XOR M[n] with E[n-1] and Key K2, then encrypt the
result with Key K1, yielding E[n].
(b) If the blocksize of M[n] is less than 128 bits:
(i) Pad M[n] with a single “1” bit, followed by the num-
ber of “0” bits (possibly none) required to increase
M[n]'s blocksize to 128 bits.
(ii) XOR M[n] with E[n-1] and Key K3, then encrypt the
result with Key K1, yielding E[n].
(5) The authenticator value is the leftmost 96 bits of the 128-bit E[n].
NOTE1: If M is the empty string, pad and encrypt as in (4b) to create M[1] and E[1]. This
will never be the case for ESP or AH, but is included for completeness sake.
NOTE2: [CBC-MAC-2] defines K1 as follows:
K1 = Constant1A encrypted with Key K | Constant1B encrypted with Key K.
However, the second encryption operation is only needed for AES-XCBC-MAC with keys
greater than 128 bits; thus, it is not included in the definition of AES-XCBC-MAC-96.
AES-XCBC-MAC-96 verification is performed as follows:
Upon receipt of the AES-XCBC-MAC-96 authenticator, the entire 128-bit value is computed
and the first 96 bits are compared to the value stored in the authenticator field. Keying
Material AES-XCBC-MAC-96 is a secret key algorithm. For use with either ESP or AH a fixed
key length of 128-bits MUST be supported. Key lengths other than 128-bits MUST NOT be
supported (i.e. only 128-bit keys are to be used by AES-XCBC-MAC-96).
5.6.4.2
Hash Core Algorithms
SHA1/SHA256 Core
The SHA-1/SHA-256 calculation core performs the secure hash algorithm on N x 512-bit
blocks (N < 2k) and produces a single 160-bit/256-bit hash result, CVN+1, using the 512-
bit input blocks and CVN, the previous hash result.
To calculate the hash value of an input message MCALC = Min + PadSHA-1 (PadSHA-1
includes lengthSHA-1), which by definition must be an integral number of 512-bit blocks
{B0, B1, B2, …, BL}, the following sequence is performed:
1. To indicate the start of a new hash calculation, set the CV value to the SHA-1/
SHA-256 initial value from a previously calculated partial result.
2. Write the first block to the calculation core. (16 x 32-bit words)
3. Wait for the hash value calculation to complete.
820x – Data Sheet, DS-0157-D
Page119
Hifn Confidential
EXAR [ EXAR CORPORATION ]
