Re: [Hipsec] Proposed cipers for 5201-bis

16.4.2010 17:52, Robert Moskowitz kirjoitti:
> I have worked through a number of documents and have come up with the
> following recommendations that will go into 5201-bis. I am posting them
> separately here so others can think about them without having to wade
> through the changes we are making to 5201.
>
> First and foremost we are adding EC support. EC MAY be used for 128bit
> strenght crypto and MUST be used for 192 and 256bit crypto. This means
> that I am dropping many of the larger DH mod sizes. Also with the advent
> of fECC, I can drop some of the early ECC curves. fECC gives us the
> tools to work with well researched stuff. For now we are adding the
> larger SHA sizes and will await results of the NIST hash competition.
>
> Anyway, here we go...
>
> HOST_ID
>
> Algorithms Values
>
> RESERVED 0
> DSA 3 [RFC2536] (RECOMMENDED)
> RSA 5 [RFC3110] (REQUIRED)
> ECDSA 6 [draft-?????.txt]
>
> Is there a doc for ECDSA in DNS records? Note that I dropped RSA/SHA1
> for just RSA, as that is what we are really doing.
>

There was one draft 
(http://tools.ietf.org/html/draft-ietf-dnsext-ecc-key-10) years ago that 
has now expired. Have not found any newer one.

>
> DIFFIE_HELLMAN
>
> Group Value
>
> Reserved 0
> DEPRECATED 1
> DEPRECATED 2
> DEPRECATED 3
> 3072-bit MODP group 4 RFC3526
> DEPRECATED 5
> DEPRECATED 6
> 256-bit random ECP group 7 RFC4753, draft-mcgrew-fundamental-ecc-02.txt
> 384-bit random ECP group 8 RFC4753, draft-mcgrew-fundamental-ecc-02.txt
> 521-bit random ECP group 9 RFC4753, draft-mcgrew-fundamental-ecc-02.txt
>
>
> Note all that is getting deprecated. Speak up if you have reasons to NOT
> drop what I did...
>
> HASH
>
> Hash Value
>
> Reserved 0
> SHA-1 1
> SHA-256 2
> SHA-384 3
> SHA-512 4
>
> Nothing special here.
>
>
> HIP_TRANSFORM
>
> Suite ID Value
>
> RESERVED 0
> AES-128-CBC with HMAC-SHA1 1 ([RFC3602], [RFC2404])
> 3DES-CBC with HMAC-SHA1 2 ([RFC2451], [RFC2404])
> DEPRECATED 3
> DEPRECATED 4
> NULL-ENCRYPT with HMAC-SHA1 5 ([RFC2410], [RFC2404])
> DEPRECATED 6
> NULL-ENCRYPT with HMAC-SHA2 7 ([RFC2410], [RFC4868])
> AES-128-CBC with HMAC-SHA2 8 ([RFC3602], [RFC4868])
> AES-256-CBC with HMAC-SHA2 9 ([RFC3602], [RFC4868])
> AES-CCM-8 9 [RFC4309]
> AES-CCM-16 10 [RFC4309]
> AES-GCM with a 8 octet ICV 11 [RFC4106]
> AES-GCM with a 16 octet ICV 12 [RFC4106]
>
> Again, note what is being deprecated. I believe I am adding only that
> which is of value.
>
>
> _______________________________________________
> Hipsec mailing list
> Hipsec@ietf.org
> https://www.ietf.org/mailman/listinfo/hipsec