Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as
SKEYSEED = prf(Ni | Nr, g^ir)
In other words, we invoke a pseudorandom function with the concatenation of the initiator and receiver nonces (that are sent in the clear) as the secret, and the Diffie-Hellman shared secret g^ir as the seed.
What is the rationale for this? Shouldn't the arguments for prf be reversed so that the secret is actually, well, secret?
The reason why the nonces are used as key is that there are some legacy PRFs, RFC 7296 mentions two, AES-XCBC-PRF-128 and AES-CMAC-PRF-128, that use a fixed key length (128-bit in this case, so only 64 bits of each nonce are used). Any DH key exchange that produces a longer shared secret would be rendered ineffective if its output was used as key with such PRFs.
So the nonces, which must be long enough to serve as half the key for any negotiated PRF (at least 128-bit each, most IKE implementations currently use 256 bits), are used instead to initialize the PRF and the DH shared secret as variable length seed to derive pseudorandom output from it.
