ipsec, esp: Which key is used to generate the HMAC

Short Question: Are the keys for the ICV calculation and the encryption the same in IPSEC/ESP? Or do there exist two keys in the SA?

Long Question: Before a new IPSEC-ESP connection is established, IKEv2 is used to start a new session. This involves also a DH key agreement. This key is than stored in the IKE-SA.

Once the session is established, ESP uses the key in the IKE-SA's for the message encryption/decryption. After the payload was encrypted, the ICV is calculated by a HMAC calculation. But this HMAC requires also a key. I have already searched for a few hours without being successful.

Is it the same key that is used for encryption, is it calculated out of the encryption key or are there two keys stored in the SA?

I wasn't able to find the answer in rfc4303 (ESP), rfc2104 (HMAC) or rfc7296 (IKEv2).

And there are not many books about IPsec out there.

Are the keys for the ICV calculation and the encryption the same in IPSEC/ESP? Or do there exist two keys in the SA?

No, the keys are not the same. Yes, there do exist two keys in the SA (at least, for SAs that have separate encryption and integrity transforms - not all do).

You do derive both the encryption and the HMAC key at the same time, from the same secret, but they are not the same (that'd be bad key hygene). Instead they are derived from the same secret (and also you generate the keys for the SA protecting traffic flowing in the opposite direction at the same time).

That is, IKE generates a long random-looking string (which it refers to as KEYMAT); if the encryption key is n bits and the integrity (ICV) key is m bits (and AH is not being used), then at least 2n+2m bits of KEYMAT are generated, and then:

• The first n bits is used as the initiator-to-responder encryption key (that is, used to protect traffic flowing from the initiator to the responder)
• The next m bits is used as the initiator-to-responder integrity key
• The next n bits is used as the responder-to-initiator encryption key
• The next m bits is used as the responder-to-initiator integrity key

To see the text of the standard, see section 2.17 of RFC7296:

In any case, keying material for each Child SA MUST be taken from the expanded KEYMAT using the following rules:

All keys for SAs carrying data from the initiator to the responder are taken before SAs going from the responder to the initiator.

If multiple IPsec protocols are negotiated, keying material for each Child SA is taken in the order in which the protocol headers will appear in the encapsulated packet.

If an IPsec protocol requires multiple keys, the order in which they are taken from the SA's keying material needs to be described in the protocol's specification. For ESP and AH, [IPSECARCH] defines the order, namely: the encryption key (if any) MUST be taken from the first bits and the integrity key (if any) MUST be taken from the remaining bits.

The HMAC key is the 'integrity key'