]> secunet Security Networks

Mergenthaler Allee 77 65760 Eschborn Germany +49 201 5454 3091 johannes.merkle@secunet.com

Bundesamt fuer Sicherheit in der Informationstechnik (BSI)

Postfach 200363 53133 Bonn Germany +49 228 9582 5643 manfred.lochter@bsi.bund.de

IKE, Elliptic Curve This document specifies the use of ECC Brainpool elliptic curve groups for key exchange in the Internet Key Exchange version 2 (IKEv2) protocol.

In , a new set of elliptic curve groups over finite prime fields for use in cryptographic applications was specified. These groups, denoted as ECC Brainpool curves, were generated in a verifiably pseudo-random way and comply with the security requirements of relevant standards from ISO , ANSI , NIST , and SecG . While the ASN.1 object identifiers defined in RFC 5639 allow usage of the ECC Brainpool curves in certificates and certificate revocation lists, their utilization for key exchange in IKEv2 requires the definition and assignment of additional Diffie-Hellman Group Transform IDs in the respective IANA registry. This document specifies tranform IDs for four curves from RFC 5639 as well as the encoding of the key exchange payload and derivation of the shared secret when using one of these curves.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

In order to use the ECC Brainpool curves for key exchange within IKEv2, the Diffie-Hellman Group Transform IDs (Transform Type 4) listed in the following table are to be registered with IANA . The parameters associated with these curves are defined in RFC 5639 . Curve Transform ID brainpoolP224r1 27 brainpoolP256r1 28 brainpoolP384r1 29 brainpoolP512r1 30 Test vectors for the groups defined by the ECC Brainpool curves are provided in

In for each random curve, a "twisted curve" (defined by a quadratic twist, see ) is defined offering the same level of security but potentially allowing more efficient arithmetic due to the curve parameter A = -3. The transform IDs listed in also allow using the twisted curve corresponding to the specified random curve: points (x,y) of any curve listed in can be efficiently transformed to the corresponding point (x',y') on the twisted curve of same bit length - and vice versa - by setting (x',y') = (x*Z^2, y*Z^3) with the coefficient Z specified for that curve in .

For the encoding of the key exchange payload and the derivation of the shared secret, the methods specified in are adopted. In an ECP key exchange in IKEv2, the Diffie-Hellman public value passed in a KE payload consists of two components, x and y, corresponding to the coordinates of an elliptic curve point. Each component MUST be computed from the corresponding coordinate using the FieldElement-to-OctetString conversion method specified in and MUST have bit length as indicated in . This length is enforced by the FieldElement-to-OctetString conversion method, if necessary, by prepending the value with zeros. Note: The FieldElement-to-OctetString conversion method specified in is equivalent to applying the conversion between integers and octet strings of Section 6 of after representing the field element as integer in the interval [0, p-1]. Curves Bit length of each component (x or y) Bit length of key exchange payload brainpoolP224r1 224448 brainpoolP256r1 256512 brainpoolP384r1 384768 brainpoolP512r1 5121024 From these components, the key exchange payload MUST be computed as the concatenation of the x and y coordinates. Hence, the key exchange payload has the bit length indicated in . The Diffie-Hellman shared secret value consists only of the x value. In particular, the shared secret value MUST be computed from the x coordinate of the Diffie-Hellman common value using the FieldElement-to-OctetString conversion method specified in and MUST have bit length as indicated in the .

The security considerations of apply accordingly. In order to thwart certain active attacks, the validity of the other peer's public Diffie-Hellmann value (x,y) recovered from the received key exchange payload needs to be verified. In particular, it must be verified that the coordinates x and y of the public value satisfy the curve equation. The confidentiality, authenticity and integrity of a secure communication based on IKEv2 is limited by the weakest cryptographic primitive applied. In order to achieve a maximum security level when using one of the elliptic curves from for key exchange, the key derivation function, the algorithms and key lengths of symmetric encryption and message authentication as well as the algorithm, bit length and hash function used for signature generation should be chosen according to the recommendations of and . Furthermore, the private Diffie-Hellman keys should be selected with the same bit length as the order of the group generated by the base point G and with approximately maximum entropy. Implementations of elliptic curve cryptography for IKEv2 could be susceptible to side-channel attacks. Particular care should be taken for implementations that internally use the corresponding twisted curve to take advantage of an efficient arithmetic for the special parameters (A = -3): although the twisted curve itself offers the same level of security as the corresponding random curve (through mathematical equivalence), an arithmetic based on small curve parameters could be harder to protect against side-channel attacks. General guidance on resistence of elliptic curve cryptography implementations against side-channel-attacks is given in and .

IANA has updated its Transform Type 4 (Diffie-Hellman Group Transform) registry in to include the groups listed in .

Internet Assigned Numbers Authority Harvard University

1350 Mass. Ave. Cambridge MA 02138 - +1 617 495 3864 sob@harvard.edu

General keyword Certicom Research American National Standards Institute Bundesamt fuer Sicherheit in der Informationstechnik National Institute of Standards and Technology International Organization for Standardization International Organization for Standardization National Institute of Standards and Technology This note describes the fundamental algorithms of Elliptic Curve Cryptography (ECC) as they were defined in some seminal references from 1994 and earlier. These descriptions may be useful for implementing the fundamental algorithms without using any of the specialized methods that were developed in following years. Only elliptic curves defined over fields of characteristic greater than three are in scope; these curves are those used in Suite B. This document is not an Internet Standards Track specification; it is published for informational purposes. Certicom Research

This section provides some test vectors for example Diffie-Hellman key exchanges using each of the curves defined in . In all of the following sections the following notation is used: d_A: the secret key of party A x_qA: the x-coordinate of the public key of party A y_qA: the y-coordinate of the public key of party A d_B: the secret key of party B x_qB: the x-coordinate of the public key of party B y_qB: the y-coordinate of the public key of party B x_Z: the x-coordinate of the shared secret that results from completion of the Diffie-Hellman computation y_Z: the y-coordinate of the shared secret that results from completion of the Diffie-Hellman computation The field elements x_qA, y_qA, x_qB, y_qB, x_Z, y_Z are represented as hexadecimal values using the FieldElement-to-OctetString conversion method specified in .

Curve brainpoolP224r1 dA = 39F155483CEE191FBECFE9C81D8AB1A03CDA6790E7184ACE44BCA161 x_qA = A9C21A569759DA95E0387041184261440327AFE33141CA04B82DC92E y_qA = 98A0F75FBBF61D8E58AE5511B2BCDBE8E549B31E37069A2825F590C1 dB = 6060552303899E2140715816C45B57D9B42204FB6A5BF5BEAC10DB00 x_qB = 034A56C550FF88056144E6DD56070F54B0135976B5BF77827313F36B y_qB = 75165AD99347DC86CAAB1CBB579E198EAF88DC35F927B358AA683681 x_Z = 1A4BFE705445120C8E3E026699054104510D119757B74D5FE2462C66 y_Z = BB6802AC01F8B7E91B1A1ACFB9830A95C079CEC48E52805DFD7D2AFE

Curve brainpoolP256r1 dA = 81DB1EE100150FF2EA338D708271BE38300CB54241D79950F77B063039804F1D x_qA = 44106E913F92BC02A1705D9953A8414DB95E1AAA49E81D9E85F929A8E3100BE5 y_qA = 8AB4846F11CACCB73CE49CBDD120F5A900A69FD32C272223F789EF10EB089BDC dB = 55E40BC41E37E3E2AD25C3C6654511FFA8474A91A0032087593852D3E7D76BD3 x_qB = 8D2D688C6CF93E1160AD04CC4429117DC2C41825E1E9FCA0ADDD34E6F1B39F7B y_qB = 990C57520812BE512641E47034832106BC7D3E8DD0E4C7F1136D7006547CEC6A x_Z = 89AFC39D41D3B327814B80940B042590F96556EC91E6AE7939BCE31F3A18BF2B y_Z = 49C27868F4ECA2179BFD7D59B1E3BF34C1DBDE61AE12931648F43E59632504DE

Curve brainpoolP384r1 dA = 1E20F5E048A5886F1F157C74E91BDE2B98C8B52D58E5003D57053FC4B0BD65D6F15EB5D1EE1610DF870795143627D042 x_qA = 68B665DD91C195800650CDD363C625F4E742E8134667B767B1B476793588F885AB698C852D4A6E77A252D6380FCAF068 y_qA = 55BC91A39C9EC01DEE36017B7D673A931236D2F1F5C83942D049E3FA20607493E0D038FF2FD30C2AB67D15C85F7FAA59 dB = 032640BC6003C59260F7250C3DB58CE647F98E1260ACCE4ACDA3DD869F74E01F8BA5E0324309DB6A9831497ABAC96670 x_qB = 4D44326F269A597A5B58BBA565DA5556ED7FD9A8A9EB76C25F46DB69D19DC8CE6AD18E404B15738B2086DF37E71D1EB4 y_qB = 62D692136DE56CBE93BF5FA3188EF58BC8A3A0EC6C1E151A21038A42E9185329B5B275903D192F8D4E1F32FE9CC78C48 x_Z = 0BD9D3A7EA0B3D519D09D8E48D0785FB744A6B355E6304BC51C229FBBCE239BBADF6403715C35D4FB2A5444F575D4F42 y_Z = 0DF213417EBE4D8E40A5F76F66C56470C489A3478D146DECF6DF0D94BAE9E598157290F8756066975F1DB34B2324B7BD

Curve brainpoolP512r1 dA = 16302FF0DBBB5A8D733DAB7141C1B45ACBC8715939677F6A56850A38BD87BD59B09E80279609FF333EB9D4C061231FB26F92EEB04982A5F1D1764CAD57665422 x_qA = 0A420517E406AAC0ACDCE90FCD71487718D3B953EFD7FBEC5F7F27E28C6149999397E91E029E06457DB2D3E640668B392C2A7E737A7F0BF04436D11640FD09FD y_qA = 72E6882E8DB28AAD36237CD25D580DB23783961C8DC52DFA2EC138AD472A0FCEF3887CF62B623B2A87DE5C588301EA3E5FC269B373B60724F5E82A6AD147FDE7 dB = 230E18E1BCC88A362FA54E4EA3902009292F7F8033624FD471B5D8ACE49D12CFABBC19963DAB8E2F1EBA00BFFB29E4D72D13F2224562F405CB80503666B25429 x_qB = 9D45F66DE5D67E2E6DB6E93A59CE0BB48106097FF78A081DE781CDB31FCE8CCBAAEA8DD4320C4119F1E9CD437A2EAB3731FA9668AB268D871DEDA55A5473199F y_qB = 2FDC313095BCDD5FB3A91636F07A959C8E86B5636A1E930E8396049CB481961D365CC11453A06C719835475B12CB52FC3C383BCE35E27EF194512B71876285FA x_Z = A7927098655F1F9976FA50A9D566865DC530331846381C87256BAF3226244B76D36403C024D7BBF0AA0803EAFF405D3D24F11A9B5C0BEF679FE1454B21C4CD1F y_Z = 7DB71C3DEF63212841C463E881BDCF055523BD368240E6C3143BD8DEF8B3B3223B95E0F53082FF5E412F4222537A43DF1C6D25729DDB51620A832BE6A26680A2