IKEv2 Support for Anti-Replay Status Notification

Introduction IPsec Authentication Header (AH) and Encapsulating Security Payload (ESP) are used to provide security for IP communications. Both AH and ESP support the anti-replay function to prevent an attacker from resending the packets received by the IPsec peer before. Each IPsec packet is sent with a unique sequence number, which the IPsec receiver checks to see whether the sequence number is duplicated. RFC 4302 and RFC 4303 specify the details of sequence number generation and verification. When anti-replay is enabled on the receiver, the sender must monitor the sequence number counter and increment the counter with every message sent. The sender must ensure that the counter does not cycle, and trigger the creation and use of a new IPsec SA before the counter is about to cycle. When anti-replay is disabled on the receiver, the sender does not need to monitor or reset the counter. The sender only increments the counter and rolls it over back to zero when it reaches the maximum value. It is specified in both RFC 4302 and RFC 4303 that, during SA establishment, IPsec implementation should notify the peer if it will not provide anti-replay protection, to avoid having the peer do unnecessary sequence number monitoring and SA setup. However, currently, IKEv2 does not have the notification of anti-replay status when negotiating the creation of an IPsec SA. As a result, IPsec implementations must always assume that the peer has anti-replay enabled. Even though anti-replay is disabled on both ends, they still have to monitor the sequence numbers. This document adds a notification in IKEv2 to inform the peers of their own anti-replay status when creating the IPsec SAs, which can finally avoid unnecessary sequence number monitoring.

Problem Statement When anti-replay is enabled on the peer, the IPsec implementation needs to monitor the sequence number of outbound packets, and trigger a rekey to generate and use a new Child SA when the sequence number counter is about to cycle. In high-performance scenarios, high-speed traffic causes the 32-bit sequence number to be consumed quickly, resulting in frequent rekeying of Child SAs. For this reason, IPsec defines the Extended Sequence Number (ESN) function, extending the available space for sequence numbers from 32 to 64 bits. Although ESN is good to avoid the sequence number running out in a short period, there is a prerequisite for using ESN - RFC 4302 and RFC 4303 both require ESN to be used in conjunction with the anti-replay function. That is, ESN can only be used if the anti-replay feature is enabled. In the high-performance scenario, operators may choose to disable the anti-replay function for the considerations of QoS, performance, and others. For example, the high-level QoS packets arriving first may cause a large number of low-level QoS packets being dropped, when the disordered packets exceed the window size of anti-replay. Disabling anti-replay brings a new problem: IPsec peers cannot successfully negotiate using ESN. The final result is that neither peer of IPsec enables anti-replay, but neither can use ESN, leaving the Child SAs forced to rekey frequently due to the rapid exhaustion of the 32-bit sequence number. The solution to this problem can be approached in two ways. One option is to support the continued use of the ESN when anti-replay is disabled. Because IPsec packets carry only the low-order 32 bits of the sequence number, the ESN has a need for the receiver to manage the anti-replay window in order to determine the correct value for the high-order 32 bits. To use ESN when anti-replay is disabled, the IPsec implementation needs to create and maintain a separate window for ESN as well. The other option is to add a notification of anti-replay status in IKEv2. Section 3.4.3 of both RFC 4302 and RFC 4303 specify that the IPsec receiver should notify the sender during SA establishment that the receiver will not provide anti-replay protection. Adding the anti-replay status notification in IKEv2 can fulfill this requirement. When anti-replay is disabled on both peers, neither peer needs to monitor the sequence number counter, thus avoiding frequent rekey of Child SAs. Although the first option could support using ESN when anti-replay is enabled at one peer and disabled at the other, this would require an update to RFC 4302 and RFC 4303. Therefore, this document considers the second option, given that it is only an extension of IKEv2 to fulfill a requirement already defined in RFC 4302 and RFC 4303.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Notifying the Anti-replay Status When creating a Child SA, the ANTI_REPLAY_STATUS notify payload can be used by the initiator and the responder to inform each other of their own anti-replay status (enabled or disabled) regarding this SA. The initiator includes the ANTI_REPLAY_STATUS notify payload in the IKE_AUTH exchange request for creating the initial Child SA or the CREATE_CHILD_SA exchange request for creating the subsequent Child SAs. A responder that does not support the anti-replay status notification processes the request as normal, and does not include the new Notify in the response. As per regular IKEv2 processing, a responder that does not recognize this new Notify, MUST ignore the notify. As required in RFC 4302 and RFC 4303, this responder should assume the anti-replay is enabled in the initiator. The absence of the Notify in the response indicates to the initiator that the responder doesn't support the anti-replay status notification. The initiator continues the IKEv2 negotiation as usual, and also assumes the anti-replay is enabled in the responder. A responder that supports the anti-replay status notification can understand whether the initiator provides the anti-replay protection for this Child SA, and includes the ANTI_REPLAY_STATUS notify payload in the response to inform its anti-replay status about this Child SA. The IKE_AUTH message exchange in this case is shown below: <-- HDR, SK {IDr, [CERT,] AUTH, SAr2, TSi, TSr, N(ANTI_REPLAY_STATUS)} ]]> The CREATE_CHILD_SA message exchange in this case is shown below: <-- HDR, SK {SA, Nr, [KEr,] TSi, TSr, N(ANTI_REPLAY_STATUS)} ]]> After the Child SA is successfully established and the initiator and responder mutually notify each other of their own anti-replay status, the IPsec implementation can choose not to monitor the sequence number counter if the peer's anti-replay is disabled.

ANTI_REPLAY_STATUS Notify Payload Format The ANTI_REPLAY_STATUS Notify Message type notification is used by the initiator and responder to indicate their own anti-replay status to each other when creating the Child SAs.

Protocol ID (1 octet) - this field MUST contain either (2) to indicate AH or (3) to indicate ESP.
SPI Size (1 octet) - MUST be 0.
Notify Message Type (2 octets) - MUST be set to the value TBD1.
Status (4 octets) - this field MUST be 0 to indicate the anti-replay is enabled or 1 to indicate the anti-replay is disabled.

The Critical bit MUST be 0. A non-zero value MUST be ignored.

IANA Considerations This document defines a new Notify Message Type in the "IKEv2 Notify Message Types - Status Types" registry. IANA is requested to assign the codepoint in this registry.

Security Considerations TBD

Acknowledgments TBD