[Hipsec] 5201-bis -- Limiting ECC to co-factor of 1

[Robert Moskowitz <[e-mail]>]

I hope I got the wording right here and have captured the conversations 
I have had on this subject...

All the curves specified in 5201-bis have a co-factor of 1.  It is my 
understanding that we can meet all of our security goals for HIP with 
curves having a co-factor of 1 and by explicitly limiting 5201-bis to 
curves with a co-factor 1 (as some other RFCs have done) we address one 
of the 3 IPR claims from Certicom.

To this end I want to add text to both 5.2.6 and 5.2.8 calling out this 
limit.  Perhaps something like (and I welcome any improvements):

in 5.2.6:

    The MODP Diffie-Hellman groups are defined in [RFC3526].  The ECDH
    groups 7 - 9 are defined in [RFC5903] and [RFC6090].  ECDH group 10
    is covered in Appendix D.  Any ECDH used with HIP MUST have a 
co-factor of 1.

Note that this is also a fix to the text as the ID says groups 8-10 are 
in 5903 and 7 is in App D.   Oops

in 5.2.8:

    The Host Identity is derived from the DNSKEY format for RSA and DSA.
    For these, the Public Key field of the RDATA part from RFC 4034
    [RFC4034] is used.  For ECC we distinguish two different profiles:
    ECDSA and ECDSA_LOW.  ECC contains curves approved by NIST and
    defined in RFC 4754 [RFC4754].  ECDSA_LOW is defined for devices with
    low computational capabilities and uses shorter curves from SECG
    [SECG].  Any ECDSA used with HIP MUST have a co-factor of 1.