Subject: [Ipsec] RE: Last Call: 'IKE and IKEv2 Authentication Using ECDSA' to Proposed Standard

From: Chinh Nguyen <[email-masked]>
Date: Thu, 20 Apr 2006 14:50:26 -0400

Some comments on last call:

1. "The IANA-assigned attribute number for authentication using generic
ECDSA is 8 (see [IANA]), but the parameters and associated hash
functions are not specified."

If we are going by standards such as X9.62, then hash algorithm is specified.
SHA-1 is the hash algorithm for ECDSA (X9.62 section 5.3.1).

As to the EC parameters, you can argue (or clarify) that it can be retrieved
from your public/private EC key.

As such, the current chart for IKEv1 could look like this:

                 Digital           Diffie-
     IANA       Signature          Hellman             Hash
     Value      Algorithm           Group            Function
     -----      ---------        ------------      -------------
       8          ECDSA          any               SHA-1
       9          ECDSA          P-256   [19]      SHA-256   [4]
      10          ECDSA          P-384   [20]      SHA-384   [5]
      11          ECDSA          P-512   [21]      SHA-512   [6]

2. "the signature payload SHALL contain an encoding of the computed signature
consisting of the concatenation of a pair of integers s and t."

Pasi Eronen has suggested DER-encoding of ECDSA-Sig-Value. It is interesting to
note that this was the language in earlier drafts (e.g.
draft-ietf-ipsec-ike-auth-ecdsa-02.txt)

The downside is (DER) ASN.1 parsing hairiness although it's true that you don't
need a full-blown ASN.1 parser. You can simplify by looking for the byte
sequence that would represent ECDSA-Sig-Value.

Concatenation of "r" and "s" (R|S), in the integer-to-octet-string sense, is
certainly simpler. However, it must be clarified that the size of r of s in
bytes must be the same as q, the group order. For example, some 160-bit curve
has 161-bit q and therefore r and s are actually 21 bytes long and not 20 bytes.

The easiest way to state this would be to specify that r and s must be the same
length and therefore r and/or s must be 0-padded if necessary.

3. "If the signature (s,t) were the one appearing in the authentication
   payload, then the payload would be as follows.

 00000048 00090000 CB28E099 9B9C7715 FD0A80D8 E47A7707 9716CBBF 917DD72E
 97566EA1 C066957C 86FA3BB4 E26CAD5B F90B7F81 899256CE 7594BB1E A0C89212
 748BFF3B 3D5B0315"

All test vectors in section 6 have this format. There are 2 issues:

First, this looks an IKEv2 Authentication Payload? The Signature Payload in
IKEv1 would not have the authentication method and reserved field as above
(i.e., "00090000"). This should be clarified or both types of payload should
appear in section 6.

If this is in fact an IKEv1 signature payload, then the signature would seem to
be (auth method in 16-bit hex|0x0000|r|s)?

Second, if it is an IKEv2 Auth Payload, the auth method field occupies only 1
octet. So the above example should be "09000000".

Regards,

Chinh

-- 
http://www.certicom.com/

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Vipul Gupta <[email-masked]>
Date: Thu, 20 Apr 2006 12:24:07 -0700

> draft-ietf-ipsec-ike-auth-ecdsa-02.txt)

In the TLS working group, we recently went through a similar
discussion for the "ECC Cipher Suites in TLS" draft. The
wording in the draft suggested *not* using DER encoding but
it turned out that most implementers felt that DER encoding
was easier to accommodate since they already needed code to
generate/parse DER encoded signatures to deal with ECC
certificates. In the end, we sought and received permission
from the WG chairs and the Security ADs to change the
wording in the draft to do DER encoding. This also makes
things consistent with plain DSA and is being implemented
in the ECC/TLS implementations from Certicom, OpenSSL,
Microsoft, Red Hat and Sun.

See:

http://www1.ietf.org/mail-archive/web/tls/current/msg00555.html
http://dev.experimentalstuff.com:8082/

Just something to consider.

vipul