Subject: [Hipsec] Proposed new list for DIFFIE_HELLMAN

From: Robert Moskowitz <[email-masked]>
Date: Wed, 06 Jan 2010 10:15:59 -0500

Proposed new list for DIFFIE_HELLMAN:

       Group Value  Source
       Reserved 0
       384-bit group 1
       OAKLEY well-known group 1 2      Appendex E
       1536-bit MODP group 3      RFC3526
       3072-bit MODP group 4      RFC3526
       6144-bit MODP group 5      RFC3526
       8192-bit MODP group                                     6      
RFC3526
       1024-bit MODP Group with 160-bit Prime Order Subgroup   7      
RFC5114
       2048-bit MODP Group with 224-bit Prime Order Subgroup   8      
RFC5114
       2048-bit MODP Group with 256-bit Prime Order Subgroup   9      
RFC5114
       192-bit Random ECP Group                                10     
RFC5114
       224-bit Random ECP Group                                11     
RFC5114
       256-bit Random ECP Group                                12     
RFC5114
       384-bit Random ECP Group                                13     
RFC5114
       521-bit Random ECP Group                                14     
RFC5114

Currently Groups 1 and 3 are MUST implement.  How does Group 1 compare 
to 13?  Can we drop 1 and Appendix D and just make 13 and 3 MUST?  
Should 7 replace 3 for the MUST?

Note that 12-14 were first defined in 4753, which is referenced in 5114, 
so I just want to keep all the ECP's together...

---

From: Oleg Ponomarev <[email-masked]>
Date: Thu, 7 Jan 2010 15:18:37 +0200 (EET)

Hi! On Wed, 6 Jan 2010, Robert Moskowitz wrote:

>     192-bit Random ECP Group                                10    RFC5114
>     224-bit Random ECP Group                                11    RFC5114
>     256-bit Random ECP Group                                12    RFC5114
>     384-bit Random ECP Group                                13    RFC5114
>     521-bit Random ECP Group                                14    RFC5114

> How does Group 1 compare to 13?

ECDH-384 is equivalent to DH-7680

> Can we drop 1 and Appendix D and just make 13 and 3 MUST?

I think 13 is too long for a MUST. ECC-224 (~RSA2048) should be good 
enough until 2030 according to NIST recommendations. ECDH384 takes more 
than triple time of ECDH224.

-- 
Regards, Oleg.

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 07 Jan 2010 12:12:37 -0500

> ECDH-384 is equivalent to DH-7680

OK.  I see, and I read Appendix D of 5201 and looked some more at 5114.  
Given the 192 ECP group, is there any value in keeping our cheap, 
breakable 384 DH?
> enough until 2030 according to NIST recommendations. ECDH384 takes 
> more than triple time of ECDH224.
>

So what would be the MUST implement?  3 and 12?

And any hums on dropping 1?

---

From: Miika Komu <[email-masked]>
Date: Thu, 07 Jan 2010 19:48:02 +0200

Robert Moskowitz wrote:

Hi,

> And any hums on dropping 1?

I recall that 1 was there for low-end devices.

---

From: Tobias Heer <[email-masked]>
Date: Thu, 07 Jan 2010 18:54:58 +0100

Am 07.01.2010 um 18:48 schrieb Miika Komu:

>> OK.  I see, and I read Appendix D of 5201 and looked some more at 5114.  Given the 192 ECP group, is there any value in keeping our cheap, breakable 384 DH?
>>> 
>>> I think 13 is too long for a MUST. ECC-224 (~RSA2048) should be good enough until 2030 according to NIST recommendations. ECDH384 takes more than triple time of ECDH224.
>>> 

Low-end devices should be able to handle elliptic curve crypto.
I agree with dropping 1 if there are no IPR problems for 12 or 13 (whatever becomes the next MUST).

Tobias

> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec

--  

Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group 
RWTH Aachen University, Germany
tel: +49 241 80 207 76
web: http://ds.cs.rwth-aachen.de/members/heer

---

From: Oleg Ponomarev <[email-masked]>
Date: Fri, 8 Jan 2010 17:37:33 +0200 (EET)

>>>      8192-bit MODP group                                     6      RFC3526
>>>      1024-bit MODP Group with 160-bit Prime Order Subgroup   7      RFC5114
>>>      2048-bit MODP Group with 224-bit Prime Order Subgroup   8      RFC5114
>>>      2048-bit MODP Group with 256-bit Prime Order Subgroup   9      RFC5114

BTW, I would suggest to add 2048-bit and 4096-bit MODP Groups from RFC3526

> So what would be the MUST implement?  3 and 12?

MUST implement 3 and 9, SHOULD 11  and MAY the rest, IMHO.

-- 
Regards, Oleg.