RFC 7321
Cryptographic Algorithm Implementation Requirements and Usage Guidance for Encapsulating Security Payload (ESP) and Authentication Header (AH)
RFC 7321 💖 Cryptographic Algorithm Implementation Requirements and Usage Guidance for Encapsulating Security Payload (ESP) and Authentication Header (AH)
okay bestie, this one is the IETF's crypto shopping list for IPsec ✨ It's an Internet Standards Track doc from August 2014. D. McGrew (Cisco Systems) and P. Hoffman (VPN Consortium) wrote it, and it's listed under ISSN 2070-1721. It obsoletes RFC 4835 🫶 It's giving "we're updating the list because the old one aged badly."
Internet Engineering Task Force (IETF) D. McGrew
Request for Comments: 7321 Cisco Systems
Obsoletes: 4835 P. Hoffman
Category: Standards Track VPN Consortium
ISSN: 2070-1721 August 2014Abstract ✨
okay so this doc updates the Cryptographic Algorithm Implementation Requirements for ESP and AH 💅 It also adds usage guidance so you can pick these algorithms without vibes-only decision making 🔥
ESP and AH use a bunch of cryptographic algorithms to give confidentiality and/or data origin authentication to protected data in the IP Security (IPsec) architecture 🦋 For different implementations to actually talk to each other, the IPsec standard names a set of mandatory-to-implement algorithms. This document lists the current set for ESP and AH, names algorithms that should be implemented because they might get promoted to mandatory later 👀, and recommends against implementing some obsolete ones 💀 There's also usage guidance to help people using ESP and AH reach their security goals by choosing algorithms well 🌸
This document obsoletes RFC 4835.
Status of This Memo ✨
this is an Internet Standards Track document 🎀
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community 🫶 It got public review and was approved for publication by the Internet Engineering Steering Group (IESG) 💅 If you want more info on Internet Standards, check Section 2 of RFC 5741 🧚
For the current status, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc7321 🌈
Copyright Notice 💜
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. 🔒
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, since they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 🍓
This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English. 🙈
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2. Implementation Requirements . . . . . . . . . . . . . . . . . 4
2.1. ESP Authenticated Encryption (Combined Mode Algorithms) . 4
2.2. ESP Encryption Algorithms . . . . . . . . . . . . . . . . 4
2.3. ESP Authentication Algorithms . . . . . . . . . . . . . . 5
2.4. AH Authentication Algorithms . . . . . . . . . . . . . . 5
2.5. Summary of Changes from RFC 4835 . . . . . . . . . . . . 5
3. Usage Guidance . . . . . . . . . . . . . . . . . . . . . . . 5
4. Rationale . . . . . . . . . . . . . . . . . . . . . . . . . . 6
4.1. Authenticated Encryption . . . . . . . . . . . . . . . . 7
4.2. Encryption Transforms . . . . . . . . . . . . . . . . . . 7
4.3. Authentication Transforms . . . . . . . . . . . . . . . . 7
5. Algorithm Diversity . . . . . . . . . . . . . . . . . . . . . 8
6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 9
7. Security Considerations . . . . . . . . . . . . . . . . . . . 9
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
8.1. Normative References . . . . . . . . . . . . . . . . . . 9
8.2. Informative References . . . . . . . . . . . . . . . . . 101. Introduction ✨
okay so ESP [RFC4303] and AH [RFC4302] are the mechanisms for putting cryptographic protection on data sent over an IPsec Security Association (SA) [RFC4301] 🦋
For different implementations to interoperate, you need a set of mandatory-to-implement algorithms 🫶 That way there's at least one algorithm everyone has in common. This document lists the current set of mandatory-to-implement algorithms for ESP and AH, names algorithms that should be implemented because they may be promoted to mandatory someday, and recommends against some obsolete ones 💀 It also gives usage guidance so ESP and AH users can hit their security goals with smart mechanism choices 💅
Crypto is a constant plot twist 😭 New algorithms keep showing up and existing ones keep getting attacked. An algorithm that's strong today might be shown to be weak tomorrow. So the choice of mandatory-to-implement algorithm should be conservative, to lower the odds of it getting compromised quickly 🔒 Performance matters too, since lots of IPsec uses happen in environments where performance is a concern ⭐
The ESP and AH mandatory-to-implement algorithms may need to change over time as crypto develops 🌈 That's why the list isn't in the main IPsec, ESP, or AH specs. It lives in this document instead 🧚 Ideally, tomorrow's mandatory algorithm should already be in most IPsec implementations by the time it becomes mandatory. To help with that, this document flags the algorithms we know about today. There's no guarantee that the algorithms we predict will be mandatory will actually be mandatory 🙈 And every algorithm known today is subject to cryptographic attack and might get broken later, so stay alert bestie 💀
1.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 📖
We also define a couple of extra keywords here 🎀
MUST- This term means the same as MUST. However, we expect that at some point in the future this algorithm will no longer be a MUST. 🥀
SHOULD+ This term means the same as SHOULD. However, it is likely that an algorithm marked as SHOULD+ will be promoted at some future time to be a MUST. 🚀
2. Implementation Requirements 💅
this section lists the cryptographic algorithms that MUST be implemented, and gives guidance about the ones that SHOULD or SHOULD NOT be implemented 🔥
In the sections that follow, all AES modes are for 128-bit AES. 192-bit and 256-bit AES MAY be supported for those modes, but the requirements here are for 128-bit AES. 🦋
2.1. ESP Authenticated Encryption (Combined Mode Algorithms)
ESP combined mode algorithms give you both confidentiality and authentication. In crypto terms these are authenticated encryption algorithms [RFC5116] 🫶 The authenticated encryption transforms are listed in the ESP encryption transforms IANA registry 🌸
Requirement Authenticated Encryption Algorithm
----------- ----------------------------------
SHOULD+ AES-GCM with a 16 octet ICV [RFC4106]
MAY AES-CCM [RFC4309]2.2. ESP Encryption Algorithms
Requirement Encryption Algorithm
----------- --------------------------
MUST NULL [RFC2410]
MUST AES-CBC [RFC3602]
MAY AES-CTR [RFC3686]
MAY TripleDES-CBC [RFC2451]
MUST NOT DES-CBC [RFC2405]2.3. ESP Authentication Algorithms
Requirement Authentication Algorithm (notes)
----------- -----------------------------
MUST HMAC-SHA1-96 [RFC2404]
SHOULD+ AES-GMAC with AES-128 [RFC4543]
SHOULD AES-XCBC-MAC-96 [RFC3566]
MAY NULL [RFC4303]Note that the requirement level for NULL authentication depends on the type of encryption used 👀 When you use authenticated encryption from Section 2.1, the requirement for NULL encryption is the same as the requirement for the authenticated encryption itself. When you use the encryption from Section 2.2, the requirement for NULL encryption is truly "MAY"; see Section 3 for more detail. 🧚
2.4. AH Authentication Algorithms
The requirements for AH are the same as for ESP Authentication Algorithms, except that NULL authentication is inapplicable. 💖
2.5. Summary of Changes from RFC 4835
okay here's the tea ☕ This is a summary of the changes from RFC 4835 👑
Old New
Requirement Requirement Algorithm (notes)
---- ----------- -----------------
MAY SHOULD+ AES-GCM with a 16 octet ICV [RFC4106]
MAY SHOULD+ AES-GMAC with AES-128 [RFC4543]
MUST- MAY TripleDES-CBC [RFC2451]
SHOULD NOT MUST NOT DES-CBC [RFC2405]
SHOULD+ SHOULD AES-XCBC-MAC-96 [RFC3566]
SHOULD MAY AES-CTR [RFC3686]3. Usage Guidance ✨
okay so ESP and AH can be used like, a bunch of different ways, so this section is basically your guide to the best way to use them 🎀. ESP can do confidentiality, data origin authentication, or both together. AH only does data origin authentication. (We're gonna shorten "data origin authentication" to "authentication" from here on, bestie 💅). If you want the background on those security services, it's in [RFC4949].
Providing both confidentiality and authentication is literally the best security 🔥. If you don't need confidentiality, authentication is still super useful. Confidentiality without authentication is not effective [DP07], so it SHOULD NOT be used 🙅. We'll go through each case in more detail below.
To get both, an authenticated encryption transform from Section 2.1 SHOULD be used in ESP, together with NULL authentication. You can also use an ESP encryption transform and an ESP authentication transform together, and that MAY be used too ✨. It is NOT RECOMMENDED to use ESP with NULL authentication alongside AH, because some configurations of that combo have been shown to be insecure [PD10] 💀.
To get authentication without confidentiality, an authentication transform MUST be used in either ESP or AH. The IPsec community generally prefers ESP with NULL encryption over AH. AH is still required in some protocols and operational environments when there are security-sensitive options in the IP header, like source routing headers, because ESP inherently can't protect those IP options 🧐. Effective confidentiality without authentication isn't possible, since the lack of authentication undermines how trustworthy the encryption is [B96][V02]. So an encryption transform MUST NOT be used with a NULL authentication transform (unless the encryption transform is an authenticated encryption transform from Section 2.1) 🚫.
Triple-DES SHOULD NOT be used in any scenario where multiple gigabytes of data get encrypted with a single key. It's a 64-bit block cipher, so it leaks info about plaintexts above that "birthday bound" [M13] 😭. Triple-DES CBC is listed as a MAY implement for backwards compatibility, but its use is discouraged 🥀.
4. Rationale 🧠
This section explains the principles behind the implementation requirements from earlier. Let's get into it!
Algorithms listed as "MAY implement" are not meant to be endorsed over other non-standard alternatives 💅. All of the algorithms that showed up in [RFC4835] are included here, for the sake of continuity 🫶. Some of them moved from "SHOULD implement" to "MAY implement", so don't be shocked 🙈.
4.1. Authenticated Encryption
This document encourages authenticated encryption algorithms because they bring big efficiency and throughput advantages. The tight binding between authentication and encryption can also be a security advantage [RFC5116] 🔐.
AES-GCM [RFC4106] brings significant performance benefits [KKGEGD] and has been incorporated into IPsec recommendations [RFC6379]. It has basically emerged as the preferred authenticated encryption method in IPsec and other standards, and it's giving main character energy 👑✨.
4.2. Encryption Transforms
Since ESP encryption is optional, support for the "NULL" algorithm is required so things stay consistent with the way services get negotiated 🤝. Note that while authentication and encryption can each be "NULL", they MUST NOT both be "NULL" [RFC4301] [H10] 🚫.
AES Counter Mode (AES-CTR) is efficient, but it provides no authentication capability 🙃. The AES-GCM authenticated encryption method has all the advantages of AES-CTR and also gives you authentication, so this document moves AES-CTR from a SHOULD to a MAY 🦋.
Triple DES (TDES) is obsolete because of its small block size. Like all 64-bit block ciphers, it SHOULD NOT be used to encrypt more than one gigabyte of data with a single key [M13] 😬. Its key size is smaller than that of the Advanced Encryption Standard (AES), while its performance and efficiency are worse too. So its use in new implementations is discouraged 🥀.
The Data Encryption Standard (DES) is obsolete because of its small key size and small block size 💀. There's been publicly demonstrated, open-design, special-purpose cracking hardware, so its use has been changed to MUST NOT in this document 🚫🔥.
4.3. Authentication Transforms
AES-GMAC gives good security along with performance advantages, even over HMAC-MD5 🏎️. It also uses the same internal components as AES-GCM, so it's easy to implement in a way that shares components with that authenticated encryption algorithm 🧩.
The MD5 hash function has been found to not meet its goal of collision resistance. It's so weak that its use in digital signatures is highly discouraged [RFC6151] 😭. There have been theoretical results against HMAC-MD5, but that message authentication code doesn't seem to have a practical vulnerability. So it may not be urgent to remove HMAC-MD5 from the existing protocols 🤷♀️.
SHA-1 has been found to not meet its goal of collision resistance. However, HMAC-SHA-1 doesn't rely on that property, and HMAC-SHA-1 is believed to be secure 🫶.
HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 are believed to provide a good security margin, and they perform adequately on many platforms 💜. However, these algorithms are not recommended for implementation in this document. That's because HMAC-SHA-1 support is widespread and its security is good, AES-GMAC provides good security with better performance, and Authenticated Encryption algorithms don't need any authentication methods ✨.
AES-XCBC hasn't seen widespread deployment, even though it was previously recommended as a SHOULD+ in RFC 4835. So this document lists it only as a SHOULD 🌸.
5. Algorithm Diversity 🌈
When the AES cipher was first adopted, the decision was made to keep encouraging the implementation of Triple-DES, in order to provide algorithm diversity. But the passage of time has eroded Triple-DES's viability as an alternative to AES 🕰️. As a 64-bit block cipher, its security is inadequate at high data rates (see Section 4.2). Its performance in software and Field-Programmable Gate Arrays (FPGAs) is considerably worse than AES's 📉.
Since it wouldn't be possible to use Triple-DES as an alternative to AES in high data rate environments, or in environments where its performance couldn't keep up with the requirements, the rationale for retaining Triple-DES for algorithm diversity is disappearing 😔. (Of course, this doesn't change the rationale for retaining Triple-DES in IPsec implementations for backwards compatibility 🫶.)
Recent discussions in the IETF have started looking at how to select a different cipher that could provide algorithm diversity in IPsec and other IETF standards. That work is expected to take a long time and involve discussions among many participants and organizations 🐢.
It's very unlikely that an exploitable flaw will be found in AES (for example, a flaw that required less than a terabyte of known plaintext, when AES is used in a conventional mode of operation) 🛡️. The only reason algorithm diversity deserves any consideration is that there would be large problems if such a flaw were ever found 🙀.
6. Acknowledgements 🫶
Some of the wording here was adapted from [RFC4835], the document that this one obsoletes 💖. That RFC itself borrows from earlier RFCs, notably RFC 4305 and 4307. RFC 4835, RFC 4305, and RFC 4307 were authored by Vishwas Manral, Donald Eastlake, and Jeffrey Schiller respectively 📝.
Big thanks to Wajdi Feghali, Brian Weis, Cheryl Madson, Dan Harkins, Paul Wouters, Ran Atkinson, Scott Fluhrer, Tero Kivinen, and Valery Smyslov for their insightful feedback on this document 🥰.
7. Security Considerations 💀
The security of a system that uses cryptography depends on both the strength of the cryptographic algorithms chosen and the strength of the keys used with those algorithms. ⚠️ It also depends on the engineering and administration of the protocol used by the system, to make sure there are no non-cryptographic ways to bypass the security of the overall system. Don't skip this part, bestie 😤.
This document is all about the selection of cryptographic algorithms for the use of ESP and AH, specifically the selection of mandatory-to-implement algorithms 🔑. The algorithms identified in this document as "MUST implement" or "SHOULD implement" are not known to be broken at the current time. Cryptographic research to date leads us to believe they will likely remain secure into the foreseeable future 🔒. However, this is not necessarily forever ⏳. Therefore, we expect that revisions of that document will be issued from time to time to reflect the current best practice in this area 📆.
8. References 📚
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the
Internet Protocol", RFC 4301, December 2005.
[RFC4302] Kent, S., "IP Authentication Header", RFC 4302, December
2005.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
4303, December 2005.8.2. Informative References 📚
okay bestie, this is the reading list 🧚 these are the background papers and older RFCs the spec points to. they're informative, so they don't set any rules, but they're the receipts for why things are the way they are 💅
- [B96] Bellovin, S., "Problem areas for the IP security protocols", Proceedings of the Sixth Usenix Unix Security Symposium, 1996.
- [DP07] Degabriele, J. and K. Paterson, "Attacking the IPsec Standards in Encryption-only Configurations", IEEE Symposium on Privacy and Security, 2007. 😭
- [H10] Hoban, A., "Using Intel AES New Instructions and PCLMULQDQ to Significantly Improve IPSec Performance on Linux", Intel White Paper, August 2010. ⚡
- [KKGEGD] Kounavis, M., Kang, X., Grewal, K., Eszenyi, M., Gueron, S., and D. Durham, "Encrypting the Internet", SIGCOMM, 2010. 🌐
- [M13] McGrew, D., "Impossible plaintext cryptanalysis and probable-plaintext collision attacks of 64-bit block cipher modes", IACR ePrint, 2012. 🔍
- [PD10] Paterson, K. and J. Degabriele, "On the (in)security of IPsec in MAC-then-encrypt configurations", CCS '10, ACM Conference on Computer and Communications Security, 2010. 🔐
- [RFC2404] Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96 within ESP and AH", RFC 2404, November 1998. 🎀
- [RFC2405] Madson, C. and N. Doraswamy, "The ESP DES-CBC Cipher Algorithm With Explicit IV", RFC 2405, November 1998. 🌸
- [RFC2410] Glenn, R. and S. Kent, "The NULL Encryption Algorithm and Its Use With IPsec", RFC 2410, November 1998. 🫥
- [RFC2451] Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher Algorithms", RFC 2451, November 1998. 🦋
- [RFC3566] Frankel, S. and H. Herbert, "The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec", RFC 3566, September 2003. ✨
- [RFC3602] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC Cipher Algorithm and Its Use with IPsec", RFC 3602, September 2003. 💜
- [RFC3686] Housley, R., "Using Advanced Encryption Standard (AES) Counter Mode With IPsec Encapsulating Security Payload (ESP)", RFC 3686, January 2004. 🍓
- [RFC4106] Viega, J. and D. McGrew, "The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)", RFC 4106, June 2005. 🌈
- [RFC4309] Housley, R., "Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)", RFC 4309, December 2005. 👑
- [RFC4543] McGrew, D. and J. Viega, "The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH", RFC 4543, May 2006. 🫶
- [RFC4835] Manral, V., "Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)", RFC 4835, April 2007. 📝
- [RFC4949] Shirey, R., "Internet Security Glossary, Version 2", RFC 4949, August 2007. 📖
- [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated Encryption", RFC 5116, January 2008. 🔥
- [RFC6151] Turner, S. and L. Chen, "Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms", RFC 6151, March 2011. 🙈
- [RFC6379] Law, L. and J. Solinas, "Suite B Cryptographic Suites for IPsec", RFC 6379, October 2011. ⭐
- [V02] Vaudenay, S., "Security Flaws Induced by CBC Padding - Applications to SSL, IPSEC, WTLS ...", EUROCRYPT, 2002. 💀
Authors' Addresses ✨
the people who wrote this, bestie 🎀 you can email them if you have questions 💌
- David McGrew, Cisco Systems, EMail: mcgrew@cisco.com
- Paul Hoffman, VPN Consortium, EMail: paul.hoffman@vpnc.org
that's the whole spec, babe! 🌈👑💖
📦 where this page comes from
- ietf: rfc7321 2014-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms