[Ipsec] Comments to draft-songlee-aes-cmac-prf-128-01.txt

[Tero Kivinen <[e-mail]>]

The draft uses truncation to truncate the key if it is longer than 128
bits. This is not very well suited for the IKEv2 use.

The PRF is used in IKEv2 with key (Ni | Nr), where the length of Ni
and Nr is between 16 and 256 octects. This means that the keying
material when calculating SKEYSEED of the IKE_SA (2.14) is always only
Ni and the responder nonce does not affect to the value of the
SKEYSEED at all.

It would be better to use similar method than
draft-hoffman-rfc3664bis-05.txt does, i.e:
----------------------------------------------------------------------
   o  If the key is 129 bits or longer, shorten it to exactly 128 bits
      by performing the steps in AES-XCBC-PRF-128 (that is, the
      algorithm described in this document).  In that re-application of
      this algorithm, the key is 128 zero bits; the message is the too-
      long current key.
----------------------------------------------------------------------

Also the IANA consideration section needs to have a bit more text.
I.e. something like:

6. IANA Consideration

   IANA should allocate a value for IKEv2 Transform Type 2
   (Pseudo-random Function (PRF)) to the PRF_AES128_CMAC algorithm
   when this document is published.
-- 
[e-mail]

_______________________________________________
Ipsec mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/ipsec