Algorithm Implementation Requirements and Usage Guidance for the Internet Key Exchange Protocol Version 2 (IKEv2)

Wouters, Paul; Migault, Daniel; Kivinen, Tero; Nir, Yoav

doi:10.17487/rfc8247

Cited by 4 publications

(12 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The Encapsulating Security Protocol (ESP), the core IPsec security protocol, is specified in [19]. Algorithm implementation and usage guidelines are specified in [20] for IKEv2 and in [21] for IPsec. Various extensions to IKEv2 have their own RFC specifications.…”

Section: The Ipsec Protocolmentioning

confidence: 99%

“…To do so, it can send an informational exchange message (i.e., a probe 1228 message) containing zero payloads. 20 An endpoint receiving such an informational message must respond with an empty informational message. If these probes are not answered for a configured time period, the IKE SA and IPsec SA are terminated.…”

Section: The Informational Exchangementioning

confidence: 99%

“…This is usually referred to as AH+ESP. This combined mode (ESP for encryption and 1855 AH for integrity) is no longer recommended [20], as it provides no advantage over regular ESP 1856 with authentication. Regular ESP with authentication also reduces the MTU compared to 1857 AH+ESP, due to the additional overhead of an AH header plus an ESP header versus just an ESP header with authentication.…”

Section: Authentication Header (Ah)mentioning

confidence: 99%

“…Setting the cryptographic policy for confidentiality and integrity protection and key exchange 2723 involves choosing encryption and integrity protection algorithms, key lengths, 51 DH groups for key exchange, and IKE and ESP lifetimes. For up-to-date policies and advice on these settings, see NIST SP 800-131A [47] and FIPS 140 [13] as well as the recommendations of the IETF for IKE [20] and ESP [59]. Note that these documents will be updated over time or be obsoleted for newer publications.…”

mentioning

confidence: 99%

“…It is uncommon to use 192-bit AES keys, and this key length is optional in [20]. It is worth mentioning as well that in the future, an adversary with a quantum computer may be able to reduce the key strength of an AES key by a factor of two, in which case a 256-bit AES key may effectively provide around 128 bits of security in the quantum computer world (note that this level of security strength is a magnitude stronger than the current level of 128 bits for classical security).…”

mentioning

confidence: 99%

See 4 more Smart Citations

Guide to IPsec VPNs

2019

Preprint

View full text Add to dashboard Cite

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

show abstract

Section: The Ipsec Protocolmentioning

confidence: 99%

Section: The Informational Exchangementioning

confidence: 99%

Section: Authentication Header (Ah)mentioning

confidence: 99%

mentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations

Guide to IPsec VPNs

2019

Preprint

View full text Add to dashboard Cite

show abstract

Speeding Up the Internet of Things: LEAIoT: A Lightweight Encryption Algorithm Toward Low-Latency Communication for the Internet of Things

Habib

Ahmad²,

Jabbar

et al. 2018

IEEE Consumer Electron. Mag.

View full text Add to dashboard Cite

Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd

Vanhoef

Ronen

2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

We systematically analyze WPA3 and EAP-pwd, find denial-ofservice and downgrade attacks, present severe vulnerabilities in all implementations, reveal side-channels that enable offline dictionary attacks, and propose design fixes which are being officially adopted.The WPA3 certification aims to secure home networks, while EAP-pwd is used by certain enterprise Wi-Fi networks to authenticate users. Both use the Dragonfly handshake to provide forward secrecy and resistance to dictionary attacks. In this paper, we systematically evaluate Dragonfly's security. First, we audit implementations, and present timing leaks and authentication bypasses in EAP-pwd and WPA3 daemons. We then study Dragonfly's design and discuss downgrade and denial-of-service attacks. Our next and main results are side-channel attacks against Dragonfly's password encoding method (e.g. hash-to-curve). We believe that these sidechannel leaks are inherent to Dragonfly. For example, after our initial disclosure, patched software was still affected by a novel side-channel leak. We also analyze the complexity of using the leaked information to brute-force the password. For instance, bruteforcing a dictionary of size 10 10 requires less than $1 in Amazon EC2 instances. These results are also of general interest due to ongoing standardization efforts on Dragonfly as a TLS handshake, Password-Authenticated Key Exchanges (PAKEs), and hash-to-curve. Finally, we discuss backwards-compatible defenses, and propose protocol fixes that prevent attacks. Our work resulted in a new draft of the protocols incorporating our proposed design changes.

show abstract

Algorithm Implementation Requirements and Usage Guidance for the Internet Key Exchange Protocol Version 2 (IKEv2)

Abstract: The IPsec series of protocols makes use of various cryptographic algorithms in order to provide security services. The Internet

Cited by 4 publications

References 7 publications

Guide to IPsec VPNs

Guide to IPsec VPNs

Speeding Up the Internet of Things: LEAIoT: A Lightweight Encryption Algorithm Toward Low-Latency Communication for the Internet of Things

Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd

Contact Info

Product

Resources

About