]> INSIDE Secure

Eerikinkatu 28 FI-00180 HELSINKI FI kivinen@iki.fi

Security IP Security Maintenance and Extensions (ipsecme) The Internet Key Exchange Version 2 (IKEv2) protocol has limited support for the Elliptic Curve Digital Signature Algorithm (ECDSA). The current version only includes support for three Elliptic Curve groups, and there is fixed hash algorithm tied to each curve. This document generalizes the IKEv2 signature support so it can support any signature method supported by the PKIX and also adds signature hash algorithm negotiation. This is generic mechanism, and is not limited to ECDSA, but can also be used with other signature algorithms.

This document adds new IKEv2 () authentication method to support all kinds of signature methods. The current signature based authentication methods in the IKEv2 are per algorithm, i.e. there is one for RSA Digital signatures, one for DSS Digital Signatures (using SHA-1) and three for different ECDSA curves each tied to exactly one hash algorithm. This design starts to be cumbersome when more ECDSA groups are added, as each of them would require new authentication method and as with ECDSA there is no way to extract the hash algorithm from the signature, each ECDSA algorithm would need to come with fixed hash algorithm tied to it. With the SHA-3 definitions coming out, it is seen that it might be possible that in the future the signature methods are used with SHA-3 also, not only SHA-2. This means new mechanism for negotiating the hash algorithm for the signature algorithms is needed. The RSA Digital Signatures format in the IKEv2 is specified to use RSASSA-PKCS1-v1_5, but there has been some discussions that newer padding methods should be preferred instead of PKCS #1 version 1.5 (See section 5 of ). The DSS Digital Signatures format in the IKEv2 is specified to always use SHA-1, which limits the security of that, meaning there is no point of using long keys with it. This documents specifies two things, one is one new authentication method, which includes the enough information inside the Authentication payload data that the signature hash algorithm can be extracted from there (see ). The another thing is to add indication of supported signature hash algorithms by the peer (see ). This allows peer to know which hash algorithms are supported by the other end and use one of them (provided one is allowed by policy). There is no need to actually negotiate one common hash algorithm, as different hash algorithms can be used in different directions if needed. The new digital signature method needs to be flexible enough to include all current signature methods (RSA, DSA, ECDSA, RSASSA-PSS, etc), and also allow adding new things in the future (ECGDSA, ElGamal etc). For this the signature algorithm is specified in the same way as the PKIX () specifies the signature of the Certificate, i.e. there is simple ASN.1 object before the actual signature data. This ASN.1 object contains the OID specifying the algorithm, and associated parameters to it. In normal case the IKEv2 implementations supports fixed amount of signature methods, with commonly used parameters, so it is acceptable for the implementation to just treat this ASN.1 object as binary blob which is compared against the known values, or the implementation can parse the ASN.1 and extract information from there.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

This document specifies new "Digital Signature" authentication method. This method can be used with any types of signatures. As the authentication methods are not negotiated in the IKEv2, the peer is only allowed to use this authentication method if the SIGNATURE_HASH_ALGORITHMS Notify Payload has been sent and received. In this newly defined authentication method, the Authentication Data field inside the Authentication Payload does not include only the signature value, but instead the signature value is prefixed with the ASN.1 object containing the algorithm used to generate the signature. The ASN.1 object contains the algorithm identification OID, and this OID identifies both the signature algorithm and the hash used when calculating the signature. In addition to the OID there is optional parameters which might be needed for algorithms like RSASSA-PSS. To make implementations easier, the ASN.1 object is prefixed by the 8-bit length field. This length field allows simple implementations to be able to know the length of the ASN.1 without the need to parse it, so they can use it as binary blob which is compared against the known signature algorithm ASN.1 objects, i.e. they do not need to be able to parse or generate ASN.1 objects. See for commonly used ASN.1 objects. The ASN.1 used here are the same ASN.1 which is used in the AlgorithmIdentifier of the PKIX (Section 4.1.1.2 of ) encoded using distinguished encoding rules (DER) . The algorithm OID inside the ASN.1 specifies the signature algorithm and the hash function, which are needed for signature verification. The EC curve is always known by the peer because it needs to have the certificate or the public key of the other end before it can do signature verification and public key specifies the curve. Currently only the RSASSA-PSS uses the parameters, for all others the parameters is either NULL or missing. Note, that for some algorithms there is two possible ASN.1 encoding possible, one with parameters being NULL and others where the whole parameters is omitted. This is because some of those algorithms are specified that way. When encoding the ASN.1 implementations should use the preferred way, i.e. if the algorithm specification says "preferredPresent" then parameter object needs to be there (i.e. it will be NULL if no parameters is specified), and if it says "preferredAbsent", then the whole parameters object is missing. The Authentication payload is defined in IKEv2 as follows:

Auth Method (1 octet) - Specifies the method of authentication used.

Computed as specified in Section 2.15 of RFC5996 using a private key associated with the public key sent in certificate payload, and using one of the hash algorithms sent by the other end in the SIGNATURE_HASH_ALGORITHMS notify payload. If both ends send and receive SIGNATURE_HASH_ALGORITHMS and signature authentication is to be used, then this method MUST be used. The Authentication Data field has bit different format than in other Authentication methods (see below). ]]>

Authentication Data (variable length) - see Section 2.15 of RFC5996. For "Digital Signature" format the Authentication data contains special format as follows:

Where the ASN.1 Length is the length of the ASN.1 encoded AlgorithmIdentifier object, and after that is the actual AlgorithmIdentifier ASN.1 object, followed by the actual signature value. There is no padding between ASN.1 object and signature value. For the hash truncation the method of X9.62 () MUST be used.

The supported hash algorithms that can be used for the signature algorithms are now indicated with new SIGNATURE_HASH_ALGORITHMS Notification Payload sent inside the IKE_SA_INIT exchange. This notification also indicates the support of the new signature algorithm method, i.e. sending this notification tells that new "Digital Signature" authentication method is supported and that following hash functions are supported by sending peer. Both ends sends their list of supported hash-algorithms and when calculating signature a peer MUST pick one algorithm sent by the other peer. Note, that different algorithms can be used in different directions. The algorithm OID matching selected hash algorithm (and signature algorithm) used when calculating the signature is sent inside the Authentication Data field of the Authentication Payload.

Protocol ID is 0, SPI Size 0, and Notify Message Type <TBD from status types>. The Notification Data value contains list of 16-bit hash algorithm identifiers from the newly created Hash Algorithm Identifiers for the IKEv2 IANA registry.

This specification does not provide a way for the peers to indicate the public / private key pair types they have. I.e. how can the responder select public / private key pair type that the initiator supports. There is already several ways this information can be found in common cases. One of the ways to find out which key the initiator wants the responder to use is to indicate that in the IDr payload of the IKE_AUTH request of the initiator. I.e initiator indicates that it wants the responder to use certain public / private key pair by sending IDr which indicates that information. This means the responder needs to have different identities configured and each of those identities needs to be tied up to certain public / private key (or key type). Another way to get this information is from the Certificate Request payload sent by the initiator. For example if the initiator indicates in his Certificate Request payload that it trust CA which is signed by the ECDSA key, that will also indicate it can be process ECDSA signatures, thus responder can safely use ECDSA keys when authenticating himself. Responder can also check the key type used by the initiator, and use same key type than the initiator used. This does not work in case the initiator is using shared secret or EAP authentication, as in that case it is not using public key. If initiator is using public key authentication himself this is most likely the best way for the responder to find the type the initiator supports. In case the initiator uses a public key type that the responder will not support, the responder will reply with AUTHENTICATION_FAILED error. If initiator has multiple different keys it can try different key (and perhaps different key type) until it finds key that the other end accepts. Initiator can also use the Certificate Request payload sent by the responder to help deciding which public key should be tried. In normal case if initiator has multiple public keys, there is configuration that will select one of those for each connection, so the proper key is know by configuration.

The "Recommendations for Key Management" () table 2 combined with table 3 gives recommendations for how to select suitable hash functions for the signature. This new digital signature method does not tie the EC curve to the specific hash function, which was done in the old IKEv2 ECDSA methods. This means it is possible to use 512-bit EC curve with SHA1, i.e. this allows mixing different security levels. This means that the security of the authentication method is the security of the weakest of components (signature algorithm, hash algorithm, curve). This might make the security analysis of the system bit more complex. Note, that this kind of mixing of the security can be disallowed by the policy. The hash algorithm registry does not include MD5 as supported hash algorithm, as it is not considered safe enough for signature use (). The current IKEv2 uses RSASSA-PKCS1-v1_5, which do have some problems (, ) and does not allow using newer padding methods like RSASSA-PSS. This new method allows using other padding methods. The current IKEv2 only allows using normal DSA with SHA-1, which means the security of the regular DSA is limited to the security of SHA-1. This new methods allows using longer keys and longer hashes with DSA.

This document creates new IANA registry for IKEv2 Hash Algorithms. Changes and additions to this registry is by expert review. The initial values of this registry is:

MD5 is not included to the hash algorithm list as it is not considered safe enough for signature hash uses. Values 5-1023 are reserved to IANA. Values 1024-65535 are for private use among mutually consenting parties. This specification also allocates one new IKEv2 Notify Message Types - Status Types value for the SIGNATURE_HASH_ALGORITHMS, and adds new value "Digital Signature" to the IKEv2 Authentication Method registry.

Most of this work was based on the work done in the IPsecME design team for the ECDSA. The design team members were: Dan Harking, Johannes Merkle, Tero Kivinen, David McGrew, and Yoav Nir.

&rfc2119; &rfc5280; &rfc5996; &rfc3279; &rfc4055; &rfc5480; &rfc5758; &rfc5912; American National Standards Institute &x690; University of Waterloo

This section lists commonly used ASN.1 objects in binary form. This section is not-normative, and these values should only be used as examples, i.e. if this and the actual specification of the algorithm ASN.1 object is different the actual format specified in the actual specification needs to be used. These values are taken from the New ASN.1 Modules for the Public Key Infrastructure Using X.509 ().

These algorithm identifiers here include several different ASN.1 objects with different hash algorithms. In this document we only include the commonly used ones i.e. the one using SHA-1, or SHA-2 as hash function. Some of those other algorithms (MD2, MD5) specified for this are not safe enough to be used as signature hash algorithm, and some are omitted as there is no hash algorithm specified in the our IANA registry for them. Note, that there is no parameters in any of these, but all specified here needs to have NULL parameters present in the ASN.1. See Algorithms and Identifiers for PKIX Profile () and Additional Algorithms and Identifiers for RSA Cryptography for PKIX Profile () for more information.

sha1WithRSAEncryption OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5 } Parameters are required, and they must be NULL.

sha256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 11 } Parameters are required, and they must be NULL.

sha384WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 12 } Parameters are required, and they must be NULL.

sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 } Parameters are required, and they must be NULL.

With different DSA algorithms the parameters are always omitted. Again we omit dsa-with-sha224 as there is no hash algorithm in our IANA registry for it. See Algorithms and Identifiers for PKIX Profile () and PKIX Additional Algorithms and Identifiers for DSA and ECDSA ( for more information.

dsa-with-sha1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 3 } Parameters are absent.

dsa-with-sha256 OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) algorithms(4) id-dsa-with-sha2(3) 2 } Parameters are absent.

With different ECDSA algorithms the parameters are always omitted. Again we omit ecdsa-with-sha224 as there is no hash algorithm in our IANA registry for it. See Elliptic Curve Cryptography Subject Public Key Information (), Algorithms and Identifiers for PKIX Profile () and PKIX Additional Algorithms and Identifiers for DSA and ECDSA ( for more information.

ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 } Parameters are absent.

ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } Parameters are absent.

ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 3 } Parameters are absent.

ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 4 } Parameters are absent.

With the RSASSA-PSS the algorithm object identifier is always id-RSASSA-PSS, but the hash function is taken from the parameters, and it is required. See for more information.

id-RSASSA-PSS OBJECT IDENTIFIER ::= { pkcs-1 10 } Parameters are empty, but the ASN.1 part of the sequence must be there. This means default parameters are used (same as the next example).

id-RSASSA-PSS OBJECT IDENTIFIER ::= { pkcs-1 10 } Here the parameters are present, and contains the default parameters, i.e. SHA-1, mgf1SHA1, saltlength of 20, trailerfield of 1.

XXX Examples missing XXX Most likely include examples for sha1WithRSAEncryption and dsa-with-sha256 or something like that. I do not think we need all possible signature examples.