Subject: [Ipsec] Protocol Action: 'IKE and IKEv2 Authentication Using ECDSA' to Proposed Standard

From: The IESG <[email-masked]>
Date: Mon, 7 Aug 2006 16:27:50 -0700

The IESG has approved the following document:

- 'IKE and IKEv2 Authentication Using ECDSA '
    <draft-ietf-ipsec-ike-auth-ecdsa-06.txt> as a Proposed Standard

This document has been reviewed in the IETF but is not the product of an
IETF Working Group.

The IESG contact person is Russ Housley.

A URL of this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipsec-ike-auth-ecdsa-06.txt

Technical Summary

   This document describes how the Elliptic Curve Digital Signature
   Algorithm (ECDSA) may be used as the authentication method within the
   Internet Key Exchange (IKE) and Internet Key Exchange version 2
   (IKEv2) protocols.  ECDSA may provide benefits including computational
   efficiency, small signature sizes, and minimal bandwidth compared to
   other available digital signature methods.  This document adds ECDSA
   capability to IKE without introducing any changes to existing IKE
   operation.

Working Group Summary

   This document is an individual submission.  It was discussed in the
   IPsec Working Group, but that working group was closed before reaching
   consensus on this document.  Thus, it is not affiliated with any IETF
   Working Group.

Protocol Quality

   This document was reviewed by Russ Housley for the IESG.

Note to IANA

   The registry is http://www.iana.org/assignments/ipsec-registry [IANA-IKE],
   and the section within the registry is "IPSEC Authentication Methods".
   The three new additions are:

      Method                                        Value
      ------                                        -----
      ECDSA with SHA-256 on the P-256 curve           9
      ECDSA with SHA-384 on the P-384 curve          10
      ECDSA with SHA-521 on the P-512 curve          11

   The registry is http://www.iana.org/assignments/ikev2-parameters
   [IANA-IKEv2], and the section within the registry is "IKEv2
   Authentication Method".  The three new additions are:

      Method                                        Value
      ------                                        -----
      ECDSA with SHA-256 on the P-256 curve           9
      ECDSA with SHA-384 on the P-384 curve          10
      ECDSA with SHA-521 on the P-512 curve          11

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 8 Aug 2006 15:26:48 +0300

>    The three new additions are:

As the currently allocated numbers in the IKEv2-parameters for the
"IKEv2 Authentication Method" are completely different that IKEv1, and
the first unallocated number in that registry is 4, I think it would
be much better to simply take next available numbers (i.e. 4, 5, and
6) instead of the proposed numbers, which would leave a gap of 4-8 to
the registry. This also affects the hex encoded packet examples in the
section 8. 
-- 
[email-masked]