Subject: [Ipsec] AUTH payload - Issues

From: khan wadood <[email-masked]>
Date: Sat, 30 Oct 2004 15:55:28 +0100 (BST)

hi,

I am very much confused regarding calculation of AUTH
payload in message number no.3 
As, it is written in the draft-ietf-ipsec-ikev2-17.txt

'In the case of a pre-shared key, the AUTH value is
computed as:

AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"),
<msg octets>)'

Issues are: 

1-How does the Responder verify the AUTH payload of
the Initiator ??

2-'Key Pad for IKEv2'  i.e., 17 ASCII characters may
be different on the Initiator and Responder side. So,
the AUTH payload verification may fail on either side
because of this ??

3.What does 'msg octets' means for Initiator ?? and
Responder ??
 
For inititator, does this mean ??
'the first octet of the first SPI in the header of the
message no.1 and end with the last octet of the last
payload of the message no.1 where message no.1 is
first message of init exchange.

thanks in advance

wadood 

________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked]
Date: Sun, 31 Oct 2004 09:56:51 +0200

> 1-How does the Responder verify the AUTH payload of

The responder performs the same calculation, and compares
the value to the one sent by the initiator.

> the AUTH payload verification may fail on either side

No, the string 'Key Pad for IKEv2' is the same on both sides 
(i.e., it's not just any 17 ASCII characters, but the 
characters 'K', 'e', 'y', ' ', etc.)

> 3.What does 'msg octets' means for Initiator ?? and

See the first paragraph of Section 2.15.

Best regards,
Pasi