From: "Henderson, Thomas R" <thomas.r.henderson@boeing.com>
To: "'Tobias Heer'" <heer@cs.rwth-aachen.de>,
 "hipsec@ietf.org" <hipsec@ietf.org>
Date: Thu, 9 Dec 2010 08:31:46 -0800
Thread-Topic: [Hipsec] HIT Suites and algorithms used in RFC5201-bis
Thread-Index: AcuXkTP/rO6ZCftQRwStDYMA1OGpOwALJjSg
Message-ID: <7CC566635CFE364D87DC5803D4712A6C4CED25AB29@XCH-NW-10V.nw.nos.boeing.com>
References: <42082FED-C009-4C35-813A-F55165A419BE@cs.rwth-aachen.de>
In-Reply-To: <42082FED-C009-4C35-813A-F55165A419BE@cs.rwth-aachen.de>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [Hipsec] HIT Suites and algorithms used in RFC5201-bis
Precedence: list

> -----Original Message-----
> From: hipsec-bounces@ietf.org
> [mailto:hipsec-bounces@ietf.org] On Behalf Of Tobias Heer
> Sent: Thursday, December 09, 2010 2:27 AM
> To: hipsec@ietf.org
> Subject: [Hipsec] HIT Suites and algorithms used in RFC5201-bis
>
> Hello,
>
> we have consolidated the set of algorithms to be used in
> RFC5201 and would like
> to present it to the list and ask for feedback.
>
> We have three HIT Suites.  The HIT Suites define the
> algorithms that are used
> for generating a HIT/Orchid.  It also defines which HMAC
> flavor will be used in
> HIP control packets.
>
>
>      HIT Suite              ID
>      RESERVED                0
>      RSA,DSA/SHA-1           1    (REQUIRED)
>      ECDSA/SHA-384           2    (RECOMMENDED)
>      ECDSA_LOW/SHA-1         3    (RECOMMENDED)
>
> RSA,DSA/SHA-1 represent the class of HITs we have today with
> HIP version 1.  All
> contained Algorithms (RSA and DSA) must be supported by hosts
> that implement
> this suite.
>
> ECDSA/SHA-384 bundles two ECC curves (NIST P-256 and P-384)
> with SHA-384.  Both
> curves must be implemented by hosts that implement HIT this HIT suite.
>
> ECDSA_LOW/SHA-1 is meant for devices with limited computation
> capabilities.  It
> uses the SECP160R curve from SECG.
>
> If we want to make a bold move towards ECC cryptography (and
> make packet
> fragmentation, etc.  less likely) we could change the
> REQUIRED and RECOMMENDED
> tags so that we REQUIRE the ECDSA/SHA-384 HIT SUITE and make
> the other two
> recommended.  Any comments on this?

Has anyone checked into the availability of these suites in cryptographic l=
ibraries and hardware?

Can you clarify what you believe are the implications that you hint at ("pa=
cket fragmentation, etc.")?

>
>
> The ECDH groups look similar:
>
>  Group                Value
>  Reserved             0
>  DEPRECATED           1
>  DEPRECATED           2
>  1536-bit MODP group  3 [RFC3526]
>  3072-bit MODP group  4 [RFC3526]
>  DEPRECATED           5
>  DEPRECATED           6
>  NIST P-256           7 [RFC4753]
>  NIST P-384           8 [RFC4753]
>  NIST P-521           9 [RFC4753]
>  SECP160R1           10 [SECG]
>
> Groups 7 to 10 are new in RFC5201-bis.  Again, group 10 is
> meant for devices
> with low computation capabilities and should be used only if long-term
> confidentiality is not required.
>
> The DEPRECATED values are groups present in RFC5201 but have
> been removed in
> RFC5201-bis.  They have to be removed before we finish the document.
>
> Are there any comments regarding the selection of algorithms?
>  With the selected
> ECC curves, we tried to stay as close to other Internet
> standards IKE, TLS that
> use ECC already.
>

I don't have other comments and agree with trying to stay close to the pred=
ecessors.

- Tom