CODEWITHSUNDEEP
linuxaesipsec
Marste
Marste

Reputation: 679

Why is the AES-key in gcm-mode 4 bytes longer?

I'm using ip xfrm under Linux to add an IPsec SA with AES in GCM mode to the system.

The command I'm using is like this:

ip xfrm state add src 10.66.21.164 dst 10.66.21.166 proto esp spi 0x201 mode transport aead "rfc4106(gcm(aes))" 0x010203047aeaca3f87d060a12f4a4487d5a5c335 96

Now I'm wondering: The key is seemingly 20B = 160b long. The normal AES key is 128b and, as can be seen above, the IV-length is 96b. If I lengthen or shorten the key it doesn't work, so clearly the expected input is (sizeof(AES)=128b) (it does, of course, work with 256b too) + 32b long.

Why is this so? The only thing I know that is 4B long in this context is unsigned int, which is the data type of IV-length variable, but this has nothing to do with the key. Shouldn't the key plus IV be 224b long (128 + 96 for the IV)?

Upvotes: 1

Views: 1606

Answers (1)

Maarten Bodewes
Maarten Bodewes

Reputation: 93948

The 96 value in your command is the size of the authentication tag. The authentication tag is part of a message in the session, it is not something you have to specify. The same thing goes for the IV, it is generated by the protocol per message.

The key material consists of a 16 byte (128 bit) AES key and a 4 byte (16 bit) salt in hexadecimal format, which uses 2 characters per byte.

The KEYMAT requested for each AES-GCM key is 20 octets. The first 16 octets are the 128-bit AES key, and the remaining four octets are used as the salt value in the nonce.

Source: RFC 4106.

Upvotes: 3

Related Questions