Subject: RE: [Ipsec] Is always padding required for the payload encrypted in IKE?

From: [email-masked]
Date: Fri, 22 Oct 2004 11:19:53 +0300

Hi,

It looks like the text on Page 15 is talking about encrypting 
some individual payloads in Phase 1 "revised mode of public key
encryption" messages ("<something>Ke_i" and "<something>KE_r"), 
while Page 38 is about encrypting the whole ISAKMP message ("HDR*").

Thus, I don't think there's any conflict between the "always be 
padding" and "should be padded", since they refer to different
cases.

Best regards,
Pasi

> -----Original Message-----
> From: Nobumichi Ozoe
> Sent: Friday, October 22, 2004 9:04 AM
> To: [email-masked]
> Subject: [Ipsec] Is always padding required for the payload 
>   encrypted in IKE?
>
> 
> Hello,
> 
> I have question about the padding in IKE.
> 
> Q1. When the encrypted payload is the size of a byte boundary 
> exactly, is it necessary to surely attach the padding?
> 
>  e.g
>    Encryption algorithm: 3DES-CBC
>    Hash algorithm: SHA
>    The size of the data encrypted is 48 bytes.
> 
> There are two part in RFC2409 about padding, first says 
> "always be padding", second says "should be padded".
> 
>    Page 15, last paragraph
>    Encrypted payloads are padded up to the nearest block size. 
>    All padding bytes, except for the last one, contain 0x00. The
>    last byte of the padding contains the number of the padding
>    bytes used, excluding the last one. Note that this means there 
>    will always be padding.
> 
>    Page 38, line 19
>                                                Each message
>    should be padded up to the nearest block size using bytes 
>    containing 0x00. The message length in the header MUST 
>    include the length of the pad since this reflects the 
>    size of the ciphertext.
> 
> Q2. When the encrypted message which does not contain the 
> padding is received, should receiver receive it?
> 
> Q3. If so, how should receiver process? Please let me know 
> RFC which is consulted.
> 
> Regards,
> 
> ---
> Nobumichi Ozoe
> TAHI Project

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Nobumichi Ozoe <[email-masked]>
Date: Fri, 22 Oct 2004 18:29:49 +0900

Thank you for your reply.

> padding" and "should be padded", since they refer to different

Ok.

Then, the receiver should receive the encrypted isakmp message without the padding, is right?