< draft-kivinen-ipsecme-oob-pubkey-10.txt		draft-kivinen-ipsecme-oob-pubkey-11.txt >
	IP Security Maintenance and Extensions (ipsecme) T. Kivinen		Network Working Group T. Kivinen
	Internet-Draft INSIDE Secure		Internet-Draft INSIDE Secure
	Updates: 7296 (if approved) P. Wouters		Updates: 7296 (if approved) P. Wouters
	Intended status: Standards Track Red Hat		Intended status: Standards Track Red Hat
	Expires: October 22, 2015 H. Tschofenig		Expires: February 27, 2016 H. Tschofenig
	April 20, 2015		August 26, 2015
	More Raw Public Keys for IKEv2		More Raw Public Keys for IKEv2
	draft-kivinen-ipsecme-oob-pubkey-10.txt		draft-kivinen-ipsecme-oob-pubkey-11.txt
	Abstract		Abstract
	The Internet Key Exchange Version 2 (IKEv2) protocol currently only		The Internet Key Exchange Version 2 (IKEv2) protocol currently only
	supports raw RSA keys. In constrained environments it is useful to		supports raw RSA keys. In constrained environments it is useful to
	make use of other types of public keys, such as those based on		make use of other types of public keys, such as those based on
	Elliptic Curve Cryptography. This documents adds support for other		Elliptic Curve Cryptography. This documents adds support for other
	types of raw public keys to IKEv2.		types of raw public keys to IKEv2.
	Status of This Memo		Status of this Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on October 22, 2015.		This Internet-Draft will expire on February 27, 2016.
	Copyright Notice		Copyright Notice
	Copyright (c) 2015 IETF Trust and the persons identified as the		Copyright (c) 2015 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must		to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	described in the Simplified BSD License.		described in the Simplified BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
	2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3		2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
	3. Certificate Encoding Payload . . . . . . . . . . . . . . . . 3		3. Certificate Encoding Payload . . . . . . . . . . . . . . . . . 4
	4. Security Considerations . . . . . . . . . . . . . . . . . . . 4		4. Security Considerations . . . . . . . . . . . . . . . . . . . 5
	5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5		5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5
	6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 5		6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 5
	7. References . . . . . . . . . . . . . . . . . . . . . . . . . 5		7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 6
	7.1. Normative References . . . . . . . . . . . . . . . . . . 5		7.1. Normative References . . . . . . . . . . . . . . . . . . . 6
	7.2. Informative References . . . . . . . . . . . . . . . . . 5		7.2. Informative References . . . . . . . . . . . . . . . . . . 6
	Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 6		Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 7
	A.1. ECDSA Example . . . . . . . . . . . . . . . . . . . . . . 6		A.1. ECDSA Example . . . . . . . . . . . . . . . . . . . . . . 7
	A.2. RSA Example . . . . . . . . . . . . . . . . . . . . . . . 8		A.2. RSA Example . . . . . . . . . . . . . . . . . . . . . . . 8
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 10
	1. Introduction		1. Introduction
	Secure DNS allows public keys to be associated with domain names for		Secure DNS allows public keys to be associated with domain names for
	usage with security protocols like Internet Key Exchange Version 2		usage with security protocols like Internet Key Exchange Version 2
	(IKEv2) [RFC7296] and Transport Layer Security (TLS) [RFC5246] but it		(IKEv2) [RFC7296] and Transport Layer Security (TLS) [RFC5246] but it
	relies on extensions in those protocols to be specified.		relies on extensions in those protocols to be specified.
	In [RFC5996] IKEv2 had support for PKCS #1 encoded RSA keys, i.e., a		In [RFC5996] IKEv2 had support for PKCS #1 encoded RSA keys, i.e., a
	DER-encoded RSAPublicKey structure (see [RSA] and [RFC3447]). Other		DER-encoded RSAPublicKey structure (see [RSA] and [RFC3447]). Other
	skipping to change at page 5, line 22 ¶		skipping to change at page 6, line 4 ¶
	Encodings registry:		Encodings registry:
	TBD Raw Public Key		TBD Raw Public Key
	6. Acknowledgements		6. Acknowledgements
	This document reproduces some parts of the similar TLS document		This document reproduces some parts of the similar TLS document
	([RFC7250]).		([RFC7250]).
	7. References		7. References
	7.1. Normative References		7.1. Normative References
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/
			RFC2119, March 1997,
			<http://www.rfc-editor.org/info/rfc2119>.
	[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,		[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
	Housley, R., and W. Polk, "Internet X.509 Public Key		Housley, R., and W. Polk, "Internet X.509 Public Key
	Infrastructure Certificate and Certificate Revocation List		Infrastructure Certificate and Certificate Revocation List
	(CRL) Profile", RFC 5280, May 2008.		(CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
			<http://www.rfc-editor.org/info/rfc5280>.
	[RFC7296] Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T.		[RFC7296] Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T.
	Kivinen, "Internet Key Exchange Protocol Version 2		Kivinen, "Internet Key Exchange Protocol Version 2
	(IKEv2)", STD 79, RFC 7296, October 2014.		(IKEv2)", STD 79, RFC 7296, DOI 10.17487/RFC7296,
			October 2014, <http://www.rfc-editor.org/info/rfc7296>.
	[RFC7427] Kivinen, T. and J. Snyder, "Signature Authentication in		[RFC7427] Kivinen, T. and J. Snyder, "Signature Authentication in
	the Internet Key Exchange Version 2 (IKEv2)", RFC 7427,		the Internet Key Exchange Version 2 (IKEv2)", RFC 7427,
	January 2015.		DOI 10.17487/RFC7427, January 2015,
			<http://www.rfc-editor.org/info/rfc7427>.
	7.2. Informative References		7.2. Informative References
	[RFC3447] Jonsson, J. and B. Kaliski, "Public-Key Cryptography		[RFC3447] Jonsson, J. and B. Kaliski, "Public-Key Cryptography
	Standards (PKCS) #1: RSA Cryptography Specifications		Standards (PKCS) #1: RSA Cryptography Specifications
	Version 2.1", RFC 3447, February 2003.		Version 2.1", RFC 3447, DOI 10.17487/RFC3447,
			February 2003, <http://www.rfc-editor.org/info/rfc3447>.
	[RFC4025] Richardson, M., "A Method for Storing IPsec Keying		[RFC4025] Richardson, M., "A Method for Storing IPsec Keying
	Material in DNS", RFC 4025, March 2005.		Material in DNS", RFC 4025, DOI 10.17487/RFC4025,
			March 2005, <http://www.rfc-editor.org/info/rfc4025>.
	[RFC4055] Schaad, J., Kaliski, B., and R. Housley, "Additional		[RFC4055] Schaad, J., Kaliski, B., and R. Housley, "Additional
	Algorithms and Identifiers for RSA Cryptography for use in		Algorithms and Identifiers for RSA Cryptography for use in
	the Internet X.509 Public Key Infrastructure Certificate		the Internet X.509 Public Key Infrastructure Certificate
	and Certificate Revocation List (CRL) Profile", RFC 4055,		and Certificate Revocation List (CRL) Profile", RFC 4055,
	June 2005.		DOI 10.17487/RFC4055, June 2005,
			<http://www.rfc-editor.org/info/rfc4055>.
	[RFC4754] Fu, D. and J. Solinas, "IKE and IKEv2 Authentication Using		[RFC4754] Fu, D. and J. Solinas, "IKE and IKEv2 Authentication Using
	the Elliptic Curve Digital Signature Algorithm (ECDSA)",		the Elliptic Curve Digital Signature Algorithm (ECDSA)",
	RFC 4754, January 2007.		RFC 4754, DOI 10.17487/RFC4754, January 2007,
			<http://www.rfc-editor.org/info/rfc4754>.
	[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security		[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
	(TLS) Protocol Version 1.2", RFC 5246, August 2008.		(TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/
			RFC5246, August 2008,
			<http://www.rfc-editor.org/info/rfc5246>.
	[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk,		[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk,
	"Elliptic Curve Cryptography Subject Public Key		"Elliptic Curve Cryptography Subject Public Key
	Information", RFC 5480, March 2009.		Information", RFC 5480, DOI 10.17487/RFC5480, March 2009,
			<http://www.rfc-editor.org/info/rfc5480>.
	[RFC5996] Kaufman, C., Hoffman, P., Nir, Y., and P. Eronen,		[RFC5996] Kaufman, C., Hoffman, P., Nir, Y., and P. Eronen,
	"Internet Key Exchange Protocol Version 2 (IKEv2)", RFC		"Internet Key Exchange Protocol Version 2 (IKEv2)",
	5996, September 2010.		RFC 5996, DOI 10.17487/RFC5996, September 2010,
			<http://www.rfc-editor.org/info/rfc5996>.
	[RFC6394] Barnes, R., "Use Cases and Requirements for DNS-Based		[RFC6394] Barnes, R., "Use Cases and Requirements for DNS-Based
	Authentication of Named Entities (DANE)", RFC 6394,		Authentication of Named Entities (DANE)", RFC 6394,
	October 2011.		DOI 10.17487/RFC6394, October 2011,
			<http://www.rfc-editor.org/info/rfc6394>.
	[RFC7250] Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and		[RFC7250] Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J.,
	T. Kivinen, "Using Raw Public Keys in Transport Layer		Weiler, S., and T. Kivinen, "Using Raw Public Keys in
	Security (TLS) and Datagram Transport Layer Security		Transport Layer Security (TLS) and Datagram Transport
	(DTLS)", RFC 7250, June 2014.		Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250,
			June 2014, <http://www.rfc-editor.org/info/rfc7250>.
	[RSA] R. Rivest, , A. Shamir, , and L. Adleman, "A Method for		[RSA] R. Rivest, A. Shamir, and L. Adleman, "A Method for
	Obtaining Digital Signatures and Public-Key		Obtaining Digital Signatures and Public-Key
	Cryptosystems", February 1978.		Cryptosystems", February 1978.
	Appendix A. Examples		Appendix A. Examples
	This appendix provides examples of the actual payloads sent on the		This appendix provides examples of the actual payloads sent on the
	wire.		wire.
	A.1. ECDSA Example		A.1. ECDSA Example
End of changes. 21 change blocks.
	38 lines changed or deleted		52 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/