[IPsec] Re: Fwd: I-D Action:draft-hoffman-ikev2bis-02.txt

Paul Hoffman wrote:
>    In Section 2.13, replaced text about variable length keys with
>    clearer explanation and requirement on non-HMAC PRFs.  Also added
>    "preferred" to Section 2.14 for the key length, and removed redundant
>    text.
> 
>    In Section 2.14, removed the "half and half" description and replaced
>    it with exceptions for RFC4434 and RFC4615.
> 
>    Removed the now-redundant "All PRFs used with IKEv2 MUST take
>    variable-sized keys" from Section 2.15.

okay, these clarifications helped me just now, and answer the questions for 
the email that I posted ten minutes ago.

Tero, based upon this, is your SKEYSEED input you sent me correct?

SshIkev2Crypto/ikev2-crypto.c:328/test_ikev2_skeyseed_agree: Key for PRF (Ni 
| Nr)
00000000: b5ce 8419 095c 6e2b 6b62 d305 5305 b3c4  .....\n+kb..S...
00000010: 47e9 f925 8ca2 3858 f675 b166 b02c c292  G..%..8X.u.f.,..

My inputs were:

unsigned char tc2_ni[] = {
  0xb5, 0xce, 0x84, 0x19,  0x09, 0x5c, 0x6e, 0x2b,
  0x6b, 0x62, 0xd3, 0x05,  0x53, 0x05, 0xb3, 0xc4,
};
unsigned char tc2_nr[] = {
  0x47, 0xe9, 0xf9, 0x25,  0x8c, 0xa2, 0x38, 0x58,
  0xf6, 0x75, 0xb1, 0x66,  0xb0, 0x2c, 0xc2, 0x92,
};

and this was md5, so the key size is 16 bytes.
You have an input key size of 32 bytes.

_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec