Subject: [MSEC] Comments on draft-ietf-msec-mikey-ecc-00.txt

From: "Fries, Steffen" <[email-masked]>
Date: Thu, 28 Jul 2005 15:13:51 +0200

Hi,

during the presentation of the draft draft-ietf-msec-mikey-ecc-00.txt at

the last IETF meeting, there was discussion about the patent situation 
regarding EC-MQV. 

Because of this, we suggest to add a DH method to the current draft,
which 
is (to our knowledge) free of patent issues. This DH method is very
similar 
to the method defined in RFC3830. The only difference here is that the 
signature algorithm is based on elliptic curves, to be more specific on 
ECDSA. The proposal also proceeds with one roundtrip for the key
establishing 
process of two clients A and B :

Elliptic curve Diffie Hellman  key agreement (ECDH) protected with
the ECDSA (or ECGDSA) signature scheme. This scheme proceeds as follows:

Both client A and client B are endowed with the same cryptographically
secure elliptic curve.

The system parameters are:
- an elliptic curve  E over a finite field F (of type GF(p) or GF(2^n),
  p a prime, n a positive integer).
- a point P on E generating a cyclic group of prime order q
- a hash function h
- the elliptic curve based digital signature scheme ECDSA (or ECGDSA)
  using hash function h
- a random number generator Random() generating random numbers in the
  range {1, ...,  q-1}

-  The client's individual keys and parameters are:
-  ID_A:    A's identity
-  SK_A:    A's private key
-  PK_A:    A's public key
-  Cert_A:  Certificate binding PK_A to ID_A

-  ID_B:    B's identity
-  SK_B:    B's private key
-  PK_B:    B's public key
-  Cert_B:  Certificate binding PK_B to ID_B

Client A - Initiator                   Client B -Responder

Initialization:
Rand, x:= Random()

Protocol execution:
xP:= the x-fold of curve point P
K:= xP, T, RAND, [ID_A|CERT_A], ID_B, {SP}
S:= EC(G)DSA(H(xP),SK_A)

I_MESSAGE = HDR, (K,S)
                ---------------------------->

                        Initialization:
                        Rand, y:= Random()

                        Protocol execution:
                        Verification of certificate Cert_A and
                        signature S. (if valid continue else abort)
                        yP:= the y-fold of curve point P
                        K':= yP, T, RAND, [ID_B|CERT_B], ID_A, {SP}
                        S':= EC(G)DSA(H(yP),SK_B)

                        R_MESSAGE =(K',S')
                 <----------------------------
Verification of certificate Cert_B and signature S'.
(if valid continue else abort)

TGK:= xK'                       TGK:= yK

TGK is the common key A and B agreed on in this protocol.

A similar approach using elliptic curves in TLS is described in 
draft-ietf-tls-ecc-10.txt and provides also the option to use ESDH 
with ECDSA.

Regards
	Steffen
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec