[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Digest length truncation, "algorithm differentiator"?
I'm trying to write IPSEC implementation which uses separately
loadable cryptographic and authentication libraries. For this use, the
IPSEC code itself doesn't care what the algorithm numbers in SA mean.
Now I have run into minor uncertainty with the digest lengths of the
authentication algorithms. Both hmac-md5-96 and hmac-sha1-96 documents
specify truncation of the digest output into 96 bits.
Is my interpretation correct:
If for some weird reason someone wanted to use more bits of
those digests, one would have to define a new algorithm number
for the SA to use? (e.g. the current PFKEY numbers MD5HMAC=2
and SHA1HMAC=3 refer explicitly to the trunctated digests
and the truncation amount is "algorithm differentiator" in
PFKEY terms?)
None of the PFKEY messages appear to have a parameter for the digest
length. (I guess I just need to extend the configuration which now
just maps the numbers to algorithms from loadable libraries, to
include a digest length to be used?)
In supported algorithms, there is this 'sadb_alg_ivlen'. What is its
value with authentication algorithms? Digest length? If so, should it
be the truncated 96 or the real 160 (sha1) or 128 (md5)?
regards,
--
Markku Savela (msa@hemuli.tte.vtt.fi), Technical Research Centre of Finland
Multimedia Systems, P.O.Box 1203,FIN-02044 VTT,http://www.vtt.fi/tte/staff/msa/
Follow-Ups: