Subject: [Ipsec] Last Call: 'IKE and IKEv2 Authentication Using ECDSA' to Proposed Standard

From: The IESG <[email-masked]> (by way of Paul Hoffman)
Date: Wed, 5 Apr 2006 11:58:37 -0700

The IESG has received a request from an individual submitter to consider the
following document:

- 'IKE and IKEv2 Authentication Using ECDSA'
    <draft-ietf-ipsec-ike-auth-ecdsa-05.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action.  Please send any comments to the
[email-masked] or [email-masked] mailing lists by 2006-05-03.

The file can be obtained via
http://www.ietf.org/internet-drafts/draft-ietf-ipsec-ike-auth-ecdsa-05.txt

Also, this IPR disclosure may be of inerest
https://datatracker.ietf.org/public/ipr_detail_show.cgi?ipr_id=695

_______________________________________________
IETF-Announce mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf-announce

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 6 Apr 2006 16:54:06 +0300

>     <draft-ietf-ipsec-ike-auth-ecdsa-05.txt> as a Proposed Standard

The draft-ietf-ipsec-ike-auth-ecdsa-05.txt claims in section "3.
Specifying ECDSA within IKE and IKEv2" that there is IANA allocated
number for ECDSA, but that is not true for IKEv2. There is IKEv1
number allocated for it, but the IKEv2 registry
(http://www.iana.org/assignments/ikev2-parameters) does not have any
number allocated for ECDSA.

Note, that IKEv1 and IKEv2 registries are separate, and numbers needs
to be allocated from both in case it is required to be used with both
versions.

The correct registry to allocate that number from the IKEv2 registries
is the "IKEv2 Authentication Method" registry, and the numbers in that
registry are not same as the ones in the IKEv1 "IPSEC Authentication
Methods" registry.

I am not sure wheter I understand the table listing the IKEv1 IANA
registry value, Diffie-Hellman groups and Hash functions in section 3.
Is it so that that group and that hash function is used to calculate
the signature itself, or is it so that same groups must also be used
in the IKE (i.e Diffie-Hellman group of the IKE and hash function used
in the IKE)?

>From the later paragraphs it seems that those Diffie-Hellman groups
and Hash functions are only used when generating and verifying the
signature, and the IKE itself can use different Diffie-Hellman group
and different hash function. I think there should be some more text
explaining this fact, and the numbers in the brackets refering to the
IKEv1 allocated IANA identifiers should be removed, as they simply
confuse reader.

As I explained earlier IKEv2 has separate registry for those things
too, and IKEv2 do not even have hash function registry at all (it has
registries for Pseudo-random Function and for Integrity Algorithms,
but not for hash functions).

The IANA Considerations section is quite vague which registries should
be updated, i.e. it does not for example list at all the actual name
to put to the registry and does not list IKEv1 and IKEv2 registries
separately.

The test vectors assume that number 9, 10, are 11, are going to be
allocated from the IKEv2 registries too for those, but I think it
would be much more logical to allocate next free numbers i.e. 4, 5,
and 6. Actually it would be much better not to refere those methods as
numbers at all but give them names, and put the mapping from numbers
to names in the IANA registries.

So I propose following changes:
----------------------------------------------------------------------
Change:

   The IANA-assigned attribute number for authentication using generic 
   ECDSA is 8 (see [IANA]), but the parameters and associated hash 
   functions are not specified.   The document defines the following
   authentication algorithms along with their anticipated IANA 
   attribute numbers.

                 Digital           Diffie-
     IANA       Signature          Hellman             Hash
     Value      Algorithm           Group            Function
     -----      ---------        ------------      -------------
       9          ECDSA          P-256   [19]      SHA-256   [4]
      10          ECDSA          P-384   [20]      SHA-384   [5]
      11          ECDSA          P-521   [21]      SHA-512   [6]
   
   The numbers in brackets are the IANA identifiers for the Diffie-
   Hellman groups and the hash functions.

to

   There is IANA-assigned attribute number for authentication using
   generic ECDSA for IKEv1, but the parameters and associated hash
   functions are not specified. The document defines the following
   authentication algorithms along with their anticipated IANA
   attribute numbers.

     Authentication         Digital      Diffie-
     Method                 Signature    Hellman    Hash
     Name                   Algorithm    Group      Function
     -----                  ---------    -----      --------
     ECDSA-P-256-SHA-256    ECDSA        P-256      SHA-256
     ECDSA-P-384-SHA-384    ECDSA        P-384      SHA-384
     ECDSA-P-512-SHA-512    ECDSA        P-512      SHA-512

   Those parameters are used when calculating the signature, the
   Diffie-Hellman group and hash functions are negotiated separately
   when used in the IKE. 
----------------------------------------------------------------------
I.e. removed all references to IANA numbers from here, added names for
the authentication methods, fixed P-521 to P-512 also as I assume
P-521 is a typo, and added comment that parameters are only for ECDSA
signature calculation, they do not replace Diffie-Hellman / Hash
function etc negotiation of IKE. 
----------------------------------------------------------------------

Change:

5. IANA Considerations

   Before this document can become an RFC, it is required that IANA 
   update its registry of IKE authentication methods in [IANA] to 
   include the three options defined in Section 3 of this document.

to

5. IANA Considerations

   This document adds 3 parameters to the 2 existing registries.

   Changes to "Internet Key Exchange (IKE) Attributes"
   (http://www.iana.org/assignments/ipsec-registry) "IPSEC
   Authentication Methods" registry:

   Value        Method
   -----        ------
   (IANA-TBA1)  ECDSA with P-256 and SHA-256 (ECDSA-P-256-SHA-256)
   (IANA-TBA2)  ECDSA with P-384 and SHA-384 (ECDSA-P-384-SHA-384)
   (IANA-TBA3)  ECDSA with P-512 and SHA-512 (ECDSA-P-512-SHA-512)

   Changes to "Internet Key Exchange Version 2 (IKEv2) Parameters"
   (http://www.iana.org/assignments/ikev2-parameters) "IKEv2
   Authentication Method" registry:

   Value        Method
   -----        ------
   (IANA-TBA4)  ECDSA with P-256 and SHA-256 (ECDSA-P-256-SHA-256)
   (IANA-TBA5)  ECDSA with P-384 and SHA-384 (ECDSA-P-384-SHA-384)
   (IANA-TBA6)  ECDSA with P-512 and SHA-512 (ECDSA-P-512-SHA-512)
----------------------------------------------------------------------
Change

6.1 Authentication Method 9

   The parameters for Diffie-Hellman group 19 are 

to

6.1 Authentication Method ECDSA-P-256-SHA-256

   The parameters for Diffie-Hellman group P-256 are 
----------------------------------------------------------------------
and also change in section 6.1 last full payload example from

 00000048 00090000 CB28E099 9B9C7715 FD0A80D8 E47A7707 9716CBBF 917DD72E
 97566EA1 C066957C 86FA3BB4 E26CAD5B F90B7F81 899256CE 7594BB1E A0C89212
 748BFF3B 3D5B0315

to

 00000048 (IANA-TBA4)0000 CB28E099 9B9C7715 FD0A80D8 E47A7707 9716CBBF 917DD72E
 97566EA1 C066957C 86FA3BB4 E26CAD5B F90B7F81 899256CE 7594BB1E A0C89212
 748BFF3B 3D5B0315

{The IANA-TBA4 is replaced with the actual value of the number
assigned by IANA for the IANA-TBA4 in hexadesimal format for 16-bit
field. This note is removed from the final RFC}
----------------------------------------------------------------------

And similar changes to 6.2, and 6.3.
-- 
[email-masked]