Modes of Operation for Camellia for Use with IPsec
Extracted elements (15)
Camellia was selected as an optional IPsec cipher because it is available under several open source licenses and has been adopted by major open source projects (OpenSSL, FreeBSD, Linux, Firefox), lowering deployment barriers for implementors.
Camellia in CTR and CCM modes is used in IPsec in the same manner as AES in RFC 3686 (CTR) and RFC 4309 (CCM), with Camellia substituted as the block cipher per RFC 5528.
The Key Length attribute MUST be specified in the IKE exchange when negotiating Camellia transforms, because Camellia supports three key lengths.
The Key Length attribute MUST have a value of 128, 192, or 256 bits. No other key lengths are permitted for Camellia in IKEv2.
The size of KEYMAT MUST be equal to or longer than the associated Camellia key for all three modes (CBC, CTR, CCM).
Camellia-CBC mode is defined in RFC 4312. It follows the same conventions as that specification for use with IPsec ESP.
Camellia uses a block size of 16 octets (128 bits). Padding requirements for Camellia, Camellia-CBC, Camellia-CCM, and ESP are each specified in their respective referenced documents.
ENCR_CAMELLIA_CCM is offered in three ICV (Integrity Check Value) variants — 8, 12, and 16 octets — matching the ICV size options defined for AES-CCM in RFC 4309, giving negotiators a choice of authentication tag length.
Three modes of operation are defined for Camellia with IPsec: Cipher Block Chaining (CBC), Counter (CTR), and Counter with CBC-MAC (CCM). These provide confidentiality, data origin authentication, and connectionless integrity.
IANA assigned five IKEv2 Transform Type 1 (Encryption Algorithm) identifiers: 23 (ENCR_CAMELLIA_CBC), 24 (ENCR_CAMELLIA_CTR), 25 (ENCR_CAMELLIA_CCM with 8-octet ICV), 26 (ENCR_CAMELLIA_CCM with 12-octet ICV), and 27 (ENCR_CAMELLIA_CCM with 16-octet ICV).
No security problems have been found for the Camellia cipher algorithm, as reported by the CRYPTREC evaluation and independently confirmed by the NESSIE project's analysis of optimized implementations.
Security considerations for CTR mode are addressed by reference to Section 9 of RFC 3686 (AES-CTR with IPsec ESP), and for CCM mode by reference to Section 7 of RFC 4309 (AES-CCM with IPsec ESP). No independent security analysis is provided beyond those references.
KEYMAT for Camellia-CBC is exactly the key length: 16 octets for 128-bit, 24 octets for 192-bit, 32 octets for 256-bit. All octets form the Camellia key with no additional fields.
KEYMAT for Camellia-CCM is key-length plus 3 octets: 19 octets (128-bit key + 3-octet salt), 27 octets (192-bit key + 3-octet salt), or 35 octets (256-bit key + 3-octet salt). The trailing 3 octets serve as the salt value in the counter block.
KEYMAT for Camellia-CTR is key-length plus 4 octets: 20 octets (128-bit key + 4-octet nonce), 28 octets (192-bit key + 4-octet nonce), or 36 octets (256-bit key + 4-octet nonce). The trailing 4 octets serve as the nonce value in the counter block.