IPFYI
RFC 3602 Proposed Standard

The AES-CBC Cipher Algorithm and Its Use with IPsec

S. Frankel, R. Glenn, S. Kelly · 2003-09

Abstract

This document describes the use of the Advanced Encryption Standard (AES) Cipher Algorithm in CBC mode with an explicit Initialization Vector (IV) as a confidentiality mechanism within the context of the IPsec Encapsulating Security Payload (ESP). AES-CBC with 128-bit, 192-bit, and 256-bit key lengths is specified.

Why This RFC Matters

RFC 3602 brought AES into the IPsec ecosystem at a time when DES and 3DES were the dominant cipher choices, providing a NIST-standardized algorithm with significantly better security-to-performance characteristics. The CBC mode specification with an explicit IV prevents certain block-reuse attacks while remaining straightforward to implement in hardware and software. This RFC effectively accelerated the deprecation of weaker ciphers in VPN deployments and is still referenced in modern IKEv2/IPsec implementations that list AES-CBC as a supported transform.

관련 프로토콜

IPSEC ESP IKEV2

관련 용어

ipsec encryption vpn certificate firewall

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS) RFC 6454 The Web Origin Concept