RFC 4309

Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)

📅 published December 2005, from ietf

RFC 4309: Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP) 🎀

okay so this RFC is literally the spec for using AES in CCM mode (with an explicit IV) as an IPsec ESP mechanism. it's how you get confidentiality, data origin authentication, and connectionless integrity all in one go 🔥

the title block says it was written by R. Housley of Vigil Security 🧚. it's a Standards Track doc, dated December 2005, and it's a Network Working Group RFC numbered 4309. the header doesn't list anything it obsoletes or updates, so there's nothing to cross-check there 🦋

Status of This Memo ✨

bestie, this part is the legal-ish bit, but it's important: this doc is an Internet standards track protocol for the Internet community, and it's inviting discussion and suggestions for improvements 💅 for the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). distribution of this memo is unlimited 🌸

Copyright Notice ✨

Abstract ✨

so the big idea: this doc describes using AES in Counter with CBC-MAC (CCM) mode, with an explicit initialization vector (IV), as an IPsec Encapsulating Security Payload (ESP) mechanism. the goal is to give you confidentiality, data origin authentication, and connectionless integrity 🔐 it's giving main character energy ✨

Table of Contents 🌈

   1. Introduction ....................................................2
      1.1. Conventions Used in This Document ..........................2
   2. AES CCM Mode ....................................................2
   3. ESP Payload .....................................................4
      3.1. Initialization Vector (IV) .................................4
      3.2. Encrypted Payload ..........................................4
      3.3. Authentication Data ........................................5
   4. Nonce Format ....................................................5
   5. AAD Construction ................................................6
   6. Packet Expansion ................................................7
   7. IKE Conventions .................................................7
      7.1. Keying Material and Salt Values ............................7
      7.2. Phase 1 Identifier .........................................8
      7.3. Phase 2 Identifier .........................................8
      7.4. Key Length Attribute .......................................8
   8. Test Vectors ....................................................8
   9. Security Considerations .........................................8
  10. Design Rationale ...............................................9
  11. IANA Considerations ...........................................11
  12. Acknowledgements ..............................................11
  13. References ....................................................11
      13.1. Normative References .....................................11
      13.2. Informative References ...................................12

1. Introduction 🌸

okay so AES is a block cipher, and it's super flexible because it works in lots of different modes. this doc is all about AES in CCM (Counter with CBC-MAC) mode, which we'll call AES CCM. we use an explicit IV, and we plug it into IPsec ESP [ESP] for confidentiality, data origin authentication, and connectionless integrity 🦋

it doesn't give you an IPsec overview though, bestie. if you want to know how all the IPsec pieces work together to give security services, check out [ARCH] and [ROAD] 📚

1.1. Conventions Used in This Document 💅

here's the important bit about the key words. the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [STDWORDS] 🫶

2. AES CCM Mode 🎀

so CCM is a generic authenticate-and-encrypt block cipher mode [CCM], and in this spec it's paired with the AES [AES] block cipher 💖

AES CCM has two parameters, and they're iconic:

M (ICV size): M is the size of the integrity check value (ICV). CCM defines values of 4, 6, 8, 10, 12, 14, and 16 octets. however, to keep things aligned and still secure enough, only values that are a multiple of four and at least eight are permitted. implementations MUST support M values of 8 octets and 16 octets, and implementations MAY support an M value of 12 octets 🔥
L (length field): L is the size of the length field in octets. CCM defines values of L between 2 octets and 8 octets. this spec only supports L = 4. implementations MUST support an L value of 4 octets, which fits a full Jumbogram [JUMBO]. the length covers all the encrypted data, which also includes the ESP Padding, Pad Length, and Next Header fields 🧚

there are four inputs to CCM originator processing, and you need to know all of them 👑

key: a single key is used to calculate the ICV using CBC-MAC and to do the payload encryption using counter mode. AES supports key sizes of 128 bits, 192 bits, and 256 bits. the default key size is 128 bits, and implementations MUST support this key size. implementations MAY also support key sizes of 192 bits and 256 bits 🔑
nonce: the size of the nonce depends on what you pick for L. it's 15-L octets. implementations MUST support a nonce of 11 octets. the nonce is built the way Section 4 describes 🌈
payload: the payload of the ESP packet. the payload MUST NOT be longer than 4,294,967,295 octets, which is the maximum size of a Jumbogram [JUMBO]. the ESP Padding, Pad Length, and Next Header fields are also part of the payload 📦
AAD: CCM gives you data integrity and data origin authentication for some data outside the payload. CCM doesn't let additional authenticated data (AAD) get longer than 18,446,744,073,709,551,615 octets. the ICV is computed from the ESP header, Payload, and ESP trailer fields, which is way smaller than the CCM limit. the AAD is constructed the way Section 5 describes 🦋

AES CCM requires the encryptor to generate a unique per-packet value and to communicate that value to the decryptor 💜 this per-packet value is one of the component parts of the nonce, and it's called the initialization vector (IV). the same IV and key combination MUST NOT be used more than once. the encryptor can make the IV in any way that guarantees uniqueness. common approaches include incrementing a counter for each packet and using linear feedback shift registers (LFSRs) ✨

AES CCM uses counter mode for encryption, and like any stream cipher, reusing the same IV with the same key is catastrophic 💀 an IV collision immediately leaks information about the plaintext in both packets. so it's inappropriate to use this CCM with statically configured keys. you'd need extraordinary measures to stop IV reuse with the static key across power cycles. to be safe, implementations MUST use fresh keys with AES CCM. the Internet Key Exchange (IKE) [IKE] protocol or IKEv2 [IKEv2] can be used to establish fresh keys 🔐

3. ESP Payload 🍓

the ESP payload is the IV followed by the ciphertext. the payload field, as defined in [ESP], looks like this (Figure 1) 💅

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                     Initialization Vector                     |
      |                            (8 octets)                         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      ~                  Encrypted Payload (variable)                 ~
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      ~                 Authentication Data (variable)                ~
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                Figure 1.  ESP Payload Encrypted with AES CCM

3.1. Initialization Vector (IV) 🌸

the AES CCM IV field MUST be eight octets. the IV MUST be chosen by the encryptor in a way that guarantees the same IV value is used only once for a given key. the encryptor can make the IV in any way that ensures uniqueness. common approaches include incrementing a counter for each packet and linear feedback shift registers (LFSRs) 💖

including the IV in each packet means the decryptor can generate the key stream it needs for decryption, even when some datagrams are lost or reordered 🦋

3.2. Encrypted Payload 🧚

the encrypted payload contains the ciphertext 💜

AES CCM mode doesn't require plaintext padding. however, ESP does require padding to 32-bit word-align the authentication data. the Padding, Pad Length, and Next Header fields MUST be concatenated with the plaintext before encryption is performed, as described in [ESP]. when padding is required, it MUST be generated and checked according to the conventions specified in [ESP] ✨

3.3. Authentication Data 🔥

AES CCM provides an encrypted ICV. the ICV that CCM provides is carried in the Authentication Data fields without any further encryption. implementations MUST support ICV sizes of 8 octets and 16 octets. implementations MAY also support an ICV of 12 octets 👑

4. Nonce Format 🌈

each packet carries the IV that's needed to build the sequence of counter blocks that counter mode uses to generate the key stream. the AES counter block is 16 octets. one octet is used for the CCM Flags, and 4 octets are used for the block counter, as specified by the CCM L parameter. the remaining octets are the nonce, which occupy the second through twelfth octets in the counter block. the nonce format is shown in Figure 2 🦋

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
                      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                      |                  Salt                         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                     Initialization Vector                     |
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                           Figure 2.  Nonce Format

the components of the nonce are:

Salt: the salt field is 24 bits. as the name suggests, it holds an unpredictable value. it MUST be assigned at the beginning of the security association. the salt value doesn't need to be secret, but it MUST NOT be predictable prior to the beginning of the security association 🧂
Initialization Vector: the IV field is 64 bits. as described in Section 3.1, the IV MUST be chosen by the encryptor in a way that guarantees the same IV value is used only once for a given key 💫

this construction lets each packet consist of up to:

      2^32 blocks  =  4,294,967,296 blocks
                   = 68,719,476,736 octets

and honestly, this construction gives each packet more key stream than is needed to handle any IPv6 Jumbogram [JUMBO] 🎀 that's the whole vibe, bestie 💅✨

5. AAD Construction 🎀

okay so AAD is the part where we make sure the SPI and the (Extended) Sequence Number get integrity and origin authentication 🔐, but they stay unencrypted 👀. no hiding them, just locking them so nobody can mess with them 💅. there are two formats: one for 32-bit sequence numbers (Figure 3) and one for 64-bit extended sequence numbers (Figure 4) ✨.

Sequence Numbers go in canonical network byte order 🌸. Extended Sequence Numbers also go in canonical network byte order, but the high-order 32 bits come first and the low-order 32 bits come second 🧚. If you want the full scoop on canonical network byte order, check out RFC 791, Appendix B 📖.

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                               SPI                             |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                     32-bit Sequence Number                    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 3. AAD Format with 32-bit Sequence Number 🦋

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                               SPI                             |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                 64-bit Extended Sequence Number               |
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 4. AAD Format with 64-bit Extended Sequence Number 🌈

6. Packet Expansion 📦

the IV and the ICV are the ONLY things that cause packet expansion 🙌. the IV always adds 8 octets to the front of the payload 💜. the ICV goes at the end of the payload, and the CCM parameter M decides how big it is 🍓. implementations MUST support M values of 8 octets and 16 octets 🫶, and implementations MAY also support an M value of 12 octets ✨.

7. IKE Conventions 🗝️

this section is all about the conventions for making keying material and salt values for AES CCM with the Internet Key Exchange (IKE) [IKE] protocol 🔑. it also defines the identifiers and attributes you need to negotiate an SA that uses AES CCM 🧚‍♀️.

7.1. Keying Material and Salt Values 🧂

as we said before, implementations MUST use fresh keys with AES CCM 🚫🔁. IKE can be used to establish fresh keys ✨. this part explains how to get the unpredictable salt value for the nonce from IKE 🎲. quick note: this convention gives you a salt that is secret AND unpredictable 🤫💖.

IKE uses a pseudo-random function (PRF) to derive keying material 🎀. the PRF gets used over and over to derive keying material of any size, called KEYMAT 🔁. the keying material gets pulled out of the output string without caring about boundaries 🍰.

the size of KEYMAT MUST be three octets longer than the associated AES key needs 🫶. here's how the keying material gets used:

AES CCM with a 128-bit key 🌸
- The KEYMAT requested for each AES CCM key is 19 octets. The first 16 octets are the 128-bit AES key, and the remaining three octets are used as the salt value in the counter block.
AES CCM with a 192-bit key 🌷
- The KEYMAT requested for each AES CCM key is 27 octets. The first 24 octets are the 192-bit AES key, and the remaining three octets are used as the salt value in the counter block.
AES CCM with a 256-bit key 👑
- The KEYMAT requested for each AES CCM key is 35 octets. The first 32 octets are the 256-bit AES key, and the remaining three octets are used as the salt value in the counter block.

7.2. Phase 1 Identifier 🙅‍♀️

this doc does NOT spell out how to use AES CCM for IKE Phase 1 negotiations 🙈. if you want AES CCM in Phase 1, you'd need a separate spec, and an Encryption Algorithm Identifier would need to be assigned 📝.

7.3. Phase 2 Identifier 🎟️

for IKE Phase 2 negotiations, IANA has assigned three ESP Transform Identifiers for AES CCM with an explicit IV 💅:

14 for AES CCM with an 8-octet ICV;
15 for AES CCM with a 12-octet ICV; and
16 for AES CCM with a 16-octet ICV.

7.4. Key Length Attribute 📏

AES comes in three key lengths, so the Key Length attribute MUST be specified in the IKE Phase 2 exchange [DOI] 🔐. the Key Length attribute MUST have a value of 128, 192, or 256 💯.

8. Test Vectors 🧪

Section 8 of [CCM] has test vectors that help implementers out with AES CCM mode 🫶🌟.

9. Security Considerations 🚨💀

okay, this section is SERIOUS, bestie 😭. AES CCM uses counter (CTR) mode for confidentiality 🔐. if a counter value is EVER used for more than one packet with the same key, the same key stream gets used to encrypt both packets, and the confidentiality guarantees are gone 💔💀.

what happens if the encryptor XORs the same key stream with two different packet plaintexts? 👀 say two packets are made of plaintext byte sequences P1, P2, P3 and Q1, Q2, Q3. both get encrypted with key stream K1, K2, K3. the two ciphertexts are:

(P1 XOR K1), (P2 XOR K2), (P3 XOR K3)

(Q1 XOR K1), (Q2 XOR K2), (Q3 XOR K3)

if an attacker gets BOTH of these ciphertext streams, confidentiality is totally wrecked 💥😱, because:

(P1 XOR K1) XOR (Q1 XOR K1) = P1 XOR Q1
(P2 XOR K2) XOR (Q2 XOR K2) = P2 XOR Q2
(P3 XOR K3) XOR (Q3 XOR K3) = P3 XOR Q3

once the attacker has the two plaintexts XORed together, it's pretty straightforward to pull them apart 🧩. so using ANY stream cipher, AES CTR included, to encrypt two plaintexts under the same key stream leaks the plaintext 🫠.

so AES CCM should not be used with statically configured keys 🙅‍♀️. you'd need extraordinary measures to stop a counter block value from being reused with the static key across power cycles 🥴. to be safe, implementations MUST use fresh keys with AES CCM 🔑✨. the IKE [IKE] protocol can be used to establish fresh keys 🫶.

when IKE sets up fresh keys between two peer entities, separate keys get established for the two traffic flows 🌊. but if a different mechanism is used to establish fresh keys, one that establishes only a single key to encrypt packets, then there's a HIGH probability that the peers will pick the same IV values for some packets 😬🚩. so, to avoid counter block collisions, ESP implementations that let the same key be used for encrypting and decrypting packets with the same peer MUST make sure the two peers assign different salt values to the security association (SA) 🧂💅.

no matter the mode, AES with a 128-bit key is vulnerable to the birthday attack after 2^64 blocks are encrypted with a single key 🎂💀. ESP with Extended Sequence Numbers allows for up to 2^64 packets in a single SA, so there's real potential for more than 2^64 blocks to be encrypted with one key 😰. implementations SHOULD generate a fresh key before 2^64 blocks are encrypted with the same key, or implementations SHOULD make use of the longer AES key sizes 🔄🗝️. note that ESP with 32-bit Sequence Numbers will NOT exceed 2^64 blocks, even if every packet is a maximum-length Jumbograms 🧃✨.

10. Design Rationale 🧠✨

okay this is the "why" section 🤓. when they were building this spec, people considered using the ESP sequence number field INSTEAD of an explicit IV field 🤔. this section explains why the explicit IV won 🏆. it's not a cryptographic security issue, because either approach prevents counter block collisions 🙌.

using the explicit IV doesn't decide how the encryptor assigns the per-packet value in the counter block 💅. that's a good thing, for a few reasons:

Only the encryptor can make sure the value isn't used for more than one packet, so there's no point picking a mechanism that lets the decryptor figure out whether counter block values collide. the damage from a collision is done whether the decryptor notices it or not 😤.
Explicit IVs let you use adders, LFSRs, or any other technique that fits the encryptor's time budget, as long as the technique gives a unique value for each packet 🌀. adders are simple to implement, but because of carries, they don't run in constant time 🐢. LFSRs are an alternative that DOES run in constant time ⚡.
Complexity is in the implementer's hands 🎀. also, what the encryptor's implementer decides doesn't make the decryptor more (or less) complex 🙅‍♀️.
The per-packet counter block value assignment needs to live inside the assurance boundary 🏰. some implementations assign the sequence number inside that boundary, but others don't 🤷‍♀️. a sequence number collision doesn't have dire consequences, but, as described in Section 6, a collision in counter block values has DISASTROUS consequences 💀🔥.
Using the sequence number as the IV is possible in architectures where sequence number assignment happens within the assurance boundary 🧚. in that case, the sequence number and the IV field contain the same value 👯.
By decoupling the IV and the sequence number, architectures where sequence number assignment happens outside the assurance boundary are accommodated 🌈.

the explicit IV field comes straight from decoupling the sequence number and the per-packet counter block value 🫶. the extra overhead (64 bits for the IV field) is totally acceptable 💖. and honestly, that overhead is way less than Cipher Block Chaining (CBC) mode 🙌. with CBC, you normally need a full block for the IV and, on average, half a block for padding 😩. AES CCM confidentiality processing with an explicit IV has about ONE-THIRD of the overhead of AES CBC, and the overhead is constant for each packet 👑✨.

11. IANA Considerations 📋

IANA has assigned three ESP transform numbers for use with AES CCM with an explicit IV 🎟️:

14 for AES CCM with an 8-octet ICV;
15 for AES CCM with a 12-octet ICV; and
16 for AES CCM with a 16-octet ICV.

12. Acknowledgements 💌

Doug Whiting and Niels Ferguson worked with the author to develop CCM mode 🫶. they developed it as part of the IEEE 802.11i security effort 📡. one of the most attractive things about CCM mode is that it's unencumbered by patents 🕊️💅. the author acknowledges the companies that supported the development of an unencumbered authenticated encryption mode (in alphabetical order) 🌸:

Hifn
Intersil
MacFergus
RSA Security

and also, a big thank you to Tero Kivinen for his comprehensive review of this document 🥰💖.

13. References 📚

This section provides normative and informative references 🧾✨.

13.1. Normative References 📚

Okay, bestie, these are the must-read docs the spec leans on so hard it can't function without them 🫶

[AES]       NIST, FIPS PUB 197, "Advanced Encryption Standard (AES),"
            November 2001.

[DOI]       Piper, D., "The Internet IP Security Domain of
            Interpretation for ISAKMP", RFC 2407, November 1998.

[ESP]       Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
            4303, December 2005.

[CCM]       Whiting, D., Housley, R., and N. Ferguson, "Counter with
            CBC-MAC (CCM)", RFC 3610, September 2003.

[STDWORDS]  Bradner, S., "Key words for use in RFCs to Indicate
            Requirement Levels", BCP 14, RFC 2119, March 1997.

13.2. Informative References 🌸

These ones are the extra reading. Super helpful for context, not required to get the main vibe 💅

[ARCH]      Kent, S. and K. Seo, "Security Architecture for the
            Internet Protocol", RFC 4301, December 2005.

[IKE]       Harkins, D. and D. Carrel, "The Internet Key Exchange
            (IKE)", RFC 2409, November 1998.

[IKEv2]     Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
            RFC 4306, December 2005.

[ROAD]      Thayer, R., Doraswamy, N., and R. Glenn, "IP Security
            Document Roadmap", RFC 2411, November 1998.

[JUMBO]     Borman, D., Deering, S., and R. Hinden, "IPv6
            Jumbograms", RFC 2675, August 1999.

Author's Address 🎀

This RFC was written by Russell Housley at Vigil Security, LLC. Here's where to find him 💖

Russell Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA 20170
USA

EMail: housley@vigilsec.com

Full Copyright Statement ⭐

The Internet Society owns the copyright here, from 2005. Lowkey the legal stuff, but it matters 🫶

This document is subject to the rights, licenses and restrictions contained in BCP 78. Except as set forth in BCP 78, the authors keep all their rights 📜

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 😭

Intellectual Property 🦋

The IETF doesn't take a side on whether any patents or other IP rights apply to the tech in this document, or whether you can get a license for them. It also hasn't checked for any such rights itself 🤷‍♀️ For the procedures around RFC rights, look at BCP 78 and BCP 79.

If you want copies of IPR disclosures, or assurances that licenses will be available, those are in the IETF's online IPR repository at http://www.ietf.org/ipr. The same goes if you're trying to get a general license or permission for using the proprietary rights this spec involves.

The IETF also invites anyone to flag copyrights, patents, patent applications, or other proprietary rights that might cover tech needed to implement this standard. Send that to the IETF at ietf-ipr@ietf.org 🌈

Acknowledgement 💜

The RFC Editor function is currently funded by the Internet Society. Thank you, Internet Society 🧚✨

📦 where this page comes from

ietf: rfc4309 2005-12
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms