Subject: [Hipsec] Cipher selections

From: Robert Moskowitz <[email-masked]>
Date: Mon, 07 Dec 2009 16:27:54 -0500

Following is a bit of a rambling note....

Can we emnuerate the ciphers we will be adding/keeping in the new HIP?

First the Public Key algorithms:

RSA with key lengths of:
ECC curves and key lengths:

Do we keep DSA or drop it?  Or do we keep it for historical and flag 
that it is going away on any future revision?

Hashs:

SHA-1 for 'backwards' compatible or historical and flag that it is going 
away on any future revision?

SHA-256
Is there any alternative for HIP hash needs?  What about SHA-224?  Is 
the code smaller/faster?  What do we put in the document that will be 
coming out before the Hash compitition is finished but is light enough 
for the needs of some systems running HIP?

Diffie-Hellman Groups (is that the best way to express this?):

???

MACs:

HMAC
CMAC ??
Any other recommendation?

Do we rename the HMAC TLV to just MAC (or something else that NIST would 
approve of?) or do we have separate TLVs for each MAC supported?

HIP-Transforms:

Do we drop any?  Like Blowfish?
CCM?
Other?  GCM?  I have heard a claim the CCM is more efficient on small 
packets that GCM.  But if an implementation will be focused on GCM for 
ESP, perhaps the use of GCM for IP-Transform is desired?

All responses SHOULD reference RFC or FIPS document #, section if 
appropriate, and any IANA assignments.

I want to start adding and removing! specific text from 5201-bis.

---

From: Paul Lambert <[email-masked]>
Date: Mon, 7 Dec 2009 14:25:04 -0800

> SHA-256

Hash algorithms, like SH-256, need must be augmented to describe the actual length of the hash used in the protocol (e.g. truncated to 64bits).  So you would need to have something like - SHA-256-64

Paul
 
Paul A. Lambert | Marvell Semiconductor | +1 650-787-9141
 
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Robert Moskowitz
> Sent: Monday, December 07, 2009 1:28 PM
> To: HIP
> Subject: [Hipsec] Cipher selections
> 
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec

---

From: Oleg Ponomarev <[email-masked]>
Date: Tue, 8 Dec 2009 01:04:45 +0200 (EET)

> ECC curves and key lengths:

using the same underlying EC groups as below

> SHA-256
> Is there any alternative for HIP hash needs?  What about SHA-224?  Is the 
> code smaller/faster?  What do we put in the document that will be coming out 
> before the Hash compitition is finished but is light enough for the needs of 
> some systems running HIP?

SHA-224 is a truncated version of SHA-256 (SHA-384 -/- of SHA-512), they 
have equal number of cycles and take almost the same time.

> Diffie-Hellman Groups (is that the best way to express this?):

I think we may use 192,224,256,384&521-bit Random ECP Groups from RFC5114
(draft-ponomarev-hip-ecc-00.txt)

-- 
Regards, Oleg.