Subject: [Ipsec] Comments about draft-solinas-ui-suites-00

From: <[email-masked]>
Date: Mon, 11 Dec 2006 10:59:16 +0200

A couple of minor comments about this draft:

1) The document needs a reference to draft-kelly-ipsec-ciph-sha2,
which specifies how to use SHA-256 with IPsec.

2) Currently draft-kelly-ipsec-ciph-sha2 specifies only SHA-256 
based integrity/PRF algorithms, but not SHA-384 or SHA-512, so 
"Suite-B-GCM-256" and "Suite-B-GMAC-256" are not actually
implementable using currently existing documents.

3) Given that SHA-384 is basically SHA-512 truncated to 384 bits 
(and with different IV), do we really need e.g. a SHA-384 based 
PRF for IKEv2? Wouldn't it be simpler just to use SHA-512?
(There are applications where using SHA-384 may make sense, but 
I'm not sure IKEv2 PRF is one of them...)

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Scott G Kelly <[email-masked]>
Date: Mon, 11 Dec 2006 06:17:44 -0800

FYI, we're updating draft-kelly-ipsec-ciph-sha2 to include sha-{384,512} 
  per Steve Bellovin's review comments. Hopefully, that will be 
available later this week.

---

From: Russ Housley <[email-masked]>
Date: Fri, 15 Dec 2006 13:42:54 -0500

Pasi:

As you have already seen on this list, Scott Kelly is working on an 
update to draft-kelly-ipsec-ciph-sha2.  Once that is done, a 
reference will be added.  I hope to progress the two documents at the 
same time.  This should resolve comments 1) and 2).

As for comment 3), the authors acknowledge that you have a good 
point.  However, they prefer SHA-384 over SHA-512 because SHA-384 is 
a Suite B algorithm and SHA-512 is not.  Moreover, if the user is 
also using ECDSA-384 digital signatures, then he will need to have 
SHA-384 anyway.

Russ