[IPsec] Raw ECDSA keys and IKEv2

Tero Kivinen <kivinen@iki.fi> Thu, 21 July 2011 23:53 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-ID: <20008.48126.941062.723271@fireball.kivinen.iki.fi>
Date: Fri, 22 Jul 2011 02:53:34 +0300
From: Tero Kivinen <kivinen@iki.fi>
To: ipsec@ietf.org
Subject: [IPsec] Raw ECDSA keys and IKEv2
Precedence: list

In the RFC5996 we have format for Raw RSA keys (using PKCS1 format).
The current buzzword compatible mantra seems to be ECDSA or Elliptic
Curve keys in general, so perhaps we should also allow Raw ECDSA keys
to be used in the IKEv2?

For the format we could either use one of the following:

1) RFC5480
2) Draft-hoffman-dnssec-ecdsa-04
3) Roll our own
4) Combination of few above

The RFC5480 has the problem that it uses ASN.1, and many of the people
want to use Raw Public Keys just because they do not want to use Self
signed certificates because of ASN.1 requirement.

Draft-hoffman-dnssec-ecdsa-04 uses DNSSec registries, do we want to
reuse them?

The case 4 would most likely be best, meaning we create own wrapper
format where we have the curve information using our own registry (or
reuse IKEv2 Authentication Method registry, as the key to be used will
be used to create the Authentication Payload anyways), and then attach
to that either the format from draft-hoffman-dnssec-ecdsa-04 section
4, or from RFC 5480 section 2.2.
-- 
kivinen@iki.fi

[IPsec] Raw ECDSA keys and IKEv2 Tero Kivinen