Subject: [IPsec] another RFC 4869 question

From: Scott C Moonen <[email-masked]>
Date: Thu, 14 May 2009 08:31:47 -0400

RFC 4869 makes some statements like:

   The authentication method used with IKEv1 MAY be either pre-shared
   key [RFC2409] or ECDSA-256 [RFC4754].

That seems to me like an empty statement, since it doesn't require any 
particular set of choices nor does it proscribe any choice.

Is it intended to proscribe the use of non-ECDSA digital signatures such 
as RSA, and therefore limit the options to pre-shared key and ECDSA-256? I 
wonder if it should read "MUST" instead?

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://scott.andstuff.org/
http://www.linkedin.com/in/smoonen

---

From: Russ Housley <[email-masked]>
Date: Wed, 20 May 2009 14:32:02 -0400

Scott:

RFC 4869 makes some
statements like:

The authentication method used with IKEv1 MAY
be either pre-shared

That seems to me like an empty statement, since it doesn't
require any particular set of choices nor does it proscribe any
choice.

Pre-shared key involve a shared symmetric value.  ECDSA-256 involves
a pubic-private key pair and a certificate.  Either one is
acceptable for the Suite B environment.

Is it intended to
proscribe the use of non-ECDSA digital signatures such as RSA, and
therefore limit the options to pre-shared key and ECDSA-256?  I
wonder if it should read "MUST" instead?

That is how I read it.

Russ