Re: [IPsec] IKE's DH groups 19-21, NIST, FIPS 140-2, etc.

  Hi,

  RFC 5114 claims it defines new ECP groups 19, 20, and 21 for IKE but
so does RFC 4753. Interestingly the curve definitions are different but
the orders are the same (maybe it's just interesting because I don't
understand why). RFC 5114 also defines some new MODP groups but RFC 4753
does not.

  One nice thing about RFC 5114 is that it updates the IANA repositories
for TLS, SSH, and SMIME as well as IKE so these groups can be used by
other IETF protocols that require them. RFC 4753 only defines their use
in IKE.

  If there is no cryptographic difference between ECP curve 19 (20 and 21)
as defined in RFC 5114 and RFC 4753 then can some mention be made in this
draft to that effect? And can it then obsolete RFC 5114 as well as RFC
4753? It just seems strange to have two RFCs defining the same group
differently. And can this I-D also include IANA considerations for TLS,
SSH, and SMIME if it's going to obsolete RFC 5114?

  regards,

  Dan.

On Mon, July 6, 2009 1:15 pm, Russ Housley wrote:
> I think a fix is already in the works:
> https://datatracker.ietf.org/doc/draft-solinas-rfc4753bis/
>
> _______________________________________________
> IPsec mailing list
> IPsec@ietf.org
> https://www.ietf.org/mailman/listinfo/ipsec
>