RFC 4308

Cryptographic Suites for IPsec

📅 published December 2005, from ietf

RFC 4308: Cryptographic Suites for IPsec 🎀

Okay bestie, this is RFC 4308 💖 Cryptographic Suites for IPsec, written by Paul Hoffman from the VPN Consortium. It's on the Standards Track and it's dated December 2005. The header doesn't list anything it obsoletes or updates, so it's doing its own thing 🧚

Status of This Memo ✨

This document is an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements. For the current standardization state and status of this protocol, check the "Internet Official Protocol Standards" (STD 1) 📚 Distribution of this memo is unlimited 🌈

Copyright (C) The Internet Society (2005).

Abstract 🦋

IPsec, Internet Key Exchange (IKE), and IKEv2 all lean on security algorithms to give privacy and authentication between the initiator and responder 🔐 There are so many algorithms out there, and two IPsec systems can't talk to each other unless they're using the same ones 😭 This document specifies optional suites of algorithms and attributes that make IPsec administration way easier when you're using manual keying mode, IKEv1, or IKEv2 ✨

1. Introduction 🎀

This document is a companion to IPsec [RFC2401] and its two key exchange protocols, IKE [RFC2409] and IKEv2 [IKEv2]. Like most security protocols, IPsec, IKE, and IKEv2 let users choose which cryptographic algorithms they want to use for their security needs 🔑

Implementation experience with IPsec in manual key mode and with IKE showed that typical system administrators have so many choices to make that it's hard to get interoperability without careful pre-agreement 🙈 So the IPsec Working Group agreed there should be a small number of named suites that cover typical security policies 💅 These suites might show up in the administrative interface of the IPsec system. They're often called "UI suites" ("user interface suites"), and they're optional. They don't stop implementers from allowing individual selection of the security algorithms 🫶

Even though the UI suites listed here are optional to implement, this document is on the standards track. Why? Because implementers who call particular suites by the names used here have to conform to the suites listed in this document 👑 These suites shouldn't be treated as extensions to IPsec, IKE, and IKEv2. They're administrative methods for describing sets of configurations, and that's it 🧚

The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", and "MAY" in this document are to be interpreted as described in [RFC2119] 🌸

2. UI Suites 💅

This section lists optional, non-mandatory suites that may be presented to system administrators to make it easier to choose among the many options in IPsec systems 🍓 These suites can't cover every option an administrator needs to select. Instead, they give values for a subset of the options 🦋

Note that these UI suites are just collections of values for some options in IPsec. Using UI suites doesn't change the IPsec, IKE, or IKEv2 protocols in any way 🙌 Specifically, the transform substructure in IKE and IKEv2 must be used to give the value for each specified option, whether or not UI suites are used.

Implementations that use UI suites SHOULD also provide a management interface for specifying values for individual cryptographic options 🔥 Honestly, UI suites probably aren't a complete solution for matching the security policies of many IPsec users. So an interface that gives a more complete set of options should be used as well 💖

IPsec implementations that use these UI suites SHOULD use the suite names listed here 🎀 IPsec implementations SHOULD NOT use different names for the suites described here, and they MUST NOT use the names listed here for suites that don't match these values. These requirements are necessary for interoperability, so no skipping them 😤✨

Note that the suites listed here are for use of IPsec in virtual private networks. Other uses of IPsec will probably want to define their own suites and give them different names 🌈

Additional suites can be defined by RFCs. The strings used to identify UI suites are registered by IANA 📋

2.1. Suite "VPN-A" 👑

This suite matches the commonly used corporate VPN security used in IKEv1 at the time this document was published 💼

IPsec:
Protocol               Encapsulating Security Payload (ESP) [RFC2406]
ESP encryption         TripleDES in CBC mode [RFC2451]
ESP integrity          HMAC-SHA1-96 [RFC2404]

IKE and IKEv2:
Encryption             TripleDES in CBC mode [RFC2451]
Pseudo-random function HMAC-SHA1 [RFC2104]
Integrity              HMAC-SHA1-96 [RFC2404]
Diffie-Hellman group   1024-bit Modular Exponential (MODP) [RFC2409]

Rekeying of Phase 2 (for IKE) or the CREATE_CHILD_SA (for IKEv2) MUST be supported by both parties in this suite 🔄 The initiator of this exchange MAY include a new Diffie-Hellman key. If it does include one, that key MUST be of type 1024-bit MODP. And if the initiator includes a Diffie-Hellman key, the responder MUST include a Diffie-Hellman key too, and it MUST be of type 1024-bit MODP 🫶

2.2. Suite "VPN-B" 🌸

This suite is what a lot of people expect the commonly used corporate VPN security to be within a few years of this document's publication 🔮

IPsec:
Protocol                 ESP [RFC2406]
ESP encryption           AES with 128-bit keys in CBC mode [AES-CBC]
ESP integrity            AES-XCBC-MAC-96 [AES-XCBC-MAC]

IKE and IKEv2:
Encryption               AES with 128-bit keys in CBC mode [AES-CBC]
Pseudo-random function   AES-XCBC-PRF-128 [AES-XCBC-PRF-128]
Integrity                AES-XCBC-MAC-96 [AES-XCBC-MAC]
Diffie-Hellman group     2048-bit MODP [RFC3526]

Rekeying of Phase 2 (for IKE) or the CREATE_CHILD_SA (for IKEv2) MUST be supported by both parties in this suite 🔄 The initiator of this exchange MAY include a new Diffie-Hellman key. If it does include one, that key MUST be of type 2048-bit MODP. And if the initiator includes a Diffie-Hellman key, the responder MUST include a Diffie-Hellman key too, and it MUST be of type 2048-bit MODP 💅

2.3. Lifetimes for IKEv1 ⭐

IKEv1 has two security parameters that don't show up in IKEv2: the lifetime of the Phase 1 and Phase 2 security associations (SAs) ⏳ Systems that use IKEv1 with either the VPN-A or VPN-B suites MUST use an SA lifetime of 86400 seconds (1 day) for Phase 1, and an SA lifetime of 28800 seconds (8 hours) for Phase 2 🎀

Acknowledgement 🫶

okay bestie, last bit! 💖 funding for the RFC Editor function is currently provided by the Internet Society 🌸 so big thank yous to them for keeping that whole operation running ✨💅

📦 where this page comes from