The Advanced Encryption Standard-Cipher-based Message Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128) Algorithm for the Internet Key Exchange Protocol (IKE)
Extracted elements (9)
When VK is not exactly 128 bits, it is normalized to 128 bits by applying AES-CMAC with an all-zero key. This allows IKEv2 to use variable-length shared secrets for authentication while still satisfying AES-CMAC's fixed 128-bit key requirement.
When used as the PRF in IKEv2 for generating keying material, AES-CMAC-PRF-128 is considered to take fixed-size 16-octet keys ('half the bits must come from Ni and half from Nr'). For authenticating with shared secrets (IKEv2 section 2.16), the key may vary in length.
The key VK needs to be chosen independently and randomly based on RFC 4086, and both keys VK and K should be kept safe and periodically refreshed.
Use of VK longer than or equal to 128 bits is recommended; use of VK shorter than or equal to 64 bits is discouraged because of small entropy.
AES-CMAC-PRF-128 is a PRF algorithm identical to AES-CMAC (RFC 4493) except that the 128-bit key length restriction is removed, supporting variable-length keys (VK). It takes a variable-length key VK, a message M, and produces a 128-bit pseudo-random output (PRV).
The algorithm operates in two steps: (1) derive a 128-bit key K from VK — if VKlen equals 16 octets, K := VK; otherwise K := AES-CMAC(0^128, VK, VKlen); (2) compute PRV := AES-CMAC(K, M, len) and return PRV.
IANA allocated the value 8 for IKEv2 Transform Type 2 (Pseudo-Random Function) to the PRF_AES128_CMAC algorithm.
Part of the algorithm's strength lies in the secrecy of VK and correctness of implementation. Test vectors in Section 4 are provided to assist in verifying implementation correctness.
Security of AES-CMAC-PRF-128 depends on the strength of AES and AES-CMAC. If VK is longer than 128 bits and is shortened via the normalization step, some entropy may be lost, but the derived key K preserves approximately 128 bits of entropy as long as VK is longer than 128 bits.