Subject: [IPsec] IKE's DH groups 19-21, NIST, FIPS 140-2, etc.

From: Scott C Moonen <[email-masked]>
Date: Wed, 1 Jul 2009 15:19:58 -0400

RFC 4753 documents that the shared secret obtained from an ECP 
Diffie-Hellman operation is the concatenation of the x and y coordinates 
of the derived point.

Is that correct?

That is a little strange to me, which is why I want to double check.  The 
y coordinate is simply a dependent variable, so including it doesn't seem 
to add much.  Much of the literature also seems to indicate that the x 
coordinate alone is generally considered to be the shared secret. Existing 
standards such as RSA's PKCS#11 interface use only the x coordinate. 
Moreover, in NIST publication 800-56A, "Recommendation for Pair-Wise Key 
Establishment Schemes Using Discrete Logarithm Cryptography", on p. 41 the 
x coordinate alone is again understood to be the shared secret.  This 
reference is particularly interesting, because it is incorporated into 
FIPS 140-2 via annex D, as the list of "Approved Key Establishment 
Techniques".

Assuming it is correct that IKE considers the shared secret to be the 
concatenation of the x and y coordinates, does this imply that IKE's use 
of DH groups 19, 20 and 21 cannot be made to be compliant with FIPS 140-2? 
 (Should I be asking this question somewhere else?)

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://scott.andstuff.org/
http://www.linkedin.com/in/smoonen

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 2 Jul 2009 10:28:23 -0700

At 3:19 PM -0400 7/1/09, Scott C Moonen wrote:
>RFC 4753 documents that the shared secret obtained from an ECP Diffie-Hellman operation is the concatenation of the x and y coordinates of the derived point.
>
>Is that correct?

Yes, I believe.

>That is a little strange to me, which is why I want to double check.  The y coordinate is simply a dependent variable, so including it doesn't seem to add much.  

It does help to keep the formats aligned. It is probably superfluous but harmless.

>Assuming it is correct that IKE considers the shared secret to be the concatenation of the x and y coordinates, does this imply that IKE's use of DH groups 19, 20 and 21 cannot be made to be compliant with FIPS 140-2?

No.

>  (Should I be asking this question somewhere else?)

Yes. Ask the folks at NIST.

--Paul Hoffman, Director
--VPN Consortium

---

From: Scott C Moonen <[email-masked]>
Date: Thu, 2 Jul 2009 14:38:43 -0400

> Yes, I believe.

Thank you, Paul.

It matters little at this point, but I am curious to hear if any other IKE 
implementors faced challenges with crypto libraries or service providers 
only generating the x coordinate.

Thanks,

From:
Paul Hoffman <[email-masked]>
To:
Scott C Moonen/Raleigh/IBM@IBMUS, [email-masked]
Date:
07/02/2009 01:28 PM
Subject:
Re: [IPsec] IKE's DH groups 19-21, NIST, FIPS 140-2, etc.

Yes, I believe.

to add much. 

It does help to keep the formats aligned. It is probably superfluous but 
harmless.

No.

--Paul Hoffman, Director
--VPN Consortium