NAME

  R_A_RFC2408_5_11_2_2_HASH - [Responder Test] Check the Hash to confirm it is invalid


TARGET

  End-Node


SYNOPSIS

  R_A_RFC2408_5_11_2_2_HASH.seq [-tooloption ...] -pkt R_A_RFC2408_5_11_2_2_HASH.def -tooloption : v6eval tool option
  See also ike_common.def and ike_ipsec.def and ike_addr.def and ike_pkt_ph1_recv.def and ike_pkt_ph2_recv.def


INITIALIZATION


TEST PROCEDURE

  This test check is following.

AGGRESSIVE EXCHANGE
# Initiator(TN) Direction Responder(NUT) (1) HDR; SA, KE, Ni, IDii ========>
(2) <======== HDR; SA, KE, Nr, IDir, HASH_R
(3) HDR[*]; HASH_I ========> <-----Hash Data field : 0 (invalid)
(4) <======== HDR*; HASH(1); N/D (HDR; N/D) Judgement (Check *1)
1. Send the first message from TN In the first message (1), the initiator generates a proposal it considers adequate to protect traffic for the given situation. The Security Association, Proposal, and Transform payloads are included in the Security Association payload (for notation purposes). Keying material used to arrive at a common shared secret and random information which is used to guarantee liveness and protect against replay attacks are also transmitted. Additionally, the initiator transmits identification information.
2. Receive the second message from NUT In the second message (2), the responder indicates the protection suite it has accepted with the Security Association, Proposal, and Transform payloads. Keying material used to arrive at a common shared secret and random information which is used to guarantee liveness and protect against replay attacks is also transmitted.Additionally, the responder transmits identification information and the results of the agreed upon authentication function(hash function).
3. Send the third message from TN In the third (3) message, the initiator send the results of the agreed upon authentication function(hash function).
4. Receive the fourth message from NUT In the second message (4), the responder indicates either an ISAKMP Notify Payload or an ISAKMP delete Payload.

* PHASE II
QUICK MODE
# Initiator(TN) Direction Responder(NUT) (1) HDR*, HASH(1), SA, Ni ========>
(2) X <======== HDR*, HASH(2), SA, Nr <-----Must not transmit Judgement (Check *2)
1. Send the first message from TN In the first message (1), the initiator generates a proposal it considers adequate to protect traffic for the given situation. The Security Association, Proposal, and Transform payloads are included in the Security Association payload (for notation purposes). And initiator send HASH(1) and Nonce. HASH(1) is the prf over the message id (M-ID) from the ISAKMP header concatenated with the entire message that follows the hash including all payload headers, but excluding any padding added for encryption. Nonce is random information which is used to guarantee liveness.
2. Receive the second message from NUT In the second message (2), the responder indicates the protection suite it has accepted with the Security Association, Proposal, and Transform payloads. And responder send HASH(2) and Nonce. HASH(2) is identical to HASH(1) except the initiator's nonce-- Ni, minus the payload header-- is added after M-ID but before the complete message. Nonce is random information which is used to guarantee liveness.


JUDGEMENT

      In AGGRESSIVE EXCHANGE, the first to the second message must be exchanged correctly.
      The third message must not be accepted.
      And must not establish ISAKMP SA(In QUICK MODE, the second message must not transmit(Check *2)
      (* or AUTHENTICATION-FAILED message(4) may be returned(Check *1)).)
      *option : if you want to check the retruned Notify message.


TERMINATION

  Clean up SAD and SPD


REFERENCE

  RFC2408
  5.11 Hash Payload Processing

(omit)
When a Hash payload is received, the receiving entity (initiator or responder) MUST do the following:
1. Determine if the Hash is supported. If the Hash determination fails, the message is discarded and the following actions are taken:
(a) The event, INVALID HASH INFORMATION, MAY be logged in the appropriate system audit file.
(b) An Informational Exchange with a Notification payload containing the INVALID-HASH-INFORMATION message type MAY be sent to the transmitting entity. This action is dictated by a system security policy.
2. Perform the Hash function as outlined in the DOI and/or Key Exchange protocol documents. If the Hash function fails, the message is discarded and the following actions are taken:
(a) The event, INVALID HASH VALUE, MAY be logged in the appropriate system audit file.
(b) An Informational Exchange with a Notification payload containing the AUTHENTICATION-FAILED message type MAY be sent to the transmitting entity. This action is dictated by a system security policy.


SEE ALSO

  perldoc V6evalTool
  IKE.html IKE Test Common Utility