Subject: [IPsec] [IKE] Mode config IV calculations

From: Matthew Cini Sarreo <[email-masked]>
Date: Fri, 2 Jul 2010 16:36:30 +0200

Hello all,

Recently I looked into the IKE Config Mode drafts and ran into an ambiguity
problem.

Config Mode (draft 05) section 3.1.1 states:

The derivation of the initialization vector (IV) for the first message, used
with SKEYID_e to encrypt the message, is described in Appendix B of [IKE].
Subsequent IVs are taken from the last ciphertext block of the previous
message as described in [IKE].

In IKE Appendix B, two methods for IV calculation are available; one for
Phase 1 and another for Phase 2.

As Config Mode is neither but something in between, it feels like the
comment referring to Appendix B leaves much to interpretation. In fact, I
checked some implementations and stumbled into ones that use both methods
for Config Mode exchanges; this obviously created some interoperability
issues.

I am inclined to think that the Phase 2 method is supposed to be used due to
the fact that the resulting hash is derived using the incoming packet's
message ID. Is this correct, or are implementations allowed to use any one
of the methods? If Config Mode is supposed to use Phase 2 calculations for
this (or maybe some other reasoning), some implementations out there seem to
have huge interoperability issues (due to an incorrect IV calculation method
use).

Would really appreciate if anyone could shed some light on this.

Regards,
Matt