RFC 4312

The Camellia Cipher Algorithm and Its Use With IPsec

📅 published December 2005, from ietf

RFC 4312: The Camellia Cipher Algorithm and Its Use With IPsec 🎀✨

okay bestie, this is the RFC that explains how to use the Camellia block cipher inside IPsec ESP 🔐💖 it was published in December 2005 as a Standards Track doc. The authors are A. Kato (NTT Software Corporation), S. Moriai (Sony Computer Entertainment Inc.), and M. Kanda (Nippon Telegraph and Telephone Corporation). It's RFC 4312 🦋 The header doesn't list anything it obsoletes or updates, so it's a standalone spec, no cap.

Status of This Memo 📋

this doc is an Internet standards track protocol for the Internet community, and it wants your feedback and ideas for making it better 💬 for where the protocol stands, check the current "Internet Official Protocol Standards" (STD 1) list. And distribution is unlimited, so share away 🌸

Copyright Notice ©️

Abstract 🍓

so the big idea: this doc says how to use the Camellia block cipher in Cipher Block Chaining mode with an explicit Initialization Vector, as the confidentiality piece inside the IPsec Encapsulating Security Payload (ESP) 🔒✨ that's the whole vibe.

1. Introduction 🧚

okay so this section is the setup 💅 Camellia is a block cipher that the EU NESSIE project [NESSIE] picked as a recommended cryptographic primitive, and Japan's CRYPTREC [CRYPTREC] put it on the list of techniques for Japanese e-Government systems 👑 it's also been submitted to other standards bodies, like ISO (ISO/IEC 18033) and the IETF S/MIME Mail Security Working Group [Camellia-CMS]. iconic behavior honestly 😭

Camellia handles a 128-bit block size and key lengths of 128, 192, and 256 bits. that's the same interface as AES [AES] 🫶

it's a symmetric cipher with a Feistel structure 🧩 NTT and Mitsubishi Electric Corporation developed it together in 2000. it was built to hold up against all the known cryptanalytic attacks, and worldwide crypto experts have been poking at it for ages. it's great for software and hardware, and its speed is comparable to AES 🔥

the Camellia homepage [Camellia-Web] has everything: the detailed spec, security analysis, performance figures, reference implementations, test vectors, and IP info. main character resource, no cap 💖

the rest of this doc is about using Camellia inside IPsec ESP. if you want the bigger picture of how the ESP pieces work together for security, go check [ARCH], [ESP], and [ROAD] 🦋

1.1. Specification of Requirements 📜

the keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are meant to be read the way [RFC-2119] describes them 🙈 these are the words that tell you how strict a rule is, so pay attention!!

2. The Camellia Cipher Algorithm 🌈

all symmetric block ciphers share some common stuff: the mode, key size, weak keys, block size, and rounds. this section goes through the parts of Camellia that matter for all that 💅

the algorithm spec and object identifiers live in [Camellia-Desc] 💜

2.1. Mode 🔁

NIST defined five modes of operation for AES and other FIPS-approved ciphers [SP800-38a]: CBC (Cipher Block Chaining), ECB (Electronic CodeBook), CFB (Cipher FeedBack), OFB (Output FeedBack), and CTR (Counter) 📚 CBC is well understood for symmetric ciphers, and it's currently required for all the other ESP ciphers. this doc uses Camellia in CBC mode inside ESP. the mode needs an Initialization Vector (IV) that's the same size as the block size. using a randomly generated IV stops identical packets from producing identical cipher text across that first block of the cipher's block size. wild how much that matters 😭

the CBC IV gets XOR'd with the first plaintext block before encryption. then for each successive block, the previous cipher text block gets XOR'd with the current plain text before it's encrypted 🧠 more on CBC lives in [SP800-38a, CRYPTO-S].

2.2. Key Size 🔑

Camellia has three key sizes: 128 bits, 192 bits, and 256 bits. the default is 128 bits, and all implementations MUST support this key size. implementations MAY also support 192-bit and 256-bit keys 💖

Camellia uses a different number of rounds for each key size. with a 128-bit key, implementations MUST use 18 rounds. with a 192-bit key, implementations MUST use 24 rounds. with a 256-bit key, implementations MUST use 24 rounds. the rounds are not optional, bestie 💀

2.3. Weak Keys ⚠️

at the time of writing, there are no known weak keys for Camellia. no weak-key drama, periodt 💅

2.4. Block Size and Padding 🧱

Camellia has a block size of sixteen octets (128 bits) 🎀

padding is required by the algorithms to keep that 16-octet (128-bit) block size. padding MUST be added, as specified in [ESP], so that the data being encrypted (which includes the ESP Pad Length and Next Header fields) is a multiple of 16 octets. no extra padding is needed for the ciphertext to end on a 4-octet boundary, because keeping the 16-octet block size already makes sure the ESP Pad Length and Next Header fields are right-aligned within a 4-octet word. so cute how it all lines up ✨ additional padding MAY be included, as specified in [ESP], as long as the 16-octet block size is maintained.

2.5. Performance 🏎️

Performance figures for Camellia are over at [Camellia-Web]. that site also compares it with AES and the other AES finalists. the NESSIE project [NESSIE] independently reported the performance of Optimized Implementations too 📊

3. ESP Payload 🎁

the ESP payload is the IV followed by the raw cipher-text 🫶 so the payload field, as defined in [ESP], breaks down like this:

   +---------------+---------------+---------------+---------------+
   |                                                               |
   +               Initialization Vector (16 octets)               +
   |                                                               |
   +---------------+---------------+---------------+---------------+
   |                                                               |
   ~ Encrypted Payload (variable length, a multiple of 16 octets)  ~
   |                                                               |
   +---------------------------------------------------------------+

the IV field MUST be the same size as the block size of the cipher algorithm being used. the IV MUST be chosen at random, and it MUST be unpredictable 🎲 this part is non-negotiable, bestie.

putting the IV in every datagram means each datagram you receive can still be decrypted, even when some get dropped or reordered in transit 🦋 that's the kind of resilience I'm obsessed with.

to avoid CBC encrypting very similar plaintext blocks across different packets, implementations MUST NOT use a counter or other low Hamming-distance source for IVs 🙈 do NOT use a counter for IVs, literally ever 💀

3.1. ESP Algorithmic Interactions 🧩

right now there are no known issues with how Camellia interacts with the other parts of ESP, like certain authentication schemes 💜

3.2. Keying Material 🗝️

the minimum number of bits sent from the key exchange protocol to the ESP algorithm must be greater than or equal to the key size. the cipher's encryption and decryption key comes from the first 128, 192, or 256 bits of the keying material 🔐

4. Interaction with Internet Key Exchange [IKE] 🤝

Camellia was designed to follow the same API as AES, so this section only defines the Phase 1 Identifier and the Phase 2 Identifier. anything else about how it interacts with IKE is the same as for AES, and you can find the details in [AES-IPSEC] 💖

4.1. Phase 1 Identifier 🏷️

for Phase 1 negotiations, IANA assigned an Encryption Algorithm ID of 8 for CAMELLIA-CBC 🎀

4.2. Phase 2 Identifier 🏷️

for Phase 2 negotiations, IANA assigned an ESP Transform Identifier of 22 for ESP_CAMELLIA 🦋

5. Security Considerations 🚨

Implementations are encouraged to use the largest key sizes they can, while taking performance into account for their particular hardware and software setup. encryption affects both sides of a secure channel, so that consideration has to cover the server as well as the client, not just the client side 👀 still, a 128-bit key is considered secure for the foreseeable future 🔐

No security problem has been found on Camellia [CRYPTREC][NESSIE] 🙌

6. IANA Considerations 📝

IANA assigned Encryption Algorithm ID = 8 to CAMELLIA-CBC 💜

IANA assigned ESP Transform Identifier = 22 to ESP_CAMELLIA 💜

7. Acknowledgements 🫶

portions of this text were unabashedly borrowed from [AES-IPSEC] 😭 no shame, honestly iconic. and this work was done while the first author was working at NTT 🌸

8. References 📚

8.1. Normative References 💖

   [Camellia-Desc]  Matsui, M., Nakajima, J., and S. Moriai, "A
                    Description of the Camellia Encryption Algorithm",
                    RFC 3713, April 2004.

   [ESP]            Kent, S., "IP Encapsulating Security Payload (ESP)",
                    RFC 4303, December 2005.

8.2. Informative References 📚

Okay bestie, these are the extra reads that back up the spec, like the bibliography at the end of a really good essay 💅

[AES] NIST, FIPS PUB 197, "Advanced Encryption Standard (AES)," November 2001. http://csrc.nist.gov/publications/fips/fips197/fips-197.{ps,pdf}.

[AES-IPSEC] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC Cipher Algorithm and Its Use With IPsec," RFC 3602, September 2003.

[ARCH] Kent, S. and R. Atkinson, "Security Architecture for the Internet Protocol", RFC 2401, November 1998.

[Camellia-CMS] Moriai, S. and A. Kato, "Use of the Camellia Encryption Algorithm in Cryptographic Message Syntax (CMS)", RFC 3657, January 2004.

[Camellia-Web] Camellia web site: http://info.isl.ntt.co.jp/camellia/.

[CRYPTO-S] Schneier, B., "Applied Cryptography Second Edition", John Wiley & Sons, New York, NY, 1995, ISBN 0-471-12845-7.

[CRYPTREC] Information-technology Promotion Agency (IPA), Japan, CRYPTREC. http://www.ipa.go.jp/security/enc/CRYPTREC/ index-e.html.

[IKE] Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.

[SP800-38a] Dworkin, M., "Recommendation for Block Cipher Modes of Operation - Methods and Techniques", NIST Special Publication 800-38A, December 2001.

[NESSIE] The NESSIE project (New European Schemes for Signatures, Integrity and Encryption), http://www.cosic.esat.kuleuven.ac.be/nessie/.

[ROAD] Thayer, R., Doraswamy, N., and R. Glenn, "IP Security Document Roadmap", RFC 2411, November 1998.

[RFC-2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

Authors' Addresses 💌

Akihiro Kato

Akihiro Kato
NTT Software Corporation

Phone: +81-45-212-7934
Fax:   +81-45-212-7410
EMail: akato@po.ntts.co.jp

Shiho Moriai

Shiho Moriai
Sony Computer Entertainment Inc.

Phone: +81-3-6438-7523
Fax:   +81-3-6438-8629
EMail: camellia@isl.ntt.co.jp (Camellia team)
       shiho@rd.scei.sony.co.jp (Shiho Moriai)

Masayuki Kanda

Masayuki Kanda
Nippon Telegraph and Telephone Corporation

Phone: +81-46-859-2437
Fax:   +81-46-859-3365
EMail: kanda@isl.ntt.co.jp

Full Copyright Statement 🌈

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. ✨

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🔐

The IETF takes no position on whether any Intellectual Property Rights or other rights that someone might claim over the technology in this document are valid or in scope, or on whether any license under those rights might be available. It also doesn't say it has made any independent effort to find such rights. 🫣 If you want the details on how rights work for RFC documents, check out BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, and the results of any attempt to get a general license or permission for implementers or users of this specification to use the proprietary rights can all be found in the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF also invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org. 💜

Acknowledgement 🫶

Funding for the RFC Editor function is currently provided by the Internet Society. 🎀

📦 where this page comes from

ietf: rfc4312 2005-12
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms