Subject: [IPsec] Question about ECDSA cert usage for IKEv2 auth

From: Gaurav Poothia <[email-masked]>
Date: Thu, 22 Dec 2011 19:07:33 +0000

Hello,
The basic IKEv2 cert auth mechanism for RSA (from RFC 5996) seems to be to hash using SHA-1 before signing.

However when using ECDSA certs for IKEv2 I am trying to make sure I am reading RFC 4754 correctly when it says the following:
"Moreover, ECDSA cannot be specified for IKEv2
   independently of an associated hash function since IKEv2 does not
   have a transform type for hash functions.  For this reason, it is
   necessary to specify the hash function as part of the signature
   algorithm.  Furthermore, the elliptic curve group must be specified
   since the choice of hash function depends on it as well.  As a
   result, it is necessary to specify three signature algorithms, named
   ECDSA-256, ECDSA-384, and ECDSA-521.  Each of these algorithms
   represents an instantiation of the ECDSA algorithm using a particular
   elliptic curve group and hash function.  The three hash functions are
   specified in [SHS].  For reasons of consistency, this document
   defines the signatures for IKE in the same way.

        Digital
       Signature
       Algorithm            Elliptic Curve Group        Hash Function
      -----------        --------------------------    ---------------
       ECDSA-256          256-bit random ECP group        SHA-256
       ECDSA-384          384-bit random ECP group        SHA-384
       ECDSA-521          521-bit random ECP group        SHA-512"

Does this mean we proceed just like RSA here but hash with SHA-256 and not SHA-1 for ECDSA-256 cert and then proceed to sign as usual.
Similarly use SHA-384 and SHA-512 for ECDSA-384 and ECDSA-521 respectively.
Is that the correct reading of this excerpt?

Thanks

---

From: Yoav Nir <[email-masked]>
Date: Thu, 22 Dec 2011 23:35:06 +0200

On Dec 22, 2011, at 9:07 PM, Gaurav Poothia wrote:

Hello,

“Moreover, ECDSA cannot be specified for IKEv2

        Digital
       Signature
       ECDSA-521          521-bit random ECP group        SHA-512”

Hi Gaurav

This is pretty much correct. With ECDSA you first hash with the specified hash function, and then sign the hash with the ECDSA group. Note how the numbers almost match up, so the size of the has is exactly the size of the buffer to be signed.

This is different from RSA, where the hash is much shorter than the buffer to be signed. Even the longest hash anyone uses has only a 512-bit output, while 1024-bit signatures are considered too short these days, and 512-bit signatures are apparently grounds for blacklisting a CA. With RSA you use the RSASSA-PKCS1-v1_5 signature scheme, and that includes an identifier for the hash algorithm, so you can use any hash you want.

Hope this helps

Yoav

---

From: Gaurav Poothia <[email-masked]>
Date: Thu, 22 Dec 2011 22:30:30 +0000

Thanks Yoav!

From: Yoav Nir [mailto:[email-masked]]
Sent: Thursday, December 22, 2011 1:35 PM
To: Gaurav Poothia
Cc: [email-masked]; Brian Swander
Subject: Re: [IPsec] Question about ECDSA cert usage for IKEv2 auth

Hello,

        Digital
       Signature

Hi Gaurav

Hope this helps

Yoav