Subject: [Hipsec] 5201bis -- Public key algorithms and key sizes

From: Robert Moskowitz <[email-masked]>
Date: Thu, 08 Apr 2010 16:59:03 -0400

It is our plan to add ECC as a PK algorithm in 5201-bis.  My proposal is 
to use:

http://www.ietf.org/id/draft-mcgrew-fundamental-ecc-02.txt

All of the math in this ID is pre-94.  The ID makes no IPR claims but 
the implication is there of unemcumbered ECC.  Problem is there is no 
standard libraries for the ID.  First thing, is naming  :)  What might 
we call curves from this draft to use in 5201bis?

Aside from that P-256, P-384, and P-512 are recommended sizes based on 
RFC 4753.  Do we include P-384?

Host-ID does not enumerate key size, nor does 5201 recommend a MUST key 
size for interoperability (at least it is not clearly stated).  I 
contend that we recommend 2048 for RSA/DSA and for anything stronger, ECC.

Any point for RSA 1024?  It does not match strength with the other 
crypto components.

Diffie-Hellman is all over the place with key sizes:

       384-bit group                    1
       OAKLEY well-known group 1        2
       1536-bit MODP group              3
       3072-bit MODP group              4
       6144-bit MODP group              5
       8192-bit MODP group              6

I am not finding reference of DH MODP group size to strength.  I would 
think we would limit MODP key size to match RSA/DSA.  For ECDH again 
256, 384 (maybe depending on question above) and 512.

Comments?

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 09 Apr 2010 08:56:41 -0400

On 04/08/2010 04:59 PM, Robert Moskowitz wrote:
> It is our plan to add ECC as a PK algorithm in 5201-bis. My proposal 
> is to use:
>
> standard libraries for the ID. 

I would like the HIP developers to look this ID over to see what it 
would take to implement. I am not aware of any code in standard 
libraries; I have asked Dave McGrew about this.

> First thing, is naming :) What might we call curves from this draft to 
> use in 5201bis?
>
> Host-ID does not enumerate key size, nor does 5201 recommend a MUST 
> key size for interoperability (at least it is not clearly stated). I 
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec
>

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 09 Apr 2010 09:22:04 -0400

On 04/08/2010 04:59 PM, Robert Moskowitz wrote:
> standard libraries for the ID. First thing, is naming :) What might we 
> call curves from this draft to use in 5201bis?

Would putting a lower case 'f' in front of all the 'standard' ECC names 
be enough of a name designation? So you would have fECC, fP-256, and fECDH?