Use AEAD wrapper for encryption payload encryption/decryption

src/libcharon/encoding/generator.c

@@ -463,24 +463,15 @@ static void generate_from_chunk(private_generator_t *this, u_int32_t offset)
 	write_bytes_to_buffer(this, value->ptr, value->len);
 }
 
-METHOD(generator_t, write_to_chunk, void,
-	private_generator_t *this, chunk_t *data)
+METHOD(generator_t, get_chunk, chunk_t,
+	private_generator_t *this, u_int32_t **lenpos)
 {
-	u_int32_t len, val;
+	chunk_t data;
 
-	len = get_length(this);
-
-	/* write length into header length field */
-	if (this->header_length_position_offset > 0)
-	{
-		val = htonl(len);
-		write_bytes_to_buffer_at_offset(this, &val, sizeof(u_int32_t),
-										this->header_length_position_offset);
-	}
-	*data = chunk_alloc(len);
-	memcpy(data->ptr, this->buffer, len);
-
-	DBG3(DBG_ENC, "generated data of this generator %B", data);
+	*lenpos = (u_int32_t*)(this->buffer + this->header_length_position_offset);
+	data = chunk_create(this->buffer, get_length(this));
+	DBG3(DBG_ENC, "generated data of this generator %B", &data);
+	return data;
 }
 
 METHOD(generator_t, generate_payload, void,
@@ -864,7 +855,7 @@ generator_t *generator_create()
 
 	INIT(this,
 		.public = {
-			.write_to_chunk = _write_to_chunk,
+			.get_chunk = _get_chunk,
 			.generate_payload = _generate_payload,
 			.destroy = _destroy,
 		},

src/libcharon/encoding/generator.h

@@ -44,18 +44,20 @@ struct generator_t {
 	/**
 	 * Generates a specific payload from given payload object.
 	 *
-	 * Remember: Header and substructures are also handled as payloads.
-	 *
 	 * @param payload 		interface payload_t implementing object
 	 */
 	void (*generate_payload) (generator_t *this,payload_t *payload);
 
 	/**
-	 * Writes all generated data of the generator to a chunk.
+	 * Return a chunk for the currently generated data.
 	 *
-	 * @param data 		chunk to write the data to
+	 * The returned length pointer must be filled in with the length of
+	 * the generated chunk (in network order).
+	 *
+	 * @param lenpos		receives a pointer to fill in length value
+	 * @param return		chunk to internal buffer.
 	 */
-	void (*write_to_chunk) (generator_t *this,chunk_t *data);
+	chunk_t (*get_chunk) (generator_t *this, u_int32_t **lenpos);
 
 	/**
 	 * Destroys a generator_t object.

src/libcharon/encoding/message.h

@@ -32,8 +32,7 @@ typedef struct message_t message_t;
 #include <encoding/payloads/ike_header.h>
 #include <encoding/payloads/notify_payload.h>
 #include <utils/linked_list.h>
-#include <crypto/crypters/crypter.h>
-#include <crypto/signers/signer.h>
+#include <crypto/aead.h>
 
 /**
  * This class is used to represent an IKEv2-Message.
@@ -201,14 +200,10 @@ struct message_t {
 	 * The body gets not only parsed, but rather it gets verified.
 	 * All payloads are verified if they are allowed to exist in the message
 	 * of this type and if their own structure is ok.
-	 * If there are encrypted payloads, they get decrypted via the supplied
-	 * crypter. Also the message integrity gets verified with the supplied
-	 * signer.
-	 * Crypter/signer can be omitted (by passing NULL) when no encryption
-	 * payload is expected.
+	 * If there are encrypted payloads, they get decrypted and verified using
+	 * the given aead transform (if given).
 	 *
-	 * @param crypter	crypter to decrypt encryption payloads
-	 * @param signer	signer to verifiy a message with an encryption payload
+	 * @param aead		aead transform to verify/decrypt message
 	 * @return
 	 * 					- SUCCESS if parsing successful
 	 * 					- NOT_SUPPORTED if ciritcal unknown payloads found
@@ -216,32 +211,28 @@ struct message_t {
 	 *					- PARSE_ERROR if message parsing failed
 	 * 					- VERIFY_ERROR if message verification failed (bad syntax)
 	 * 					- FAILED if integrity check failed
-	 * 					- INVALID_STATE if crypter/signer not supplied, but needed
+	 * 					- INVALID_STATE if aead not supplied, but needed
 	 */
-	status_t (*parse_body) (message_t *this, crypter_t *crypter, signer_t *signer);
+	status_t (*parse_body) (message_t *this, aead_t *aead);
 
 	/**
 	 * Generates the UDP packet of specific message.
 	 *
 	 * Payloads which must be encrypted are generated first and added to
-	 * an encryption payload. This encryption payload will get encrypted via
-	 * the supplied crypter. Then all other payloads and the header get generated.
-	 * After that, the checksum is added to the encryption payload over the full
-	 * message.
-	 * Crypter/signer can be omitted (by passing NULL) when no encryption
-	 * payload is expected.
-	 * Generation is only done once, multiple calls will just return a packet copy.
+	 * an encryption payload. This encryption payload will get encrypted and
+	 * signed via the supplied aead transform (if given).
+	 * Generation is only done once, multiple calls will just return a copy
+	 * of the packet.
 	 *
-	 * @param crypter	crypter to use when a payload must be encrypted
-	 * @param signer	signer to build a mac
+	 * @param aead		aead transform to encrypt/sign message
 	 * @param packet	copy of generated packet
 	 * @return
 	 * 					- SUCCESS if packet could be generated
 	 * 					- INVALID_STATE if exchange type is currently not set
 	 * 					- NOT_FOUND if no rules found for message generation
-	 * 					- INVALID_STATE if crypter/signer not supplied but needed.
+	 * 					- INVALID_STATE if aead not supplied but needed.
 	 */
-	status_t (*generate) (message_t *this, crypter_t *crypter, signer_t *signer, packet_t **packet);
+	status_t (*generate) (message_t *this, aead_t *aead, packet_t **packet);
 
 	/**
 	 * Gets the source host informations.
@@ -331,13 +322,8 @@ struct message_t {
 /**
  * Creates an message_t object from a incoming UDP Packet.
  *
- * @warning the given packet_t object is not copied and gets
- *			destroyed in message_t's destroy call.
- *
- * - exchange_type is set to NOT_SET
- * - original_initiator is set to TRUE
- * - is_request is set to TRUE
- * Call message_t.parse_header afterwards.
+ * The given packet gets owned by the message. The message is uninitialized,
+ * call parse_header() to populate header fields.
  *
  * @param packet		packet_t object which is assigned to message
  * @return 				message_t object

src/libcharon/encoding/payloads/encryption_payload.c

@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -24,9 +25,6 @@
 #include <utils/linked_list.h>
 #include <encoding/generator.h>
 #include <encoding/parser.h>
-#include <utils/iterator.h>
-#include <crypto/signers/signer.h>
-
 
 typedef struct private_encryption_payload_t private_encryption_payload_t;
 
@@ -50,9 +48,9 @@ struct private_encryption_payload_t {
 	u_int8_t next_payload;
 
 	/**
-	 * Critical flag.
+	 * Flags, including reserved bits
 	 */
-	bool critical;
+	u_int8_t flags;
 
 	/**
 	 * Length of this payload
@@ -60,28 +58,17 @@ struct private_encryption_payload_t {
 	u_int16_t payload_length;
 
 	/**
-	 * Chunk containing the iv, data, padding,
-	 * and (an eventually not calculated) signature.
+	 * Chunk containing the IV, plain, padding and ICV.
 	 */
 	chunk_t encrypted;
 
 	/**
-	 * Chunk containing the data in decrypted (unpadded) form.
+	 * AEAD transform to use
 	 */
-	chunk_t decrypted;
+	aead_t *aead;
 
 	/**
-	 * Signer set by set_signer.
-	 */
-	signer_t *signer;
-
-	/**
-	 * Crypter, supplied by encrypt/decrypt
-	 */
-	crypter_t *crypter;
-
-	/**
-	 * Contained payloads of this encrpytion_payload.
+	 * Contained payloads
 	 */
 	linked_list_t *payloads;
 };
@@ -95,16 +82,8 @@ struct private_encryption_payload_t {
 encoding_rule_t encryption_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
 	{ U_INT_8,			offsetof(private_encryption_payload_t, next_payload)	},
-	/* the critical bit */
-	{ FLAG,				offsetof(private_encryption_payload_t, critical)		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
+	/* Critical and 7 reserved bits, all stored for reconstruction */
+	{ U_INT_8,			offsetof(private_encryption_payload_t, flags)			},
 	/* Length of the whole encryption payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_encryption_payload_t, payload_length)	},
 	/* encrypted data, stored in a chunk. contains iv, data, padding */
@@ -169,44 +148,43 @@ static void compute_length(private_encryption_payload_t *this)
 {
 	enumerator_t *enumerator;
 	payload_t *payload;
-	size_t block_size, length = 0;
+	size_t bs, length = 0;
 
-	enumerator = this->payloads->create_enumerator(this->payloads);
-	while (enumerator->enumerate(enumerator, &payload))
+	if (this->encrypted.len)
 	{
-		length += payload->get_length(payload);
+		length = this->encrypted.len;
 	}
-	enumerator->destroy(enumerator);
-
-	if (this->crypter && this->signer)
+	else
 	{
-		/* append one byte for padding length */
-		length++;
-		/* append padding */
-		block_size = this->crypter->get_block_size(this->crypter);
-		length += block_size - length % block_size;
-		/* add iv */
-		length += this->crypter->get_iv_size(this->crypter);
-		/* add signature */
-		length += this->signer->get_block_size(this->signer);
+		enumerator = this->payloads->create_enumerator(this->payloads);
+		while (enumerator->enumerate(enumerator, &payload))
+		{
+			length += payload->get_length(payload);
+		}
+		enumerator->destroy(enumerator);
+
+		if (this->aead)
+		{
+			/* append padding */
+			bs = this->aead->get_block_size(this->aead);
+			length += bs - (length % bs);
+			/* add iv */
+			length += this->aead->get_iv_size(this->aead);
+			/* add icv */
+			length += this->aead->get_icv_size(this->aead);
+		}
 	}
 	length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
 	this->payload_length = length;
 }
 
-METHOD(payload_t, get_length, size_t,
+METHOD2(payload_t, encryption_payload_t, get_length, size_t,
 	private_encryption_payload_t *this)
 {
 	compute_length(this);
 	return this->payload_length;
 }
 
-METHOD(encryption_payload_t, create_payload_iterator, iterator_t*,
-	private_encryption_payload_t *this, bool forward)
-{
-	return this->payloads->create_iterator(this->payloads, forward);
-}
-
 METHOD(encryption_payload_t, add_payload, void,
 	private_encryption_payload_t *this, payload_t *payload)
 {
@@ -226,295 +204,244 @@ METHOD(encryption_payload_t, add_payload, void,
 	compute_length(this);
 }
 
-METHOD(encryption_payload_t, remove_first_payload, status_t,
-	private_encryption_payload_t *this, payload_t **payload)
-{
-	return this->payloads->remove_first(this->payloads, (void**)payload);
-}
-
-METHOD(encryption_payload_t, get_payload_count, size_t,
+METHOD(encryption_payload_t, remove_payload, payload_t *,
 	private_encryption_payload_t *this)
 {
-	return this->payloads->get_count(this->payloads);
+	payload_t *payload;
+
+	if (this->payloads->remove_first(this->payloads,
+									 (void**)&payload) == SUCCESS)
+	{
+		return payload;
+	}
+	return NULL;
 }
 
 /**
- * Generate payload before encryption.
+ * Generate payload before encryption
  */
-static void generate(private_encryption_payload_t *this)
+static chunk_t generate(private_encryption_payload_t *this,
+						generator_t *generator)
 {
 	payload_t *current, *next;
-	generator_t *generator;
 	enumerator_t *enumerator;
-
-	compute_length(this);
-	chunk_free(&this->decrypted);
+	u_int32_t *lenpos;
+	chunk_t chunk = chunk_empty;
 
 	enumerator = this->payloads->create_enumerator(this->payloads);
 	if (enumerator->enumerate(enumerator, &current))
 	{
 		this->next_payload = current->get_type(current);
 
-		generator = generator_create();
 		while (enumerator->enumerate(enumerator, &next))
 		{
 			current->set_next_type(current, next->get_type(next));
 			generator->generate_payload(generator, current);
 			current = next;
 		}
-		enumerator->destroy(enumerator);
 		current->set_next_type(current, NO_PAYLOAD);
 		generator->generate_payload(generator, current);
 
-		generator->write_to_chunk(generator, &this->decrypted);
-		generator->destroy(generator);
+		chunk = generator->get_chunk(generator, &lenpos);
 		DBG2(DBG_ENC, "generated content in encryption payload");
 	}
-	else
-	{
-		DBG2(DBG_ENC, "generating contained payloads, but none available");
-	}
 	enumerator->destroy(enumerator);
+	return chunk;
 }
 
-METHOD(encryption_payload_t, encrypt, status_t,
-	private_encryption_payload_t *this)
+/**
+ * Append the encryption payload header to the associated data
+ */
+static chunk_t append_header(private_encryption_payload_t *this, chunk_t assoc)
 {
-	chunk_t iv, padding, to_crypt, result;
-	rng_t *rng;
-	size_t block_size;
+	struct {
+		u_int8_t next_payload;
+		u_int8_t flags;
+		u_int16_t length;
+	} __attribute__((packed)) header = {
+		.next_payload = this->next_payload,
+		.flags = this->flags,
+		.length = htons(get_length(this)),
+	};
+	return chunk_cat("cc", assoc, chunk_from_thing(header));
+}
 
-	if (this->signer == NULL || this->crypter == NULL)
+METHOD(encryption_payload_t, encrypt, bool,
+	private_encryption_payload_t *this, chunk_t assoc)
+{
+	chunk_t iv, plain, padding, icv, crypt;
+	generator_t *generator;
+	rng_t *rng;
+	size_t bs;
+
+	if (this->aead == NULL)
 	{
-		DBG1(DBG_ENC, "could not encrypt, signer/crypter not set");
-		return INVALID_STATE;
+		DBG1(DBG_ENC, "encrypting encryption payload failed, transform missing");
+		return FALSE;
 	}
 
-	/* for random data in iv and padding */
 	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 	if (!rng)
 	{
-		DBG1(DBG_ENC, "could not encrypt, no RNG found");
-		return FAILED;
+		DBG1(DBG_ENC, "encrypting encryption payload failed, no RNG found");
+		return FALSE;
 	}
-	/* build payload chunk */
-	generate(this);
 
-	DBG2(DBG_ENC, "encrypting payloads");
-	DBG3(DBG_ENC, "data to encrypt %B", &this->decrypted);
+	assoc = append_header(this, assoc);
 
-	/* build padding */
-	block_size = this->crypter->get_block_size(this->crypter);
-	padding.len = block_size - ((this->decrypted.len + 1) %  block_size);
-	rng->allocate_bytes(rng, padding.len, &padding);
+	generator = generator_create();
+	plain = generate(this, generator);
+	bs = this->aead->get_block_size(this->aead);
+	/* we need at least one byte padding to store the padding length */
+	padding.len = bs - (plain.len % bs);
+	iv.len = this->aead->get_iv_size(this->aead);
+	icv.len = this->aead->get_icv_size(this->aead);
 
-	/* concatenate payload data, padding, padding len */
-	to_crypt.len = this->decrypted.len + padding.len + 1;
-	to_crypt.ptr = malloc(to_crypt.len);
+	/* prepare data to authenticate-encrypt:
+	 * | IV | plain | padding | ICV |
+	 *       \____crypt______/   ^
+	 *              |           /
+	 *              v          /
+	 *     assoc -> + ------->/
+	 */
+	free(this->encrypted.ptr);
+	this->encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len);
+	iv.ptr = this->encrypted.ptr;
+	memcpy(iv.ptr + iv.len, plain.ptr, plain.len);
+	plain.ptr = iv.ptr + iv.len;
+	padding.ptr = plain.ptr + plain.len;
+	icv.ptr = padding.ptr + padding.len;
+	crypt = chunk_create(plain.ptr, plain.len + padding.len);
+	generator->destroy(generator);
 
-	memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len);
-	memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len);
-	*(to_crypt.ptr + to_crypt.len - 1) = padding.len;
-
-	/* build iv */
-	iv.len = this->crypter->get_iv_size(this->crypter);
-	rng->allocate_bytes(rng, iv.len, &iv);
+	rng->get_bytes(rng, iv.len, iv.ptr);
+	rng->get_bytes(rng, padding.len - 1, padding.ptr);
+	padding.ptr[padding.len - 1] = padding.len - 1;
 	rng->destroy(rng);
 
-	DBG3(DBG_ENC, "data before encryption with padding %B", &to_crypt);
+	DBG3(DBG_ENC, "encryption payload encryption:");
+	DBG3(DBG_ENC, "IV %B", &iv);
+	DBG3(DBG_ENC, "plain %B", &plain);
+	DBG3(DBG_ENC, "padding %B", &padding);
+	DBG3(DBG_ENC, "assoc %B", &assoc);
 
-	/* encrypt to_crypt chunk */
-	free(this->encrypted.ptr);
-	this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
-	free(padding.ptr);
-	free(to_crypt.ptr);
+	this->aead->encrypt(this->aead, crypt, assoc, iv, NULL);
 
-	DBG3(DBG_ENC, "data after encryption %B", &result);
+	DBG3(DBG_ENC, "encrypted %B", &crypt);
+	DBG3(DBG_ENC, "ICV %B", &icv);
 
-	/* build encrypted result with iv and signature */
-	this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
-	free(this->encrypted.ptr);
-	this->encrypted.ptr = malloc(this->encrypted.len);
+	free(assoc.ptr);
 
-	/* fill in result, signature is left out */
-	memcpy(this->encrypted.ptr, iv.ptr, iv.len);
-	memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len);
-
-	free(result.ptr);
-	free(iv.ptr);
-	DBG3(DBG_ENC, "data after encryption with IV and (invalid) signature %B",
-		 &this->encrypted);
-
-	return SUCCESS;
+	return TRUE;
 }
 
 /**
  * Parse the payloads after decryption.
  */
-static status_t parse(private_encryption_payload_t *this)
+static status_t parse(private_encryption_payload_t *this, chunk_t plain)
 {
 	parser_t *parser;
-	status_t status;
 	payload_type_t type;
 
-	parser = parser_create(this->decrypted);
+	parser = parser_create(plain);
 	type = this->next_payload;
 	while (type != NO_PAYLOAD)
 	{
 		payload_t *payload;
 
-		status = parser->parse_payload(parser, type, &payload);
-		if (status != SUCCESS)
+		if (parser->parse_payload(parser, type, &payload) != SUCCESS)
 		{
 			parser->destroy(parser);
-			return PARSE_ERROR;
+			return FALSE;
 		}
-		status = payload->verify(payload);
-		if (status != SUCCESS)
+		if (payload->verify(payload) != SUCCESS)
 		{
 			DBG1(DBG_ENC, "%N verification failed",
 				 payload_type_names, payload->get_type(payload));
 			payload->destroy(payload);
 			parser->destroy(parser);
-			return VERIFY_ERROR;
+			return FALSE;
 		}
 		type = payload->get_next_type(payload);
 		this->payloads->insert_last(this->payloads, payload);
 	}
 	parser->destroy(parser);
 	DBG2(DBG_ENC, "parsed content of encryption payload");
-	return SUCCESS;
+	return TRUE;
 }
 
-METHOD(encryption_payload_t, decrypt, status_t,
-	private_encryption_payload_t *this)
+METHOD(encryption_payload_t, decrypt, bool,
+	private_encryption_payload_t *this, chunk_t assoc)
 {
-	chunk_t iv, concatenated;
-	u_int8_t padding_length;
+	chunk_t iv, plain, padding, icv, crypt;
+	size_t bs;
 
-	DBG2(DBG_ENC, "decrypting encryption payload");
-	DBG3(DBG_ENC, "data before decryption with IV and (invalid) signature %B",
-		 &this->encrypted);
-
-	if (this->signer == NULL || this->crypter == NULL)
+	if (this->aead == NULL)
 	{
-		DBG1(DBG_ENC, "could not decrypt, no crypter/signer set");
-		return INVALID_STATE;
+		DBG1(DBG_ENC, "decrypting encryption payload failed, transform missing");
+		return FALSE;
 	}
 
-	/* get IV */
-	iv.len = this->crypter->get_iv_size(this->crypter);
-	if (iv.len > this->encrypted.len)
-	{
-		DBG1(DBG_ENC, "could not decrypt, input too short");
-		return FAILED;
-	}
+	/* prepare data to authenticate-decrypt:
+	 * | IV | plain | padding | ICV |
+	 *       \____crypt______/   ^
+	 *              |           /
+	 *              v          /
+	 *     assoc -> + ------->/
+	 */
+
+	bs = this->aead->get_block_size(this->aead);
+	iv.len = this->aead->get_iv_size(this->aead);
 	iv.ptr = this->encrypted.ptr;
+	icv.len = this->aead->get_icv_size(this->aead);
+	icv.ptr = this->encrypted.ptr + this->encrypted.len - icv.len;
+	crypt.ptr = iv.ptr + iv.len;
+	crypt.len = this->encrypted.len - iv.len;
 
-	/* point concatenated to data + padding + padding_length */
-	concatenated.ptr = this->encrypted.ptr + iv.len;
-	concatenated.len = this->encrypted.len - iv.len -
-								this->signer->get_block_size(this->signer);
-
-	/* concatenated must be a multiple of block_size of crypter */
-	if (concatenated.len < iv.len ||
-		concatenated.len % this->crypter->get_block_size(this->crypter))
+	if (iv.len + icv.len > this->encrypted.len ||
+		(crypt.len - icv.len) % bs)
 	{
-		DBG1(DBG_ENC, "could not decrypt, invalid input");
-		return FAILED;
+		DBG1(DBG_ENC, "decrypting encryption payload failed, invalid length");
+		return FALSE;
 	}
 
-	/* free previus data, if any */
-	free(this->decrypted.ptr);
+	assoc = append_header(this, assoc);
 
-	DBG3(DBG_ENC, "data before decryption %B", &concatenated);
+	DBG3(DBG_ENC, "encryption payload decryption:");
+	DBG3(DBG_ENC, "IV %B", &iv);
+	DBG3(DBG_ENC, "encrypted %B", &crypt);
+	DBG3(DBG_ENC, "ICV %B", &icv);
+	DBG3(DBG_ENC, "assoc %B", &assoc);
 
-	this->crypter->decrypt(this->crypter, concatenated, iv, &this->decrypted);
-
-	DBG3(DBG_ENC, "data after decryption with padding %B", &this->decrypted);
-
-	/* get padding length, sits just bevore signature */
-	padding_length = *(this->decrypted.ptr + this->decrypted.len - 1);
-	/* add one byte to the padding length, since the padding_length field is
-	 * not included */
-	padding_length++;
-
-	/* check size again */
-	if (padding_length > concatenated.len || padding_length > this->decrypted.len)
+	if (!this->aead->decrypt(this->aead, crypt, assoc, iv, NULL))
 	{
-		DBG1(DBG_ENC, "decryption failed, invalid padding length found. Invalid key?");
-		/* decryption failed :-/ */
+		DBG1(DBG_ENC, "verifying encryption payload integrity failed");
+		free(assoc.ptr);
+		return FALSE;
+	}
+	free(assoc.ptr);
+
+	plain = chunk_create(crypt.ptr, crypt.len - icv.len);
+	padding.len = plain.ptr[plain.len - 1] + 1;
+	if (padding.len >= plain.len)
+	{
+		DBG1(DBG_ENC, "decrypting encryption payload failed, "
+			 "padding invalid %B", &crypt);
 		return FAILED;
 	}
-	this->decrypted.len -= padding_length;
+	plain.len -= padding.len;
+	padding.ptr = plain.ptr + plain.len;
 
-	/* free padding */
-	this->decrypted.ptr = realloc(this->decrypted.ptr, this->decrypted.len);
-	DBG3(DBG_ENC, "data after decryption without padding %B", &this->decrypted);
-	DBG2(DBG_ENC, "decryption successful, trying to parse content");
-	return parse(this);
+	DBG3(DBG_ENC, "plain %B", &plain);
+	DBG3(DBG_ENC, "padding %B", &padding);
+
+	return parse(this, plain);
 }
 
-METHOD(encryption_payload_t, set_transforms, void,
-	private_encryption_payload_t *this, crypter_t* crypter, signer_t* signer)
+METHOD(encryption_payload_t, set_transform, void,
+	private_encryption_payload_t *this, aead_t* aead)
 {
-	this->signer = signer;
-	this->crypter = crypter;
-}
-
-METHOD(encryption_payload_t, build_signature, status_t,
-	private_encryption_payload_t *this, chunk_t data)
-{
-	chunk_t data_without_sig = data;
-	chunk_t sig;
-
-	if (this->signer == NULL)
-	{
-		DBG1(DBG_ENC, "unable to build signature, no signer set");
-		return INVALID_STATE;
-	}
-
-	sig.len = this->signer->get_block_size(this->signer);
-	data_without_sig.len -= sig.len;
-	sig.ptr = data.ptr + data_without_sig.len;
-	DBG2(DBG_ENC, "building signature");
-	this->signer->get_signature(this->signer, data_without_sig, sig.ptr);
-	return SUCCESS;
-}
-
-METHOD(encryption_payload_t, verify_signature, status_t,
-	private_encryption_payload_t *this, chunk_t data)
-{
-	chunk_t sig, data_without_sig;
-	bool valid;
-
-	if (this->signer == NULL)
-	{
-		DBG1(DBG_ENC, "unable to verify signature, no signer set");
-		return INVALID_STATE;
-	}
-	/* find signature in data chunk */
-	sig.len = this->signer->get_block_size(this->signer);
-	if (data.len <= sig.len)
-	{
-		DBG1(DBG_ENC, "unable to verify signature, invalid input");
-		return FAILED;
-	}
-	sig.ptr = data.ptr + data.len - sig.len;
-
-	/* verify it */
-	data_without_sig.len = data.len - sig.len;
-	data_without_sig.ptr = data.ptr;
-	valid = this->signer->verify_signature(this->signer, data_without_sig, sig);
-
-	if (!valid)
-	{
-		DBG1(DBG_ENC, "signature verification failed");
-		return FAILED;
-	}
-
-	DBG2(DBG_ENC, "signature verification successful");
-	return SUCCESS;
+	this->aead = aead;
 }
 
 METHOD2(payload_t, encryption_payload_t, destroy, void,
@@ -522,7 +449,6 @@ METHOD2(payload_t, encryption_payload_t, destroy, void,
 {
 	this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
 	free(this->encrypted.ptr);
-	free(this->decrypted.ptr);
 	free(this);
 }
 
@@ -544,15 +470,12 @@ encryption_payload_t *encryption_payload_create()
 				.get_type = _get_type,
 				.destroy = _destroy,
 			},
-			.create_payload_iterator = _create_payload_iterator,
+			.get_length = _get_length,
 			.add_payload = _add_payload,
-			.remove_first_payload = _remove_first_payload,
-			.get_payload_count = _get_payload_count,
+			.remove_payload = _remove_payload,
+			.set_transform = _set_transform,
 			.encrypt = _encrypt,
 			.decrypt = _decrypt,
-			.set_transforms = _set_transforms,
-			.build_signature = _build_signature,
-			.verify_signature = _verify_signature,
 			.destroy = _destroy,
 		},
 		.next_payload = NO_PAYLOAD,

src/libcharon/encoding/payloads/encryption_payload.h

@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -25,45 +26,30 @@
 typedef struct encryption_payload_t encryption_payload_t;
 
 #include <library.h>
-#include <crypto/crypters/crypter.h>
-#include <crypto/signers/signer.h>
+#include <crypto/aead.h>
 #include <encoding/payloads/payload.h>
-#include <utils/linked_list.h>
 
 /**
  * Encrpytion payload length in bytes without IV and following data.
  */
 #define ENCRYPTION_PAYLOAD_HEADER_LENGTH 4
 
-
 /**
  * The encryption payload as described in RFC section 3.14.
- *
- * Before any crypt/decrypt/sign/verify operation can occur,
- * the transforms must be set. After that, a parsed encryption payload
- * can be decrypted, which also will parse the contained payloads.
- * Encryption is done the same way, added payloads will get generated
- * and then encrypted.
- * For signature building, there is the FULL packet needed. Meaning it
- * must be builded after generation of all payloads and the encryption
- * of the encryption payload.
- * Signature verificatin is done before decryption.
  */
 struct encryption_payload_t {
+
 	/**
 	 * Implements payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator for all contained payloads.
+	 * Get the payload length.
 	 *
-	 * iterator_t object has to get destroyed by the caller.
-	 *
-	 * @param forward 		iterator direction (TRUE: front to end)
-	 * return				created iterator_t object
+	 * @return			(expected) payload length
 	 */
-	 iterator_t *(*create_payload_iterator) (encryption_payload_t *this, bool forward);
+	size_t (*get_length)(encryption_payload_t *this);
 
 	/**
 	 * Adds a payload to this encryption payload.
@@ -73,89 +59,35 @@ struct encryption_payload_t {
 	void (*add_payload) (encryption_payload_t *this, payload_t *payload);
 
 	/**
-	 * Reove the last payload in the contained payload list.
+	 * Remove the first payload in the list
 	 *
 	 * @param payload		removed payload
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- NOT_FOUND if list empty
+	 * @return				payload, NULL if none left
 	 */
-	status_t (*remove_first_payload) (encryption_payload_t *this, payload_t **payload);
+	payload_t* (*remove_payload)(encryption_payload_t *this);
 
 	/**
-	 * Get the number of payloads.
+	 * Set the AEAD transform to use.
 	 *
-	 * @return				number of contained payloads
+	 * @param aead		aead transform to use
 	 */
-	size_t (*get_payload_count) (encryption_payload_t *this);
+	void (*set_transform) (encryption_payload_t *this, aead_t *aead);
 
 	/**
-	 * Set transforms to use.
+	 * Generate, encrypt and sign contained payloads.
 	 *
-	 * To decryption, encryption, signature building and verifying,
-	 * the payload needs a crypter and a signer object.
-	 *
-	 * @warning Do NOT call this function again after encryption, since
-	 * the signer must be the same while encrypting and signature building!
-	 *
-	 * @param crypter		crypter_t to use for data de-/encryption
-	 * @param signer		signer_t to use for data signing/verifying
+	 * @param assoc			associated data
+	 * @return				TRUE if encrypted
 	 */
-	void (*set_transforms) (encryption_payload_t *this, crypter_t *crypter, signer_t *signer);
+	bool (*encrypt) (encryption_payload_t *this, chunk_t assoc);
 
 	/**
-	 * Generate and encrypt contained payloads.
+	 * Decrypt, verify and parse contained payloads.
 	 *
-	 * This function generates the content for added payloads
-	 * and encrypts them. Signature is not built, since we need
-	 * additional data (the full message).
-	 *
-	 * @return				SUCCESS, or INVALID_STATE if transforms not set
+	 * @param assoc			associated data
+	 * @return				TRUE if decrypted and verified successfully
 	 */
-	status_t (*encrypt) (encryption_payload_t *this);
-
-	/**
-	 * Decrypt and parse contained payloads.
-	 *
-	 * This function decrypts the contained data. After,
-	 * the payloads are parsed internally and are accessible
-	 * via the iterator.
-	 *
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- INVALID_STATE if transforms not set, or
-	 * 						- FAILED if data is invalid
-	 */
-	status_t (*decrypt) (encryption_payload_t *this);
-
-	/**
-	 * Build the signature.
-	 *
-	 * The signature is built over the FULL message, so the header
-	 * and every payload (inclusive this one) must already be generated.
-	 * The generated message is supplied via the data paramater.
-	 *
-	 * @param data			chunk contains the already generated message
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- INVALID_STATE if transforms not set
-	 */
-	status_t (*build_signature) (encryption_payload_t *this, chunk_t data);
-
-	/**
-	 * Verify the signature.
-	 *
-	 * Since the signature is built over the full message, we need
-	 * this data to do the verification. The message data
-	 * is supplied via the data argument.
-	 *
-	 * @param data			chunk contains the message
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- FAILED if signature invalid, or
-	 * 						- INVALID_STATE if transforms not set
-	 */
-	status_t (*verify_signature) (encryption_payload_t *this, chunk_t data);
+	bool (*decrypt) (encryption_payload_t *this, chunk_t assoc);
 
 	/**
 	 * Destroys an encryption_payload_t object.
@@ -166,7 +98,7 @@ struct encryption_payload_t {
 /**
  * Creates an empty encryption_payload_t object.
  *
- * @return encryption_payload_t object
+ * @return			encryption_payload_t object
  */
 encryption_payload_t *encryption_payload_create(void);
 

src/libcharon/network/receiver.c

@@ -146,7 +146,7 @@ static void send_notify(message_t *request, notify_type_t type, chunk_t data)
 		ike_sa_id->switch_initiator(ike_sa_id);
 		response->set_ike_sa_id(response, ike_sa_id);
 		response->add_notify(response, FALSE, type, data);
-		if (response->generate(response, NULL, NULL, &packet) == SUCCESS)
+		if (response->generate(response, NULL, &packet) == SUCCESS)
 		{
 			charon->sender->send(charon->sender, packet);
 			response->destroy(response);

src/libcharon/sa/connect_manager.c

@@ -1064,7 +1064,7 @@ static void send_check(private_connect_manager_t *this, check_list_t *checklist,
 	DBG2(DBG_IKE, "send ME_CONNECTAUTH %#B", &check->auth);
 
 	packet_t *packet;
-	if (message->generate(message, NULL, NULL, &packet) == SUCCESS)
+	if (message->generate(message, NULL, &packet) == SUCCESS)
 	{
 		charon->sender->send(charon->sender, packet->clone(packet));
 

src/libcharon/sa/ike_sa.c

@@ -882,8 +882,7 @@ METHOD(ike_sa_t, generate_message, status_t,
 	this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
 	message->set_ike_sa_id(message, this->ike_sa_id);
 	return message->generate(message,
-				this->keymat->get_crypter(this->keymat, FALSE),
-				this->keymat->get_signer(this->keymat, FALSE), packet);
+				this->keymat->get_aead(this->keymat, FALSE), packet);
 }
 
 /**
@@ -1173,8 +1172,7 @@ METHOD(ike_sa_t, process_message, status_t,
 	is_request = message->get_request(message);
 
 	status = message->parse_body(message,
-								 this->keymat->get_crypter(this->keymat, TRUE),
-								 this->keymat->get_signer(this->keymat, TRUE));
+								 this->keymat->get_aead(this->keymat, TRUE));
 	if (status != SUCCESS)
 	{
 

src/libcharon/sa/keymat.c

@@ -36,24 +36,14 @@ struct private_keymat_t {
 	bool initiator;
 
 	/**
-	 * inbound signer (verify)
+	 * inbound AEAD
 	 */
-	signer_t *signer_in;
+	aead_t *aead_in;
 
 	/**
-	 * outbound signer (sign)
+	 * outbound AEAD
 	 */
-	signer_t *signer_out;
-
-	/**
-	 * inbound crypter (decrypt)
-	 */
-	crypter_t *crypter_in;
-
-	/**
-	 * outbound crypter (encrypt)
-	 */
-	crypter_t *crypter_out;
+	aead_t *aead_out;
 
 	/**
 	 * General purpose PRF
@@ -140,6 +130,99 @@ METHOD(keymat_t, create_dh, diffie_hellman_t*,
 	return lib->crypto->create_dh(lib->crypto, group);;
 }
 
+/**
+ * Derive IKE keys for a combined AEAD algorithm
+ */
+static bool derive_ike_aead(private_keymat_t *this, proposal_t *proposal,
+							prf_plus_t *prf_plus)
+{
+	return FALSE;
+}
+
+/**
+ * Derive IKE keys for traditional encryption and MAC algorithms
+ */
+static bool derive_ike_traditional(private_keymat_t *this, proposal_t *proposal,
+								   prf_plus_t *prf_plus)
+{
+	crypter_t *crypter_i, *crypter_r;
+	signer_t *signer_i, *signer_r;
+	u_int16_t alg, key_size;
+	chunk_t key;
+
+	/* SK_ai/SK_ar used for integrity protection */
+	if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
+	{
+		DBG1(DBG_IKE, "no %N selected",
+			 transform_type_names, INTEGRITY_ALGORITHM);
+		return FALSE;
+	}
+	signer_i = lib->crypto->create_signer(lib->crypto, alg);
+	signer_r = lib->crypto->create_signer(lib->crypto, alg);
+	if (signer_i == NULL || signer_r == NULL)
+	{
+		DBG1(DBG_IKE, "%N %N not supported!",
+			 transform_type_names, INTEGRITY_ALGORITHM,
+			 integrity_algorithm_names ,alg);
+		return FALSE;
+	}
+	key_size = signer_i->get_key_size(signer_i);
+
+	prf_plus->allocate_bytes(prf_plus, key_size, &key);
+	DBG4(DBG_IKE, "Sk_ai secret %B", &key);
+	signer_i->set_key(signer_i, key);
+	chunk_clear(&key);
+
+	prf_plus->allocate_bytes(prf_plus, key_size, &key);
+	DBG4(DBG_IKE, "Sk_ar secret %B", &key);
+	signer_r->set_key(signer_r, key);
+	chunk_clear(&key);
+
+	/* SK_ei/SK_er used for encryption */
+	if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &key_size))
+	{
+		DBG1(DBG_IKE, "no %N selected",
+			 transform_type_names, ENCRYPTION_ALGORITHM);
+		signer_i->destroy(signer_i);
+		signer_r->destroy(signer_r);
+		return FALSE;
+	}
+	crypter_i = lib->crypto->create_crypter(lib->crypto, alg, key_size / 8);
+	crypter_r = lib->crypto->create_crypter(lib->crypto, alg, key_size / 8);
+	if (crypter_i == NULL || crypter_r == NULL)
+	{
+		DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
+			 transform_type_names, ENCRYPTION_ALGORITHM,
+			 encryption_algorithm_names, alg, key_size);
+		signer_i->destroy(signer_i);
+		signer_r->destroy(signer_r);
+		return FALSE;
+	}
+	key_size = crypter_i->get_key_size(crypter_i);
+
+	prf_plus->allocate_bytes(prf_plus, key_size, &key);
+	DBG4(DBG_IKE, "Sk_ei secret %B", &key);
+	crypter_i->set_key(crypter_i, key);
+	chunk_clear(&key);
+
+	prf_plus->allocate_bytes(prf_plus, key_size, &key);
+	DBG4(DBG_IKE, "Sk_er secret %B", &key);
+	crypter_r->set_key(crypter_r, key);
+	chunk_clear(&key);
+
+	if (this->initiator)
+	{
+		this->aead_in = aead_create(crypter_r, signer_r);
+		this->aead_out = aead_create(crypter_i, signer_i);
+	}
+	else
+	{
+		this->aead_in = aead_create(crypter_i, signer_i);
+		this->aead_out = aead_create(crypter_r, signer_r);
+	}
+	return TRUE;
+}
+
 METHOD(keymat_t, derive_ike_keys, bool,
 	private_keymat_t *this, proposal_t *proposal, diffie_hellman_t *dh,
 	chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
@@ -147,8 +230,6 @@ METHOD(keymat_t, derive_ike_keys, bool,
 {
 	chunk_t skeyseed, key, secret, full_nonce, fixed_nonce, prf_plus_seed;
 	chunk_t spi_i, spi_r;
-	crypter_t *crypter_i, *crypter_r;
-	signer_t *signer_i, *signer_r;
 	prf_plus_t *prf_plus;
 	u_int16_t alg, key_size;
 	prf_t *rekey_prf = NULL;
@@ -251,50 +332,6 @@ METHOD(keymat_t, derive_ike_keys, bool,
 	prf_plus->allocate_bytes(prf_plus, key_size, &this->skd);
 	DBG4(DBG_IKE, "Sk_d secret %B", &this->skd);
 
-	/* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
-	if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL))
-	{
-		DBG1(DBG_IKE, "no %N selected",
-			 transform_type_names, INTEGRITY_ALGORITHM);
-		prf_plus->destroy(prf_plus);
-		DESTROY_IF(rekey_prf);
-		return FALSE;
-	}
-	signer_i = lib->crypto->create_signer(lib->crypto, alg);
-	signer_r = lib->crypto->create_signer(lib->crypto, alg);
-	if (signer_i == NULL || signer_r == NULL)
-	{
-		DBG1(DBG_IKE, "%N %N not supported!",
-			 transform_type_names, INTEGRITY_ALGORITHM,
-			 integrity_algorithm_names ,alg);
-		prf_plus->destroy(prf_plus);
-		DESTROY_IF(rekey_prf);
-		return FALSE;
-	}
-	key_size = signer_i->get_key_size(signer_i);
-
-	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	DBG4(DBG_IKE, "Sk_ai secret %B", &key);
-	signer_i->set_key(signer_i, key);
-	chunk_clear(&key);
-
-	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	DBG4(DBG_IKE, "Sk_ar secret %B", &key);
-	signer_r->set_key(signer_r, key);
-	chunk_clear(&key);
-
-	if (this->initiator)
-	{
-		this->signer_in = signer_r;
-		this->signer_out = signer_i;
-	}
-	else
-	{
-		this->signer_in = signer_i;
-		this->signer_out = signer_r;
-	}
-
-	/* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
 	if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &key_size))
 	{
 		DBG1(DBG_IKE, "no %N selected",
@@ -303,38 +340,24 @@ METHOD(keymat_t, derive_ike_keys, bool,
 		DESTROY_IF(rekey_prf);
 		return FALSE;
 	}
-	crypter_i = lib->crypto->create_crypter(lib->crypto, alg, key_size / 8);
-	crypter_r = lib->crypto->create_crypter(lib->crypto, alg, key_size / 8);
-	if (crypter_i == NULL || crypter_r == NULL)
+
+	if (encryption_algorithm_is_aead(alg))
 	{
-		DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
-			 transform_type_names, ENCRYPTION_ALGORITHM,
-			 encryption_algorithm_names, alg, key_size);
-		prf_plus->destroy(prf_plus);
-		DESTROY_IF(rekey_prf);
-		return FALSE;
-	}
-	key_size = crypter_i->get_key_size(crypter_i);
-
-	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	DBG4(DBG_IKE, "Sk_ei secret %B", &key);
-	crypter_i->set_key(crypter_i, key);
-	chunk_clear(&key);
-
-	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	DBG4(DBG_IKE, "Sk_er secret %B", &key);
-	crypter_r->set_key(crypter_r, key);
-	chunk_clear(&key);
-
-	if (this->initiator)
-	{
-		this->crypter_in = crypter_r;
-		this->crypter_out = crypter_i;
+		if (!derive_ike_aead(this, proposal, prf_plus))
+		{
+			prf_plus->destroy(prf_plus);
+			DESTROY_IF(rekey_prf);
+			return FALSE;
+		}
 	}
 	else
 	{
-		this->crypter_in = crypter_i;
-		this->crypter_out = crypter_r;
+		if (!derive_ike_traditional(this, proposal, prf_plus))
+		{
+			prf_plus->destroy(prf_plus);
+			DESTROY_IF(rekey_prf);
+			return FALSE;
+		}
 	}
 
 	/* SK_pi/SK_pr used for authentication => stored for later */
@@ -479,16 +502,10 @@ METHOD(keymat_t, get_skd, pseudo_random_function_t,
 	return this->prf_alg;
 }
 
-METHOD(keymat_t, get_signer, signer_t*,
+METHOD(keymat_t, get_aead, aead_t*,
 	private_keymat_t *this, bool in)
 {
-	return in ? this->signer_in : this->signer_out;
-}
-
-METHOD(keymat_t, get_crypter, crypter_t*,
-	private_keymat_t *this, bool in)
-{
-	return in ? this->crypter_in : this->crypter_out;
+	return in ? this->aead_in : this->aead_out;
 }
 
 METHOD(keymat_t, get_auth_octets, chunk_t,
@@ -550,10 +567,8 @@ METHOD(keymat_t, get_psk_sig, chunk_t,
 METHOD(keymat_t, destroy, void,
 	private_keymat_t *this)
 {
-	DESTROY_IF(this->signer_in);
-	DESTROY_IF(this->signer_out);
-	DESTROY_IF(this->crypter_in);
-	DESTROY_IF(this->crypter_out);
+	DESTROY_IF(this->aead_in);
+	DESTROY_IF(this->aead_out);
 	DESTROY_IF(this->prf);
 	chunk_clear(&this->skd);
 	chunk_clear(&this->skp_verify);
@@ -574,8 +589,7 @@ keymat_t *keymat_create(bool initiator)
 			.derive_ike_keys = _derive_ike_keys,
 			.derive_child_keys = _derive_child_keys,
 			.get_skd = _get_skd,
-			.get_signer = _get_signer,
-			.get_crypter = _get_crypter,
+			.get_aead = _get_aead,
 			.get_auth_octets = _get_auth_octets,
 			.get_psk_sig = _get_psk_sig,
 			.destroy = _destroy,

src/libcharon/sa/keymat.h

@@ -24,8 +24,7 @@
 #include <library.h>
 #include <utils/identification.h>
 #include <crypto/prfs/prf.h>
-#include <crypto/crypters/crypter.h>
-#include <crypto/signers/signer.h>
+#include <crypto/aead.h>
 #include <config/proposal.h>
 #include <sa/ike_sa_id.h>
 
@@ -99,21 +98,13 @@ struct keymat_t {
 	 */
 	pseudo_random_function_t (*get_skd)(keymat_t *this, chunk_t *skd);
 
-	/**
-	 * Get a signer to sign/verify IKE messages.
-	 *
-	 * @param in		TRUE for inbound (verify), FALSE for outbound (sign)
-	 * @return			signer
-	 */
-	signer_t* (*get_signer)(keymat_t *this, bool in);
-
 	/*
-	 * Get a crypter to en-/decrypt IKE messages.
+	 * Get a AEAD transform to en-/decrypt and sign/verify IKE messages.
 	 *
 	 * @param in		TRUE for inbound (decrypt), FALSE for outbound (encrypt)
 	 * @return			crypter
 	 */
-	crypter_t* (*get_crypter)(keymat_t *this, bool in);
+	aead_t* (*get_aead)(keymat_t *this, bool in);
 
 	/**
 	 * Generate octets to use for authentication procedure (RFC4306 2.15).