Title

  Test IKEv2.EN.I.1.2.5.2: Receipt of cryptographically valid message on the new SA
  Part A: (BASIC)

Purpose

  To verify an IKEv2 device properly handles the CREATE_CHILD_SA Exchanges to
  generate new CHILD_SAs.

References

  * [RFC 4306] - Sections 1.1.2,1.2 and 3.3.2
  * [RFC 4307] - Sections 3
  * [RFC 4718] - Sections 4.1

Procedure

   NUT                  TN1
(End-Node)           (End-Node)
    |                    |
    |------------------->| IKE_SA_INIT request (HDR, SAi1, KEi, Ni)
    |                    | (Judgement #1)
    |<-------------------| IKE_SA_INIT Response (HDR, SAr1, KEr, Nr)
    |                    | (Packet #1)
    |                    |
    |------------------->| IKE_AUTH request (HDR, SK {IDi, AUTH, N, SAi2, TSi, TSr})
    |                    | (Judgement #2)
    |<-------------------| IKE_AUTH Response (HDR, SK {IDr, AUTH, N, SAr2, TSi, TSr})
    |                    | (Packet #2)
    |                    |
    |<-------------------| IPsec {TCP-SYN}
    |                    | (Packet #3)          
    |------------------->| IPsec {TCP-RST}    
    |                    | (Judgement #3)         
    |                    |
    |<-------------------| IPsec {Echo Request}
    |                    | (Packet #4)          
    |----------X         | IPsec {Echo Reply}    
    |                    | (Judgement #4)         
    |                    |   
    |------------------->| CREATE_CHILD_SA request (HDR, SK {N, SA, Ni, TSi, TSr})
    |                    | (Judgement #5)
    |<-------------------| CREATE_CHILD_SA response (HDR, SK {N, SA, Nr, TSi, TSr})
    |                    | (Packet #5)
    |                    |
    |<-------------------| IPsec {TCP-SYN}
    |                    | (Packet #6)          
    |------------------->| IPsec {TCP-RST}    
    |                    | (Judgement #6)         
    |                    |
    |<-------------------| IPsec {Echo Request}
    |                    | (Packet #7)          
    |------------------->| IPsec {Echo Reply}    
    |                    | (Judgement #7)         
    |                    |
    V                    V
 N: USE_TRANSPORT_MODE

Packet #1 See Common Packet #2

Packet #2 See below

Packet #3 See below

Packet #4 See Common Packet #19

Packet #5 See below

Packet #6 See below

Packet #7 See Common Packet #19

Packet #2: IKE_AUTH response

IPv6 Header Same as the Common Packet #4

UDP Header Same as the Common Packet #4

IKEv2 Header Same as the Common Packet #4

E Payload Same as the Common Packet #4

IDi Payload Same as the Common Packet #4

AUTH Payload Same as the Common Packet #4

N Payload Same as the Common Packet #4

SA Payload Same as the Common Packet #4

TSi Payload Other fields are same as the Common Packet #4

Traffic Selectors See below

TSr Payload Other fields are same as the Common Packet #4

Traffic Selectors See below

TSi Payload Traffic Selector TS Type 8 (IPV6_ADDR_RANGE)

IP Protocol ID 6 (TCP)

Selector Length 40

Start Port 0

End Port 65535

Starting Address NUT's Global Address on Link A

Ending Address NUT's Global Address on Link A

TSr Payload Traffic Selector TS Type 8 (IPV6_ADDR_RANGE)

IP Protocol ID 6 (TCP)

Selector Length 40

Start Port 0

End Port 65535

Starting Address TN1's Global Address on Link X

Ending Address TN1's Global Address on Link X

Packet #3: TCP SYN packet

IPv6 Header Source Address TN1's Global Address on Link X

Destination Address NUT's Global Address on Link A

ESP Security Parameter Index CHILD_SA's SPI value used by this message

Sequence Number The value incremented the previous encrypted packet's Sequence Number by one.

Payload Data Subsequent data encrypted by underlying encryption algorithm

Padding Any value which to be a multiple of the encryption block size

Pad Length The length of the Padding field

Next Header 6 (TCP)

Integrity Check Value The checksum must be valid by calculation according to the manner described in RFC.

TCP Header Source Port 30000

Destination Port 30000

Flags SYN (0x02)

Packet #5: CREATE_CHILD_SA response

IPv6 Header Same as the Common Packet #8

UDP Header Same as the Common Packet #8

IKEv2 Header Same as the Common Packet #8

E Payload Same as the Common Packet #8

IDi Payload Same as the Common Packet #8

AUTH Payload Same as the Common Packet #8

N Payload Same as the Common Packet #8

SA Payload Same as the Common Packet #8

TSi Payload Other fields are same as the Common Packet #8

Traffic Selectors See below

TSr Payload Other fields are same as the Common Packet #8

Traffic Selectors See below

TSi Payload Traffic Selector TS Type 8 (IPV6_ADDR_RANGE)

IP Protocol ID 58 (IPV6-ICMP)

Selector Length 40

Start Port 0

End Port 65535

Starting Address NUT's Global Address on Link X

Ending Address NUT's Global Address on Link X

TSr Payload Traffic Selector TS Type 8 (IPV6_ADDR_RANGE)

IP Protocol ID 58 (IPV6-ICMP)

Selector Length 40

Start Port 0

End Port 65535

Starting Address TN1's Global Address on Link A

Ending Address TN1's Global Address on Link A

Packet #6: TCP SYN packet

IPv6 Header Source Address TN1's Global Address on Link X

Destination Address NUT's Global Address on Link A

ESP Security Parameter Index CHILD_SA's SPI value used by this message

Sequence Number The value incremented the previous encrypted packet's Sequence Number by one.

Payload Data Subsequent data encrypted by underlying encryption algorithm

Padding Any value which to be a multiple of the encryption block size

Pad Length The length of the Padding field

Next Header 6 (TCP)

Integrity Check Value The checksum must be valid by calculation according to the manner described in RFC.

TCP Header Source Port 30000

Destination Port 30000

Flags SYN (0x02)

  Part A: (BASIC)
       1. NUT starts to negotiate with TN1 by sending IKE_SA_INIT request.
       2. Observe the messages transmitted on Link A.
       3. TN1 responds with an IKE_SA_INIT response to the NUT.
       4. Observe the messages transmitted on Link A.
       5. After reception of IKE_AUTH request from the NUT, TN1 responds with an IKE_AUTH
          response to the NUT.
       6. TN1 transmits a TCP-SYN packet with IPsec ESP using corresponding algorithms to closed
          port 30000 on NUT.
       7. Observe the messages transmitted on Link A.
       8. TN1 transmits an Echo Request with IPsec ESP using corresponding algorithms to NUT.
       9. Observe the messages transmitted on Link A.
      10. NUT starts to negotiate new CHILD_SA with TN1 by sending CREATE_CHILD_SA
          request.
      11. Observe the messages transmitted on Link A.
      12. After a reception of CREATE_CHILD_SA request from the NUT, TN1 responds with a
           CREATE_CHILD_SA response to the NUT.
      13. TN1 transmits a TCP-SYN packet with IPsec ESP using corresponding algorithms to closed
          port 30000 on NUT.
      14. Observe the messages transmitted on Link A.
      15. TN1 transmits an Echo Request with IPsec ESP using corresponding algorithms to NUT.
      16. Observe the messages transmitted on Link A.

Observable Result

  Part A
    Step 2: Judgment #1
      The NUT transmits an IKE_SA_INIT request including "ENCR_3DES",
      "PRF_HMAC_SHA1", "AUTH_HMAC_SHA1_96" and "D-H group 2" as proposed
      algorithms.

    Step 4: Judgment #2
      The NUT transmits an IKE_AUTH request including "ENCR_3DES",
      "AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as proposed algorithms.
  
    Step 7: Judgment #3
      The NUT transmits a TCP-RST packet with IPsec ESP using corresponding algorithms.

    Step 9: Judgment #4
      The NUT never transmits an Echo Reply with IPsec ESP using corresponding algorithms.
   
    Step 11: Judgment #5
      The NUT transmits a CREATE_CHILD_SA request including including "ENCR_3DES",
      "AUTH_HMAC_SHA1_96" and "No Extended Sequence Numbers" as proposed algorithms.
  
    Step 14: Judgment #6
      The NUT transmits a TCP-RST packet with IPsec ESP using corresponding algorithms.
  
    Step 16: Judgment #7
      The NUT transmits an Echo Reply with IPsec ESP using corresponding algorithms.

Possible Problems

  * If the NUT uses TCP port 30000 for other applications, the TN1 transmits TCP-SYN
    packets to other closed TCP port on the NUT.

`Packet #1`	`See Common Packet #2`
`Packet #2`	`See below`
`Packet #3`	`See below`
`Packet #4`	`See Common Packet #19`
`Packet #5`	`See below`
`Packet #6`	`See below`
`Packet #7`	`See Common Packet #19`

IPv6 Header	Same as the Common Packet #4
UDP Header	Same as the Common Packet #4
IKEv2 Header	Same as the Common Packet #4
E Payload	Same as the Common Packet #4
IDi Payload	Same as the Common Packet #4
AUTH Payload	Same as the Common Packet #4
N Payload	Same as the Common Packet #4
SA Payload	Same as the Common Packet #4
TSi Payload	Other fields are same as the Common Packet #4
	Traffic Selectors	See below
TSr Payload	Other fields are same as the Common Packet #4
	Traffic Selectors	See below

TSi Payload	Traffic Selector	TS Type	8 (IPV6_ADDR_RANGE)
		IP Protocol ID	6 (TCP)
		Selector Length	40
		Start Port	0
		End Port	65535
		Starting Address	NUT's Global Address on Link A
		Ending Address	NUT's Global Address on Link A

IPv6 Header	Source Address	TN1's Global Address on Link X
IPv6 Header	Destination Address	NUT's Global Address on Link A
ESP	Security Parameter Index	CHILD_SA's SPI value used by this message
	Sequence Number	The value incremented the previous encrypted packet's Sequence Number by one.
	Payload Data	Subsequent data encrypted by underlying encryption algorithm
	Padding	Any value which to be a multiple of the encryption block size
	Pad Length	The length of the Padding field
	Next Header	6 (TCP)
	Integrity Check Value	The checksum must be valid by calculation according to the manner described in RFC.
TCP Header	Source Port	30000
	Destination Port	30000
	Flags	SYN (0x02)

IPv6 Header	Same as the Common Packet #8
UDP Header	Same as the Common Packet #8
IKEv2 Header	Same as the Common Packet #8
E Payload	Same as the Common Packet #8
IDi Payload	Same as the Common Packet #8
AUTH Payload	Same as the Common Packet #8
N Payload	Same as the Common Packet #8
SA Payload	Same as the Common Packet #8
TSi Payload	Other fields are same as the Common Packet #8
	Traffic Selectors	See below
TSr Payload	Other fields are same as the Common Packet #8
	Traffic Selectors	See below