[Hipsec] Proposed cipers for 5201-bis

[Robert Moskowitz <[e-mail]>]

I had some mail server problems and can't tell if this went out....

I have worked through a number of documents and have come up with the 
following recommendations that will go into 5201-bis.  I am posting them 
separately here so others can think about them without having to wade 
through the changes we are making to 5201.

First and foremost we are adding EC support.  EC MAY be used for 128bit 
strenght crypto and MUST be used for 192 and 256bit crypto.  This means 
that I am dropping many of the larger DH mod sizes.  Also with the 
advent of fECC, I can drop some of the early ECC curves.  fECC gives us 
the tools to work with well researched stuff.  For now we are adding the 
larger SHA sizes and will await results of the NIST hash competition.

Anyway, here we go...

HOST_ID

          Algorithms       Values

          RESERVED         0
          DSA              3 [RFC2536] (RECOMMENDED)
          RSA              5 [RFC3110] (REQUIRED)
          ECDSA            6 [draft-?????.txt]

Is there a doc for ECDSA in DNS records?  Note that I dropped RSA/SHA1 
for just RSA, as that is what we are really doing.


DIFFIE_HELLMAN

       Group                            Value

       Reserved                         0
       DEPRECATED                       1
       DEPRECATED                       2
       DEPRECATED                       3
       3072-bit MODP group              4     RFC3526
       DEPRECATED                       5
       DEPRECATED                       6
       256-bit random ECP group         7   RFC4753, 
draft-mcgrew-fundamental-ecc-02.txt
       384-bit random ECP group         8   RFC4753, 
draft-mcgrew-fundamental-ecc-02.txt
       521-bit random ECP group         9   RFC4753, 
draft-mcgrew-fundamental-ecc-02.txt


Note all that is getting deprecated.  Speak up if you have reasons to 
NOT drop what I did...

HASH

       Hash              Value

       Reserved          0
       SHA-1             1
       SHA-256           2
       SHA-384           3
       SHA-512           4

Nothing special here.


HIP_TRANSFORM

          Suite ID                          Value

          RESERVED                          0
          AES-128-CBC with HMAC-SHA1        1     ([RFC3602], [RFC2404])
          3DES-CBC with HMAC-SHA1           2     ([RFC2451], [RFC2404])
          DEPRECATED                        3
          DEPRECATED                        4
          NULL-ENCRYPT with HMAC-SHA1       5     ([RFC2410], [RFC2404])
          DEPRECATED                        6
          NULL-ENCRYPT with HMAC-SHA2       7     ([RFC2410], [RFC4868])
          AES-128-CBC with HMAC-SHA2        8     ([RFC3602], [RFC4868])
          AES-256-CBC with HMAC-SHA2        9     ([RFC3602], [RFC4868])
          AES-CCM-8                         9     [RFC4309]
          AES-CCM-16                        10    [RFC4309]
          AES-GCM with a 8 octet ICV        11    [RFC4106]
          AES-GCM with a 16 octet ICV       12    [RFC4106]

Again, note what is being deprecated.  I believe I am adding only that 
which is of value.