RFC 4196
The SEED Cipher Algorithm and Its Use with IPsec
RFC 4196: The SEED Cipher Algorithm and Its Use with IPsec 🎀
Authors: H.J. Lee, J.H. Yoon, S.L. Lee, J.I. Lee (all from KISA) 🫶 Category: Standards Track 👑 Date: October 2005 🌸 Obsoletes/Updates: The header doesn't list anything it obsoletes or updates ✨
Status of This Memo 💅
okay so this doc is an Internet standards track protocol for the Internet community, and it's literally asking everyone for discussion and suggestions for improvements 🦋 bestie, if you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share it with everyone 💜
Copyright Notice 📜
Copyright (C) The Internet Society (2005).
Abstract ✨
this doc is all about using the SEED block cipher in the Cipher Block Chaining Mode, with an explicit IV 🔐 it's a confidentiality mechanism inside the IPsec Encapsulating Security Payload (ESP), and it's giving main character energy 💖
1. Introduction 🧚
1.1. SEED 🇰🇷
SEED is a national industrial association standard [TTASSEED], and it's widely used in South Korea for electronic commerce and financial services running over wired and wireless communications 🛒
SEED is a 128-bit symmetric key block cipher developed by KISA (Korea Information Security Agency) and a group of experts since 1998 🌈 Its input/output block size is 128-bit and its key length is also 128-bit. SEED has the 16-round Feistel structure. A 128-bit input gets split into two 64-bit blocks, and the right 64-bit block goes into the round function along with a 64-bit subkey that comes from the key scheduling 🔑
SEED is super easy to implement in lots of software and hardware, and it can work really well in computing environments with restricted resources, like mobile devices and smart cards 📱💅
SEED is robust against known attacks, including DC (Differential cryptanalysis), LC (Linear cryptanalysis), and related key attacks 🛡️ It has gone through wide public scrutiny, and credible organizations like ISO/IEC JTC 1/SC 27 and Japan CRYPTREC (Cryptography Research and Evaluation Committees) have evaluated it and consider it cryptographically secure 🔥 [ISOSEED][CRYPTREC]
The rest of this document specifies how SEED is used within IPsec ESP. If you want to know how the different pieces of ESP fit together to provide security services, check out [ARCH], [ESP], and [ROAD] 🦋
1.2. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document (in uppercase, as shown) are to be interpreted as described in RFC 2119 [KEYWORDS] ✨ these words are the vibe check for the whole doc, so keep an eye on them 👀
2. The SEED Cipher Algorithm 🌸
All symmetric block cipher algorithms share common characteristics and variables, including mode, key size, weak keys, block size, and rounds. The following sections describe the relevant characteristics of SEED 💜
The algorithm specification and object identifiers are described in [ISOSEED] [SEED]. The SEED homepage, http://www.kisa.or.kr/seed/seed_eng.html, is packed with info, including a detailed specification, evaluation report, test vectors, and more 🍓
2.1. Mode 🔁
NIST has defined 5 modes of operation for the Advanced Encryption Standard (AES) [AES] and other FIPS-approved ciphers [MODES]: CBC (Cipher Block Chaining), ECB (Electronic Codebook), CFB (Cipher FeedBack), OFB (Output FeedBack), and CTR (Counter). CBC mode is well-defined and well-understood for symmetric ciphers, and it's currently required for all other ESP ciphers 💅 This document specifies using the SEED cipher in CBC mode within ESP. This mode needs an Initialization Vector (IV) that is the same size as the block size. Using a randomly generated IV stops identical ciphertext from showing up for packets that have identical data spanning the first block of the cipher algorithm's block size 🙈
The IV is XOR'd with the first plaintext block before it gets encrypted. Then, for each successive block, the previous ciphertext block is XOR'd with the current plaintext before that gets encrypted 🧚
More info on CBC mode is in [MODES] [CRYPTO-S]. For using CBC mode in ESP with 64-bit ciphers, check out [CBC] 📚
2.2. Key Size and Numbers of Rounds 🔢
SEED supports a 128-bit key and has the 16-round Feistel structure 👑
2.3. Weak Keys 🔐
At the time this document was written, there were no known weak keys for SEED ✨
2.4. Block Size and Padding 🧩
SEED uses a block size of 16 octets (128 bits) 💖
Padding is required by SEED to keep a 16-octet (128-bit) blocksize. Padding MUST be added, as specified in [ESP], so that the data to be encrypted (which includes the ESP Pad Length and Next Header fields) has a length that's a multiple of 16 octets 🫶
Because of this algorithm-specific padding requirement, you don't need any extra padding to make the ciphertext end on a 4-octet boundary. Keeping a 16-octet blocksize already guarantees that the ESP Pad Length and Next Header fields are right aligned within a 4-octet word 🎀
Additional padding MAY be included, as specified in [ESP], as long as the 16-octet blocksize is maintained 🌈
2.5. Performance 🚀
Performance figures for SEED are available at http://www.kisa.or.kr/seed/seed_eng.html 💜
3. ESP Payload 🦋
The ESP Payload is made up of the 16-octet Initialization Vector (IV) followed by the encrypted payload. So the payload field, as defined in [ESP], breaks down like this diagram 👇
+---------------+---------------+---------------+---------------+
| |
+ Initialization Vector (16 octets) +
| |
+---------------+---------------+---------------+---------------+
| |
~ Encrypted Payload (variable length, a multiple of 16 octets) ~
| |
+---------------------------------------------------------------+The IV field MUST be the same size as the block size of the cipher algorithm being used. The IV MUST be chosen at random and MUST be unpredictable 🔮
Including the IV in each datagram means every received datagram can be decrypted, even when some datagrams get dropped or re-ordered in transit 🙌
To avoid CBC encryption of very similar plaintext blocks in different packets, implementations MUST NOT use a counter or other low-hamming distance source for IVs 🚫 bestie, this one is serious, so don't skip it 💀
4. Test Vectors ✨
okay bestie, the first 2 test cases are all about SEED-CBC encryption 🧚 Each one gives you the key, the plaintext, and the ciphertext it should produce. All the data is hex with no 0x prefix, so don't get confused 💅
The last 4 test cases are sample ESP packets that use SEED-CBC for encryption 🎀 Same deal, everything is hex with no 0x prefix 🫶
Case #1 : Encrypting 32 bytes (2 blocks) using SEED-CBC with
128-bit key
Key : ed2401ad 22fa2559 91bafdb0 1fefd697
IV : 93eb149f 92c9905b ae5cd34d a06c3c8e
PlainText : b40d7003 d9b6904b 35622750 c91a2457
5bb9a632 364aa26e 3ac0cf3a 9c9d0dcb
CipherText : f072c5b1 a0588c10 5af8301a dcd91dd0
67f68221 55304bf3 aad75ceb 44341c25Case #2 : Encrypting 64 bytes (4 blocks) using SEED-CBC with
128-bit key
Key : 88e34f8f 081779f1 e9f39437 0ad40589
IV : 268d66a7 35a81a81 6fbad9fa 36162501
PlainText : d76d0d18 327ec562 b15e6bc3 65ac0c0f
8d41e0bb 938568ae ebfd92ed 1affa096
394d20fc 5277ddfc 4de8b0fc e1eb2b93
d4ae40ef 4768c613 b50b8942 f7d4b9b3
CipherText : a293eae9 d9aebfac 37ba714b d774e427
e8b706d7 e7d9a097 228639e0 b62b3b34
ced11609 cef2abaa ec2edf97 9308f379
c31527a8 267783e5 cba35389 82b48d06Now the ESP packet cases 🌸 Case #3 is a transport-mode packet from a ping to 192.168.123.100, and it walks through the whole thing: the original packet, the padding, the pad length, the next header, and then the encrypted result 🦋
Case #3 : Sample transport-mode ESP packet (ping 192.168.123.100)
Key : 90d382b4 10eeba7a d938c46c ec1a82bf
SPI : 4321
Source address : 192.168.123.3
Destination address : 192.168.123.100
Sequence number : 1
IV : e96e8c08 ab465763 fd098d45 dd3ff893
Original packet :
IP header (20 bytes) : 45000054 08f20000 4001f9fe c0a87b03 c0a87b64
Data (64 bytes) :
08000ebd a70a0000 8e9c083d b95b0700
08090a0b 0c0d0e0f 10111213 14151617
18191a1b 1c1d1e1f 20212223 24252627
28292a2b 2c2d2e2f 30313233 34353637
Augment data with :
Padding : 01020304 05060708 090a0b0c 0d0e
Pad length : 0e
Next header : 01 (ICMP)
Pre-encryption Data with padding, pad length and next header(80
bytes):
08000ebd a70a0000 8e9c083d b95b0700
08090a0b 0c0d0e0f 10111213 14151617
18191a1b 1c1d1e1f 20212223 24252627
28292a2b 2c2d2e2f 30313233 34353637
01020304 05060708 090a0b0c 0d0e0e01
Post-encryption packet with SPI, Sequence number, IV :
IP Header : 45000054 08f20000 4001f9fe c0a87b03 c0a87b64
SPI/Seq # : 00004321 00000001
IV : e96e8c08 ab465763 fd098d45 dd3ff893
Encrypted Data (80 bytes) :
e7ebaa03 cf45ef09 021b3011 b40d3769
be96ebae cd4222f6 b6f84ce5 b2d5cdd1
60eb6b0e 5a47d16a 501a4d10 7b2d7cc8
ab86ba03 9a000972 66374fa8 f87ee0fb
ef3805db faa144a2 334a34db 0b0f81caCase #4 is another transport-mode one, this time from ping -p 77 -s 20 192.168.123.100 💖
Case #4 : Sample transport-mode ESP packet
(ping -p 77 -s 20 192.168.123.100)
Key : 90d382b4 10eeba7a d938c46c ec1a82bf
SPI : 4321
Source address : 192.168.123.3
Destination address : 192.168.123.100
Sequence number : 8
IV : 69d08df7 d203329d b093fc49 24e5bd80
Original packet:
IP header (20 bytes) : 45000030 08fe0000 4001fa16 c0a87b03 c0a87b64
Data (28 bytes) :
0800b5e8 a80a0500 a69c083d 0b660e00 77777777 77777777 77777777
Augment data with :
Padding : 0102
Pad length : 02
Next header : 01 (ICMP)
Pre-encryption Data with padding, pad length and
next header(32 bytes):
0800b5e8 a80a0500 a69c083d 0b660e00
77777777 77777777 77777777 01020201
Post-encryption packet with SPI, Sequence number, IV :
IP header : 4500004c 08fe0000 4032f9c9 c0a87b03 c0a87b64
SPI/Seq # : 00004321 00000008
IV : 69d08df7 d203329d b093fc49 24e5bd80
Encrypted Data (32 bytes) :
b9ad6e19 e9a6a2fa 02569160 2c0af541
db0b0807 e1f660c7 3ae2700b 5bb5efd1Case #5 is a tunnel-mode ESP packet from a ping to 192.168.123.200. This one is giving full IP-in-IP energy 🌈 The next header is 04 (IP-in-IP), so the original IP header comes along for the ride inside the encrypted payload 👑
Case #5 : Sample tunnel-mode ESP packet (ping 192.168.123.200)
Key : 01234567 89abcdef 01234567 89abcdef
SPI : 8765
Source address : 192.168.123.3
Destination address : 192.168.123.200
Sequence number : 2
IV : f4e76524 4f6407ad f13dc138 0f673f37
Original packet :
IP header (20 bytes) : 45000054 09040000 4001f988 c0a87b03 c0a87bc8
Data (64 bytes) :
08009f76 a90a0100 b49c083d 02a20400
08090a0b 0c0d0e0f 10111213 14151617
18191a1b 1c1d1e1f 20212223 24252627
28292a2b 2c2d2e2f 30313233 34353637
Augment data with :
Padding : 01020304 05060708 090a
Pad length : 0a
Next header : 04 (IP-in-IP)
Pre-encryption Data with original IP header, padding, pad length and
next header (96 bytes) :
45000054 09040000 4001f988 c0a87b03
c0a87bc8 08009f76 a90a0100 b49c083d
02a20400 08090a0b 0c0d0e0f 10111213
14151617 18191a1b 1c1d1e1f 20212223
24252627 28292a2b 2c2d2e2f 30313233
34353637 01020304 05060708 090a0a04
Post-encryption packet with SPI, Sequence number, IV :
IP header : 4500008c 09050000 4032f91e c0a87b03 c0a87bc8
SPI/Seq # : 00008765 00000002
IV : f4e76524 4f6407ad f13dc138 0f673f37
Encrypted Data (96 bytes):
2638aa7b 05e71b54 9348082b 67b47b26
c565aed4 737f0bcb 439c0f00 73e7913c
3c8a3e4f 5f7a5062 003b78ed 7ca54a08
c7ce047d 5bec14e4 8cba1005 32a12097
8d7f5503 204ef661 729b4ea1 ae6a9178
59a5caac 46e810bd 7875bd13 d6f57b3dAnd last but not least, Case #6 is another tunnel-mode packet, this time from ping -p ff -s 40 192.168.123.200 🙈 It's the same basic recipe, just with a different payload full of ff bytes 💀
Case #6 : Sample tunnel-mode ESP packet
(ping -p ff -s 40 192.168.123.200)
Key : 01234567 89abcdef 01234567 89abcdef
SPI : 8765
Source address : 192.168.123.3
Destination address : 192.168.123.200
Sequence number : 5
IV : 85d47224 b5f3dd5d 2101d4ea 8dffab22
Original packet :
IP header (20 bytes) :
45000044 090c0000 4001f990 c0a87b03 c0a87bc8
Data (48 bytes) :
0800d63c aa0a0200 c69c083d a3de0300
ffffffff ffffffff ffffffff ffffffff
ffffffff ffffffff ffffffff ffffffff
Augment data with :
Padding : 01020304 05060708 090a
Pad length : 0a
Next header : 04 (IP-in-IP)
Pre-encryption Data with original IP header, padding, pad length and
next header (80 bytes):
45000044 090c0000 4001f990 c0a87b03
c0a87bc8 0800d63c aa0a0200 c69c083d
a3de0300 ffffffff ffffffff ffffffff
ffffffff ffffffff ffffffff ffffffff
ffffffff 01020304 05060708 090a0a04
Post-encryption packet with SPI, Sequence number, IV :
IP header : 4500007c 090d0000 4032f926 c0a87b03 c0a87bc8
SPI/Seq # : 00008765 00000005
IV : 85d47224 b5f3dd5d 2101d4ea 8dffab22
Encrypted Data (80 bytes) :
311168e0 bc36ac4e 59802bd5 192c5734
8f3d29c8 90bab276 e9db4702 91f79ac7
79571929 c170f902 ffb2f08b d448f782
31671414 ff29b7e0 168e1c87 09ba2b67
a56e0fbc 4ff6a936 d859ed57 6c16ef1b5. Interaction with IKE 🔥
okay this section is about how you use IKE [IKE] to set up IPsec ESP security associations (SAs) that run SEED in CBC mode 🧚 It's basically the handshake part where the two sides agree on the good stuff 🫶
5.1. Phase 1 Identifier
for Phase 1 negotiations, the object identifier of SEED-CBC is defined in [SEED] 💜
algorithm OBJECT IDENTIFIER ::= { iso(1) member-body(2) korea(410)
kisa(200004) algorithm(1) }
id-seedCBC OBJECT IDENTIFIER ::= { algorithm seedCBC(4) }5.2. Phase 2 Identifier
for Phase 2 negotiations, IANA has given ESP Transform Identifier (21) to ESP_SEED_CBC 🎀
5.3. Key Length Attribute
SEED supports 128-bit key lengths, so the Key Length attribute gets set to 128 bits 🌸
5.4. Hash Algorithm Considerations
HMAC-SHA-1 [HMAC-SHA] and HMAC-MD5 [HMAC-MD5] are currently considered strong enough to do two jobs: generating 128-bit SEED keys over IKE, and acting as ESP authenticators for SEED encryption with 128-bit keys 🔐 Both are giving sufficient strength right now 💅
6. Security Considerations 🛡️
okay this is the most important section so pay attention 😭 No security problem has been found on SEED. SEED is secure against all known attacks, including Differential cryptanalysis, Linear cryptanalysis, and related key attacks 🔥 The best known attack is only an exhaustive search for the key (by [CRYPTREC]). For more security considerations, the reader is encouraged to read [CRYPTREC], [ISOSEED], and [SEED-EVAL] 🧐
7. IANA Considerations 🎀
IANA has assigned ESP Transform Identifier (21) to ESP_SEED_CBC 💖
8. Acknowledgments 🫶
the authors want to thank Ph.D Haesuk Kim of Future Systems Inc. and Brian Kim of OULLIM Information Technology Inc. for their expert advice on the Test Vector examples 👑
9. References 📚
9.1. Normative References
[CBC] Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
Algorithms", RFC 2451, November 1998.
[ESP] Kent, S. and R. Atkinson, "IP Encapsulating Security
Payload (ESP)", RFC 2406, November 1998.
[IKE] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.
[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[SEED] Park, J., Lee, S., Kim, J., and J. Lee, "The SEED
Encryption Algorithm", RFC 4009, February 2005.
[TTASSEED] Telecommunications Technology Association (TTA), South
Korea, "128-bit Symmetric Block Cipher (SEED)", TTAS.KO-
12.0004, September, 1998 (In Korean)
http://www.tta.or.kr/English/new/main/index.htm9.2. Informative Reference
[AES] NIST, FIPS PUB 197, "Advanced Encryption Standard(AES),
November 2001.
http://csrc.nist.gov/publications/fips/fips197/fips-197.
{ps,pdf}
[ARCH] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
[CRYPTO-S] Schneier, B., "Applied Cryptography Second Edition", John
Wiley & Sons, New York, NY, 1995, ISBN 0-471-12845-7.
[CRYPTREC] Information-technology Promotion Agency (IPA), Japan,
CRYPTREC. "SEED Evaluation Report", February, 2002
http://www.kisa.or.kr/seed/seed_eng.html
[HMAC-MD5] Madson, C. and R. Glenn, "The Use of HMAC-MD5-96 within
ESP and AH", RFC 2403, November 1998.
[HMAC-SHA] Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96 within
ESP and AH", RFC 2404, November 1998.
[ISOSEED] ISO/IEC JTC 1/SC 27 N3979, "IT Security techniques -
Encryption Algorithms - Part3 : Block ciphers", June
2004.
[MODES] Symmetric Key Block Cipher Modes of Operation,
http://www.nist.gov/modes/.
[ROAD] Thayer, R., N. Doraswamy and R. Glenn, "IP Security
Document Roadmap", RFC 2411, November 1998.
[SEED-EVAL] KISA, "Self Evaluation Report",
http://www.kisa.or.kr/seed/data/Document_pdf/
SEED_Self_Evaluation.pdf"Authors' Address 🌈
Hyangjin Lee
Korea Information Security Agency
Phone: +82-2-405-5446
Fax : +82-2-405-5319
EMail : jiinii@kisa.or.kr
Jaeho Yoon
Korea Information Security Agency
Phone: +82-2-405-5434
Fax : +82-2-405-5219
EMail : jhyoon@kisa.or.kr
Seoklae Lee
Korea Information Security Agency
Phone: +82-2-405-5230
Fax : +82-2-405-5219
EMail : sllee@kisa.or.kr
Jaeil Lee
Korea Information Security Agency
Phone: +82-2-405-5200
Fax : +82-2-405-5219
EMail: jilee@kisa.or.krFull Copyright Statement ✨
Okay so, bestie, the legal bit is up next 💅 Copyright (C) The Internet Society (2005). 🎀
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. 💜
This document and the information in it are provided on an "AS IS" basis, and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🙈
Intellectual Property
The IETF takes no position on whether any Intellectual Property Rights, or other rights that someone might claim over the technology described here, are valid or in scope. It also doesn't say whether any license under those rights might or might not be available, and it hasn't made any independent effort to find such rights. 🦋 If you want the procedures for rights in RFC documents, check out BCP 78 and BCP 79. 📚
Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses that will be made available, and the result of any attempt to get a general license or permission to use these proprietary rights for implementers or users of this specification can all be found in the IETF's online IPR repository at http://www.ietf.org/ipr. 🌸
The IETF invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology needed to implement this standard. 🧚 Send that info to the IETF at ietf-ipr@ietf.org. ✨
Acknowledgement 🫶
Funding for the RFC Editor function is currently provided by the Internet Society. 💖 Thank you to the people keeping the whole RFC machine running, periodt 👑
📦 where this page comes from
- ietf: rfc4196 2005-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms