Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
Extracted elements (17)
Fixed key lengths equal to the hash output length are required for authentication use (not variable) because allowing variable-length keys for IPsec authenticator functions would create interoperability issues, and keys shorter than the output length decrease security strength.
HMAC-SHA-256 with 128-bit truncation is not necessarily more secure than HMAC-SHA1-96 against adversaries lacking key knowledge, since both produce 128-bit authenticators giving the same 1-in-2^128 guessing probability. The advantage of HMAC-SHA-256+ lies in longer key lengths providing more resistance to key-guessing attacks.
Truncation lengths of nnn/2 bits (128, 192, or 256 bits) were chosen because they correspond to the birthday attack bound for each HMAC-SHA-256+ algorithm, simultaneously minimizing additional wire overhead.
As of the time of writing, there are no known issues that preclude the use of HMAC-SHA-256+ algorithms with any specific ESP, IKE, or IKEv2 cipher mechanism.
IKEv2 differentiates between PRFs with fixed key sizes and those with variable key sizes; the PRF variants defined here (PRF-HMAC-SHA-256, PRF-HMAC-SHA-384, PRF-HMAC-SHA-512) are considered to have variable key length when used with IKE or IKEv2.
A strong pseudo-random function MUST be used to generate the required key for use with HMAC-SHA-256+.
When used as a data origin authentication and integrity verification algorithm in ESP, AH, IKE, or IKEv2, a truncated value using the first nnn/2 bits MUST be supported. No other authenticator value lengths are supported by this specification.
When used as an integrity/authentication algorithm, a fixed key length equal to the output length of the hash function MUST be supported, and key lengths other than the output length MUST NOT be supported.
For PRF usage with IKE/IKEv2, keys shorter than the block size are right-padded with zero bits to exactly the block size; keys longer than the block size are hashed down using the corresponding hash algorithm, then zero-padded to block size.
No implicit packet padding is required for HMAC-SHA-256+ algorithms as defined in AH. Padding is handled internally by the underlying SHA hash algorithms per FIPS PUB 180-2.
PRF variants (PRF-HMAC-SHA-256, PRF-HMAC-SHA-384, PRF-HMAC-SHA-512) are identical to their authentication counterparts except that variable-length keys are permitted and the truncation step is NOT performed.
Six algorithm variants are defined: three authentication/integrity algorithms (HMAC-SHA-256-128, HMAC-SHA-384-192, HMAC-SHA-512-256) with fixed keys equal to output length and truncated output, and three PRF variants (PRF-HMAC-SHA-256, PRF-HMAC-SHA-384, PRF-HMAC-SHA-512) with variable-length keys and no truncation.
IANA assigned IKE Phase 1 hash algorithm attribute values: SHA2-256=4, SHA2-384=5, SHA2-512=6; IKE Phase 2 authentication algorithm identifiers: HMAC-SHA2-256=5, HMAC-SHA2-384=6, HMAC-SHA2-512=7; IKEv2 PRF (type 2) transform identifiers: PRF_HMAC_SHA2_256=5, PRF_HMAC_SHA2_384=6, PRF_HMAC_SHA2_512=7; and IKEv2 integrity (type 3) transform identifiers: AUTH_HMAC_SHA2_256_128=12, AUTH_HMAC_SHA2_384_192=13, AUTH_HMAC_SHA2_512_256=14.
Key distribution mechanisms must ensure that unique keys are allocated and distributed only to the parties participating in the communication, in order to provide data origin authentication and integrity verification.
Periodic key refreshment is a fundamental security practice recommended even though no practical attacks against HMAC-SHA-256+ are known. Weak keys (e.g., dictionary words) are dramatically less resistant to attack regardless of the algorithm's theoretical strength.
Security of HMAC-SHA-256+ depends on the strength of the underlying hash algorithm, the HMAC construct, correctness of implementation, security of key management, and strength of the secret key. Test vectors are provided to verify implementation correctness but do not verify surrounding security infrastructure.
HMAC-SHA-256-128 uses a 512-bit block size, 256-bit output, 128-bit truncated authenticator field, and 256-bit key. HMAC-SHA-384-192 uses 1024-bit block, 384-bit output, 192-bit authenticator, and 384-bit key. HMAC-SHA-512-256 uses 1024-bit block, 512-bit output, 256-bit authenticator, and 512-bit key.