draft-kivinen-ipsecme-signature-auth-03.txt   draft-kivinen-ipsecme-signature-auth-04.txt 
IP Security Maintenance and Extensions T. Kivinen IP Security Maintenance and Extensions T. Kivinen
(ipsecme) INSIDE Secure (ipsecme) INSIDE Secure
Internet-Draft November 14, 2013 Internet-Draft December 9, 2013
Updates: RFC 5996 (if approved) Updates: RFC 5996 (if approved)
Intended status: Standards Track Intended status: Standards Track
Expires: May 18, 2014 Expires: June 12, 2014
Signature Authentication in IKEv2 Signature Authentication in IKEv2
draft-kivinen-ipsecme-signature-auth-03.txt draft-kivinen-ipsecme-signature-auth-04.txt
Abstract Abstract
The Internet Key Exchange Version 2 (IKEv2) protocol has limited The Internet Key Exchange Version 2 (IKEv2) protocol has limited
support for the Elliptic Curve Digital Signature Algorithm (ECDSA). support for the Elliptic Curve Digital Signature Algorithm (ECDSA).
The current version only includes support for three Elliptic Curve The current version only includes support for three Elliptic Curve
groups, and there is fixed hash algorithm tied to each curve. This groups, and there is fixed hash algorithm tied to each curve. This
document generalizes the IKEv2 signature support so it can support document generalizes the IKEv2 signature support so it can support
any signature method supported by the PKIX and also adds signature any signature method supported by the PKIX and also adds signature
hash algorithm negotiation. This is generic mechanism, and is not hash algorithm negotiation. This is generic mechanism, and is not
skipping to change at page 1, line 40 skipping to change at page 1, line 40
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on May 18, 2014. This Internet-Draft will expire on June 12, 2014.
Copyright Notice Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 9, line 27 skipping to change at page 9, line 27
SHA2-384 3 SHA2-384 3
SHA2-512 4 SHA2-512 4
MD5 is not included to the hash algorithm list as it is not MD5 is not included to the hash algorithm list as it is not
considered safe enough for signature hash uses. considered safe enough for signature hash uses.
Values 5-1023 are reserved to IANA. Values 1024-65535 are for Values 5-1023 are reserved to IANA. Values 1024-65535 are for
private use among mutually consenting parties. private use among mutually consenting parties.
This specification also allocates one new IKEv2 Notify Message Types This specification also allocates one new IKEv2 Notify Message Types
- Status Types value for the SIGNATURE_HASH_ALGORITHMS. - Status Types value for the SIGNATURE_HASH_ALGORITHMS, and adds new
value "Digital Signature" to the IKEv2 Authentication Method
registry.
8. Acknowledgements 8. Acknowledgements
Most of this work was based on the work done in the IPsecME design Most of this work was based on the work done in the IPsecME design
team for the ECDSA. The design team members were: Dan Harking, team for the ECDSA. The design team members were: Dan Harking,
Johannes Merkle, Tero Kivinen, David McGrew, and Yoav Nir. Johannes Merkle, Tero Kivinen, David McGrew, and Yoav Nir.
9. References 9. References
9.1. Normative References 9.1. Normative References
 End of changes. 5 change blocks. 
5 lines changed or deleted 7 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/