]> secunet Security Networks

Mergenthaler Allee 77 65760 Eschborn Germany +49 201 5454 3091 johannes.merkle@secunet.com

Bundesamt fuer Sicherheit in der Informationstechnik (BSI)

Postfach 200363 53133 Bonn Germany +49 228 9582 5643 manfred.lochter@bsi.bund.de

IKE, Elliptic Curve This document specifies the use of ECC Brainpool elliptic curve groups for key exchange in the Internet Key Exchange version 2 (IKEv2) protocol.

In RFC 5639 , a new set of elliptic curve groups over finite prime fields for use in cryptographic applications was specified. These groups, denoted as ECC Brainpool curves, were generated in a verifiably pseudo-random way and comply with the security requirements of relevant standards from ISO , ANSI , NIST , and SecG . While the ASN.1 object identifiers defined in RFC 5639 allow usage of the ECC Brainpool curves in certificates and certificate revocation lists, their utilization for key exchange in IKEv2 requires the definition and assignment of additional transform IDs in the respective IANA registry. This document specifies tranform IDs for four curves from RFC 5639. Furthermore, the encoding of the key exchange payload and derivation of the shared secret are defined, because previous RFCs specified this encoding only for the curves proposed therein.

In order to use the ECC Brainpool curves for key exchange within IKEv2, the Diffie-Hellman Group Transform IDs (Transform Type 4) listed in the following table are to be registered with IANA . The parameters associated with these curves are defined in RFC 5639 . Curve Transform ID brainpoolP224r1 TBD1 brainpoolP256r1 TBD2 brainpoolP384r1 TBD3 brainpoolP512r1 TBD4 The corresponding "twisted curves" defined in RFC 5639 can be used by implementations without having separate transform IDs defined: points (x,y) of any curve listed in can be efficiently transformed to the corresponding point (x',y') on the twisted curve of same bit length - and vice versa - by setting (x',y') = (x*Z^2, y*Z^3) with the coefficient Z specified for that curve in RFC 5639. Test vectors for the groups defined by the ECC Brainpool curves are provided in

RFC4306 only specifies the use of MODP groups and GF[2^N] elliptic curve groups for Diffie-Hellman key exchange with IKEv2. For Diffie-Hellman groups of elliptic curves defined over prime fields (ECP Diffie-Hellman groups), however, the format of key exchange payloads and the derivation of a shared secret has thus far not been specified generally but on a group-by-group basis. To accomodate for different bandwidth limitations, for the groups defined in this document, two different methods for encoding the key exchange payload, compressed and uncompressed, are specified. In an ECP key exchange, the Diffie-Hellman public value passed in a KE payload consists of two components, x and y, corresponding to the coordinates of an elliptic curve point. Each component MUST be computed from the corresponding coordinate using the FieldElement-to-OctetString conversion method specified in and MUST have bit length as indicated in . This length is enforced by the FieldElement-to-OctetString conversion method, if necessary, by prepending the value with zeros. Curves Bit lengths brainpoolP224r1 224 brainpoolP256r1 256 brainpoolP384r1 384 brainpoolP512r1 512 From these components, the key exchange payload MUST be computed using one of the two following encodings. Uncompressed. This method equals the method specified in RFC 5903 for the ECP curves proposed therein. The key exchange payload is defined as the concatenation of the x and y coordinates. Using this method, the bit length of the key exchange payload is twice the bit length of each component listed in . If a peer receives a key exchange payload for an ECC Brainpool curve having twice the bitlength indicated for that curve in , it MUST assume that the uncompressed encoding has been used. Compressed. The key exchange payload is defined as x. Using this method, the bit length of the key exchange payload equals the bit length of each component listed in . If a peer receives a key exchange payload for an ECC Brainpool curve having the bitlength indicated for that curve in , it MUST assume that the compressed encoding has been used. The Diffie-Hellman shared secret value MUST be computed from the x coordinate of the Diffie-Hellman common value using the FieldElement-to-OctetString conversion method specified in and MUST have bit length as indicated in the . The parties MUST verify that the Diffie-Hellman common value is not the "point at infinity", i.e. that the shared secret derived contains non-zero octets. When compressed encoding is used, computation of the Diffie-Hellman common value, and hence, of the shared secret value from the x-coordinate transmitted in the key exchange payload requires recovery of a correspoding y-coordinate. Since there are up to two possible points on the elliptic curve having a given x-coordinate, the recovered y-component is not unique. However, as explained in , any of the two y-coordinates corresponding to the x-value transmitted in the key exchange payload can be used to compute the Diffie-Hellman common value.

The security considerations of apply accordingly. The confidentiality, authenticity and integrity of a secure communication based on IKEv2 is limited by the weakest cryptographic primitive applied. In order to achieve a maximum security level when using one of the elliptic curves from for key exchange, the key derivation function, the algorithms and key lengths of symmetric encryption and message authentication as well as the algorithm, bit length and hash function used for signature generation should be chosen according to the recommendations of and . Furthermore, the private Diffie-Hellman keys should be selected with the same bit length as the order of the group generated by the base point G and with approximately maximum entropy. Implementations of elliptic curve cryptography for IKEv2 may be susceptible to side-channel attacks. Particular care should be taken for implementations that internally use the corresponding twisted curve to take advantage of an efficient arithmetic for the special parameters (A = -3): although the twisted curve itself offers the same level of security as the corresponding random curve (through mathematical equivalence), an arithmetic based on small curve parameters may be harder to protect against side-channel attacks. General guidance on resistence of elliptic curve cryptography implementations against side-channel-attacks is given in and .

Before this document can become an RFC, IANA is required to update the Transform Type 4 (Diffie-Hellman Group Transform) IDs in its Internet Key Exchange Version 2 (IKEv2) Parameters registry . In particular, numbers are to be assigned to the groups specified in . Another I-D is being submitted for publication as RFC requesting assignment for the same groups in the corresponding registry for IKEv1; in order to keep the registries for IKEv1 and IKEv2 in accordance, it is advisable to assign the same values in both registries.

Although, the authors have no knowledge about any intellectual property rights which cover the general usage of the ECP groups defined herein, implementations based on these domain parameters may require use of inventions covered by patent rights. In particular, the compressed encoding method for the key exchange payload defined in and techniques for an efficient arithmetic based on the special parameters of the twisted curves as explained in may be covered by patents.

Internet Assigned Numbers Authority Harvard University

1350 Mass. Ave. Cambridge MA 02138 - +1 617 495 3864 sob@harvard.edu

General keyword American National Standards Institute Bundesamt für Sicherheit in der Informationstechnik National Institute of Standards and Technology International Organization for Standardization International Organization for Standardization National Institute of Standards and Technology This note describes the fundamental algorithms of Elliptic Curve Cryptography (ECC) as they were defined in some seminal references from 1994 and earlier. These descriptions may be useful for implementing the fundamental algorithms without using any of the specialized methods that were developed in following years. Only elliptic curves defined over fields of characteristic greater than three are in scope; these curves are those used in Suite B. This document is not an Internet Standards Track specification; it is published for informational purposes. Certicom Research Certicom Research

This section provides some test vectors for example Diffie-Hellman key exchanges using each of the curves defined in . In all of the following sections the following notation is used: d_A: the secret key of party A x_qA: the x-coordinate of the public key of party A y_qA: the y-coordinate of the public key of party A d_B: the secret key of party B x_qB: the x-coordinate of the public key of party B y_qB: the y-coordinate of the public key of party B x_Z: the x-coordinate of the shared secret that results from completion of the Diffie-Hellman computation y_Z: the y-coordinate of the shared secret that results from completion of the Diffie-Hellman computation The field elements x_qA, y_qA, x_qB, y_qB, x_Z, y_Z are represented as hexadecimal values using the FieldElement-to-OctetString conversion method specified in .

Curve brainpoolP224r1 dA = 39F155483CEE191FBECFE9C81D8AB1A03CDA6790E7184ACE44BCA161 x_qA = A9C21A569759DA95E0387041184261440327AFE33141CA04B82DC92E y_qA = 98A0F75FBBF61D8E58AE5511B2BCDBE8E549B31E37069A2825F590C1 dB = 6060552303899E2140715816C45B57D9B42204FB6A5BF5BEAC10DB00 x_qB = 034A56C550FF88056144E6DD56070F54B0135976B5BF77827313F36B y_qB = 75165AD99347DC86CAAB1CBB579E198EAF88DC35F927B358AA683681 x_Z = 1A4BFE705445120C8E3E026699054104510D119757B74D5FE2462C66 y_Z = BB6802AC01F8B7E91B1A1ACFB9830A95C079CEC48E52805DFD7D2AFE

Curve brainpoolP256r1 dA = 81DB1EE100150FF2EA338D708271BE38300CB54241D79950F77B063039804F1D x_qA = 44106E913F92BC02A1705D9953A8414DB95E1AAA49E81D9E85F929A8E3100BE5 y_qA = 8AB4846F11CACCB73CE49CBDD120F5A900A69FD32C272223F789EF10EB089BDC dB = 55E40BC41E37E3E2AD25C3C6654511FFA8474A91A0032087593852D3E7D76BD3 x_qB = 8D2D688C6CF93E1160AD04CC4429117DC2C41825E1E9FCA0ADDD34E6F1B39F7B y_qB = 990C57520812BE512641E47034832106BC7D3E8DD0E4C7F1136D7006547CEC6A x_Z = 89AFC39D41D3B327814B80940B042590F96556EC91E6AE7939BCE31F3A18BF2B y_Z = 49C27868F4ECA2179BFD7D59B1E3BF34C1DBDE61AE12931648F43E59632504DE

Curve brainpoolP384r1 dA = 1E20F5E048A5886F1F157C74E91BDE2B98C8B52D58E5003D57053FC4B0BD65D6F15EB5D1EE1610DF870795143627D042 x_qA = 68B665DD91C195800650CDD363C625F4E742E8134667B767B1B476793588F885AB698C852D4A6E77A252D6380FCAF068 y_qA = 55BC91A39C9EC01DEE36017B7D673A931236D2F1F5C83942D049E3FA20607493E0D038FF2FD30C2AB67D15C85F7FAA59 dB = 032640BC6003C59260F7250C3DB58CE647F98E1260ACCE4ACDA3DD869F74E01F8BA5E0324309DB6A9831497ABAC96670 x_qB = 4D44326F269A597A5B58BBA565DA5556ED7FD9A8A9EB76C25F46DB69D19DC8CE6AD18E404B15738B2086DF37E71D1EB4 y_qB = 62D692136DE56CBE93BF5FA3188EF58BC8A3A0EC6C1E151A21038A42E9185329B5B275903D192F8D4E1F32FE9CC78C48 x_Z = 0BD9D3A7EA0B3D519D09D8E48D0785FB744A6B355E6304BC51C229FBBCE239BBADF6403715C35D4FB2A5444F575D4F42 y_Z = 0DF213417EBE4D8E40A5F76F66C56470C489A3478D146DECF6DF0D94BAE9E598157290F8756066975F1DB34B2324B7BD

Curve brainpoolP512r1 dA = 16302FF0DBBB5A8D733DAB7141C1B45ACBC8715939677F6A56850A38BD87BD59B09E80279609FF333EB9D4C061231FB26F92EEB04982A5F1D1764CAD57665422 x_qA = 0A420517E406AAC0ACDCE90FCD71487718D3B953EFD7FBEC5F7F27E28C6149999397E91E029E06457DB2D3E640668B392C2A7E737A7F0BF04436D11640FD09FD y_qA = 72E6882E8DB28AAD36237CD25D580DB23783961C8DC52DFA2EC138AD472A0FCEF3887CF62B623B2A87DE5C588301EA3E5FC269B373B60724F5E82A6AD147FDE7 dB = 230E18E1BCC88A362FA54E4EA3902009292F7F8033624FD471B5D8ACE49D12CFABBC19963DAB8E2F1EBA00BFFB29E4D72D13F2224562F405CB80503666B25429 x_qB = 9D45F66DE5D67E2E6DB6E93A59CE0BB48106097FF78A081DE781CDB31FCE8CCBAAEA8DD4320C4119F1E9CD437A2EAB3731FA9668AB268D871DEDA55A5473199F y_qB = 2FDC313095BCDD5FB3A91636F07A959C8E86B5636A1E930E8396049CB481961D365CC11453A06C719835475B12CB52FC3C383BCE35E27EF194512B71876285FA x_Z = A7927098655F1F9976FA50A9D566865DC530331846381C87256BAF3226244B76D36403C024D7BBF0AA0803EAFF405D3D24F11A9B5C0BEF679FE1454B21C4CD1F y_Z = 7DB71C3DEF63212841C463E881BDCF055523BD368240E6C3143BD8DEF8B3B3223B95E0F53082FF5E412F4222537A43DF1C6D25729DDB51620A832BE6A26680A2