/
►
RFC 5528
Network Working Group A. Kato
Request for Comments:
5528 NTT Software Corporation
Category: Informational M. Kanda
NTT
S. Kanno
NTT Software Corporation
April 2009
Camellia Counter Mode and Camellia Counter with CBC-MAC Mode Algorithms
Status of This Memo This memo provides information for the Internet community. It does
Copyright Notice Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (
http://trustee.ietf.org/license-info ).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Abstract This document describes the algorithms and presents test vectors for
the Camellia block cipher algorithm in Counter mode (CTR) and Counter
with Cipher Block Chaining MAC mode (CCM). The purpose of this
document is to make the Camellia-CTR and Camellia-CCM algorithm
conveniently available to the Internet Community.
Table of Contents 1. Introduction ....................................................2
1.1. Terminology ................................................3
2. The Camellia Cipher Algorithm ...................................3
2.1. Key Size ...................................................3
2.2. Weak Keys ..................................................3
2.3. Block Size and Padding .....................................3
2.4. Performance ................................................4
3. Modes of Operation ..............................................4
4. Test Vectors ....................................................4
4.1. Camellia-CTR ...............................................4
4.2. Camellia-CCM ...............................................7
5. Security Considerations ........................................20
6. Acknowledgments ................................................20
7. References .....................................................20
7.1. Normative References ......................................20
7.2. Informative References ....................................20
1. Introduction This document describes the use of the Camellia block cipher
algorithm in Counter (CTR) mode and Counter with CBC-MAC (CCM) mode.
Camellia is a symmetric cipher with a Feistel structure. Camellia
was developed jointly by NTT and Mitsubishi Electric Corporation in
2000. It was designed to withstand all known cryptanalytic attacks,
and it has been scrutinized by worldwide cryptographic experts.
Camellia is suitable for implementation in software and hardware,
offering encryption speed in software and hardware implementations
that is comparable to Advanced Encryption Standard (AES) [5].
Camellia supports 128-bit block size and 128-, 192-, and 256-bit key
lengths, i.e., the same interface specifications as the AES.
Therefore, it is easy to implement Camellia-based algorithms by
replacing the AES block of AES-based algorithms with a Camellia
block.
Camellia already has been adopted by the IETF and other international
standardization organizations; in particular, the IETF has published
specifications for the use of Camellia with IPsec [6], TLS [7],
Secure/Multipurpose Internet Mail Extensions (S/MIME) [8], and XML
Securiy [9]. Camellia is one of the three ISO/IEC international
standard [10] 128-bit block ciphers (Camellia, AES, and Super
Effective and Efficient Delivery (SEED)). Camellia was selected as a
recommended cryptographic primitive by the EU NESSIE (New European
Schemes for Signatures, Integrity and Encryption) project [11] and
was included in the list of cryptographic techniques for Japanese
e-Government systems that was selected by the Japanese CRYPTREC
(Cryptography Research and Evaluation Committees) [12].
Since optimized source code is provided under several open source
licenses [13], Camellia has also been adopted by several open source
projects (OpenSSL, FreeBSD, Linux, and Firefox).
The algorithm specification and object identifiers are described in
[1].
The Camellia web site [14] contains a wealth of information about
Camellia, including detailed specification, security analysis,
performance figures, reference implementation, optimized
implementation, test vectors (TVs), and intellectual property
information.
1.1. Terminology The key words "
MUST ", "
MUST NOT ", "
REQUIRED ", "
SHALL ", "
SHALL NOT ",
"
SHOULD ", "
SHOULD NOT ", "
RECOMMENDED ", "
MAY ", and "
OPTIONAL " in this
document are to be interpreted as described in
RFC 2119 [2].
All multi-octet values in this document are encoded and represented
in network byte order, i.e., most significant octet first.
2. The Camellia Cipher Algorithm All symmetric block cipher algorithms share common characteristics
and variables, including mode, key size, weak keys, and block size.
The following sections contain descriptions of the relevant
characteristics of Camellia.
2.1. Key Size Camellia supports three key sizes: 128 bits, 192 bits, and 256 bits.
The default key size is 128 bits, and all implementations
MUST support this key size. Implementations
MAY also support key sizes of
192 bits and 256 bits.
2.2. Weak Keys At the time of writing this document, there are no known weak keys
for Camellia.
2.3. Block Size and Padding Camellia uses a block size of 16 octets (128 bits).
Padding is required by the algorithm to maintain a 16-octet (128-bit)
block size. Padding
MUST be added such that the data to be encrypted
has a length that is a multiple of 16 octets.
Because of the algorithm-specific padding requirement, no additional
padding is required to ensure that the ciphertext terminates on a
4-octet boundary (i.e., maintaining a 16-octet block size guarantees
that the Encapsulating Security Payload (ESP) Pad Length and Next
Header fields will be right aligned within a 4-octet word).
Additional padding
MAY be included as long as the 16-octet block size
is maintained.
2.4. Performance Performance figures for Camellia are available at [14]. The NESSIE
project has reported on the performance of optimized implementations
independently [11].
3. Modes of Operation Camellia Counter (Camellia-CTR) mode and Camellia Counter with CBC-
MAC (Camellia-CCM) mode are based on [3][15][4].
CTR mode [3] behaves like a stream cipher, but is based on a block
cipher primitive (that is, CTR mode operation of a block cipher
results in a stream cipher).
CCM mode [15][4] is a generic authenticate-and-encrypt block cipher
mode. In this specification, CCM is used with the Camellia [1] block
cipher.
4. Test Vectors
4.1. Camellia-CTR This section contains nine TVs, which can be used to confirm that an
implementation has correctly implemented Camellia-CTR. The first
three TVs use Camellia with a 128-bit key; the next three TVs use
Camellia with a 192-bit key; and the last three TVs use Camellia with
a 256-bit key.
TV #8: Encrypting 32 octets using Camellia-CTR with 256-bit key
Camellia Key : F6 D6 6D 6B D5 2D 59 BB 07 96 36 58 79 EF F8 86
: C6 6D D5 1A 5B 6A 99 74 4B 50 59 0C 87 A2 38 84
Camellia-CTR IV : C1 58 5E F1 5A 43 D8 75
Nonce : 00 FA AC 24
Plaintext : 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F
Counter Block (1): 00 FA AC 24 C1 58 5E F1 5A 43 D8 75 00 00 00 01
Key Stream (1): D6 C2 01 91 20 6A 7E 0F A0 35 21 29 A4 8E 90 4A
Counter Block (2): 00 FA AC 24 C1 58 5E F1 5A 43 D8 75 00 00 00 02
Key Stream (2): F5 0D C6 99 08 CA 56 79 A4 85 D8 C8 B7 9E 5F 17
Ciphertext : D6 C3 03 92 24 6F 78 08 A8 3C 2B 22 A8 83 9E 45
: E5 1C D4 8A 1C DF 40 6E BC 9C C2 D3 AB 83 41 08
TV #9: Encrypting 36 octets using Camellia-CTR with 256-bit key
Camellia Key : FF 7A 61 7C E6 91 48 E4 F1 72 6E 2F 43 58 1D E2
: AA 62 D9 F8 05 53 2E DF F1 EE D6 87 FB 54 15 3D
Camellia-CTR IV : 51 A5 1D 70 A1 C1 11 48
Nonce : 00 1C C5 B7
Plaintext : 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
: 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F
: 20 21 22 23
Counter Block (1): 00 1C C5 B7 51 A5 1D 70 A1 C1 11 48 00 00 00 01
Key Stream (1): A4 DB 21 FF E2 A0 F9 AD 65 6D A4 91 0A 5F AA 23
Counter Block (2): 00 1C C5 B7 51 A5 1D 70 A1 C1 11 48 00 00 00 02
Key Stream (2): C1 70 B1 58 71 EC 71 88 6D D9 05 0B 03 6C 39 70
Counter Block (3): 00 1C C5 B7 51 A5 1D 70 A1 C1 11 48 00 00 00 03
Key Stream (3): 35 CE 2F AE 90 78 B3 72 F5 76 12 39 1F 8B AF BF
Ciphertext : A4 DA 23 FC E6 A5 FF AA 6D 64 AE 9A 06 52 A4 2C
: D1 61 A3 4B 65 F9 67 9F 75 C0 1F 10 1F 71 27 6F
: 15 EF 0D 8D
4.2. Camellia-CCM This section contains twenty four TVs, which can be used to confirm
that an implementation has correctly implemented Camellia-CCM. In
each of these TVs, the least significant sixteen bits of the counter
block is used for the block counter, and the nonce is 13 octets.
Some of the TVs include an eight octet authentication value, and
others include a ten octet authentication value.
5. Security Considerations Camellia-CTR and Camellia-CCM employ CTR mode for confidentiality.
For the security of CTR mode, refer to the Security Considerations of
[16].
6. Acknowledgments Thanks to Rui Hodai for comments and suggestions. Special thanks to
Alfred Hoenes for several very detailed reviews and suggestions.
7. References
7.1. Normative References [1] Matsui, M., Nakajima, J., and S. Moriai, "A Description of the
Camellia Encryption Algorithm",
RFC 3713 , April 2004.
[2] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14,
RFC 2119 , March 1997.
[3] Dworkin, M., "Recommendation for Block Cipher Modes of
Operation - Methods and Techniques", NIST Special
Publication 800-38A, December 2001, <
http://csrc.nist.gov/ publications/nistpubs/800-38a/sp800-38a.pdf>.
[4] National Institute of Standards and Technology, "Recommendation
for Block Cipher Modes Operation : The CCM Mode for
Authentication and Confidentiality", May 2004, <http://
csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf>.
7.2. Informative References [5] National Institute of Standards and Technology, "Advanced
Encryption Standard (AES)", FIPS PUB 197, November 2001,
<
http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf >.
[6] Kato, A., Moriai, S., and M. Kanda, "The Camellia Cipher
Algorithm and Its Use With IPsec",
RFC 4312 , December 2005.
[7] Moriai, S., Kato, A., and M. Kanda, "Addition of Camellia
Cipher Suites to Transport Layer Security (TLS)",
RFC 4132 ,
July 2005.
[8] Moriai, S. and A. Kato, "Use of the Camellia Encryption
Algorithm in Cryptographic Message Syntax (CMS)",
RFC 3657 ,
January 2004.
[9] Eastlake, D., "Additional XML Security Uniform Resource
Identifiers (URIs)",
RFC 4051 , April 2005.
[10] International Organization for Standardization, "Information
technology - Security techniques - Encryption algorithms - Part
3: Block ciphers", ISO/IEC 18033-3, July 2005.
[11] "The NESSIE project (New European Schemes for Signatures,
Integrity and Encryption)",
<
http://www.cosic.esat.kuleuven.be/nessie/ >.
[12] Information-technology Promotion Agency (IPA), "Cryptography
Research and Evaluation Committees",
<
http://www.ipa.go.jp/security/enc/CRYPTREC/index-e.html >.
[13] "Camellia open source software",
<
http://info.isl.ntt.co.jp/crypt/eng/camellia/source.html >.
[14] "Camellia web site", <
http://info.isl.ntt.co.jp/camellia/ >.
[15] Whiting, D., Housley, R., and N. Ferguson, "Counter with CBC-
MAC (CCM)",
RFC 3610 , September 2003.
[16] Housley, R., "Using Advanced Encryption Standard (AES) Counter
Mode With IPsec Encapsulating Security Payload (ESP)",
RFC 3686 , January 2004.
Authors' Addresses