there are no known issues regarding interactions between Camellia and other aspects of ESP, such as the use of certain authentication schemes.
The 16-octet block size of Camellia guarantees that the ESP Pad Length and Next Header fields will be right-aligned within a 4-octet word, so no additional padding beyond the 16-octet alignment requirement is needed for ESP framing.
All implementations MUST support the 128-bit key size for Camellia. Implementations MAY also support 192-bit and 256-bit key sizes.
Implementations MUST NOT use a counter or other low Hamming-distance source for IVs, to avoid CBC encryption of very similar plaintext blocks in different packets.
Padding MUST be added as specified in ESP such that the data to be encrypted (including the ESP Pad Length and Next Header fields) is a multiple of 16 octets.
The IV field MUST be the same size as the block size of the cipher algorithm (16 octets). The IV MUST be chosen at random and MUST be unpredictable.
When a 128-bit key is used, implementations MUST use 18 rounds. When a 192-bit or 256-bit key is used, implementations MUST use 24 rounds.
Camellia is used in CBC (Cipher Block Chaining) mode within ESP. The CBC IV is XOR'd with the first plaintext block before encryption; successive blocks XOR the previous ciphertext block with the current plaintext before encryption.
Camellia supports 128-bit block size and 128-, 192-, and 256-bit key lengths, matching the AES interface specification. It uses a Feistel structure and was developed jointly by NTT and Mitsubishi Electric Corporation in 2000.
For IKE Phase 1 negotiations, IANA has assigned Encryption Algorithm ID 8 to CAMELLIA-CBC.
For IKE Phase 2 negotiations, IANA has assigned ESP Transform Identifier 22 to ESP_CAMELLIA.
IANA assigned Encryption Algorithm ID = 8 to CAMELLIA-CBC for IKE Phase 1, and ESP Transform Identifier = 22 to ESP_CAMELLIA for IKE Phase 2.
Implementations are encouraged to use the largest key sizes they can, considering performance. A 128-bit key size is considered secure for the foreseeable future, but both client and server sides of a channel must be considered when selecting key size.
No security problem has been found on Camellia per the CRYPTREC and NESSIE evaluations. Camellia was designed to withstand all known cryptanalytic attacks and has been scrutinized by worldwide cryptographic experts.
The ESP payload consists of a 16-octet Initialization Vector followed by the encrypted payload (variable length, a multiple of 16 octets). The IV occupies the first 16 octets of the payload field.