Score:0

What are the explicit usage of different keys derived from SKEYSEED in IKE?

us flag

We have seven different keys derived from DH key and nonces via PRF in IKEv2 as skd, skai, skar, skei, sker, skpi, skpr. Why different keys are generated for initator and responder for encryption? What are the explicit usage of different keys derived from SKEYSEED in IKE?

For example, ska and skp are defined as "a key to the integrity protection algorithm for authenticating the component messages of subsequent exchanges" and "used when generating an AUTH payload." respectively.

What is the difference?

Score:1
my flag

Why different keys are generated for initator and responder for encryption?

Well, some encryption algorithms (for example, GCM and ChaCha/Poly1305) are unsafe if multiple encryptors can use the same keys. This could be managed (in the above examples, by making sure that the two sides use different nonces, e.g. the initiator always uses even nonces and the responder always uses odd nonces), however a different method would be needed for every such encryption algorithm. It is considerably easier and more fool-proof to just have separate keys for the separate directions.

What are the explicit usage of different keys derived from SKEYSEED in IKE?

SKd - that key is used when deriving "child SAs", that is, security associations that are created as a result of this one. These can be both IKE SAs and IPsec SAs.

SKe - these are the keys used to encrypt the IKE messages

SKa - these are the keys used to add integrity protection to the IKE messages (assuming that some explicit integrity transform, such as HMAC or CMAC, is negotiated; if a combined mode such as GCM is used, this is unused and is zero length).

SKp - these are used as a part of the formula used to compute/verify the AUTH payload, which is aimed at verifying the identity of the other side (contrasted with the SKa keys, which is aimed at verified that the message send from the other side is the message that was received).

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.