The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
obsoletes
- rfc-3664 — The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
Extracted elements (8)
AES-XCBC-MAC produces a 128-bit value that is truncated to 96 bits for use as a MAC. AES-XCBC-PRF-128 omits this truncation step, retaining the full 128-bit output, because 96 bits is too short for a long-lived PRF in IKEv1 or IKEv2 and creates keys more vulnerable to brute-force attacks than 128-bit output.
RFC 3664 required keys to be exactly 128 bits; this restriction is removed in RFC 4434 to align AES-XCBC-PRF-128 with HMAC-SHA1 and HMAC-MD5 as used in IKE, which accept variable-length keys. Bits-on-the-wire results are identical for 128-bit keys.
When used with IKEv2, AES-XCBC-PRF-128 is treated as fixed-length for generating keying material (half bits from Ni, half from Nr per IKEv2 section 2.14) but variable-length for authentication with shared secrets (IKEv2 section 2.16), allowing interoperability between RFC 3664 fixed-length-key implementations and RFC 4434 variable-length-key implementations.
AES-XCBC-PRF-128 is identical to AES-XCBC-MAC with two changes: the 128-bit key-length restriction is removed, and the truncation step in AES-XCBC-MAC section 4.3 is omitted so the full 128-bit MAC value is used as the PRF output.
Key normalization for AES-XCBC-PRF-128: a 128-bit key is used as-is; a shorter key is right-padded with zero bits to 128 bits; a longer key is shortened to 128 bits by recursively applying AES-XCBC-PRF-128 with a 128-zero-bit key over the too-long key as the message.
Implementers should use the full 128-bit MAC value from AES-XCBC-MAC (not the 96-bit truncated value) when implementing the PRF; the test vectors in AES-XCBC-MAC show the full value before truncation and are applicable for verifying AES-XCBC-PRF-128 correctness.
The security of AES-XCBC-PRF-128 relies on the strength of AES and HMAC; at the time of writing no practical cryptographic attacks were known against AES, AES-XCBC-MAC-PRF, or HMAC. Security also depends on key management quality, secret key strength, and correctness of implementations.
The PRF output is 128 bits (16 bytes), being the full AES-XCBC-MAC value before truncation. Test vectors confirm: a 16-byte key with 20-byte input yields output 47f51b4564966215b8985c63055ed308.