idnits 2.17.1 draft-popov-cryptopro-cpalgs-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- ** The document seems to lack a 1id_guidelines paragraph about 6 months document validity -- however, there's a paragraph with a matching beginning. Boilerplate error? Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 770 has weird spacing: '... mode gost2...' == Line 810 has weird spacing: '... mode gost2...' == Line 851 has weird spacing: '... mode gost2...' == Line 891 has weird spacing: '... mode gost2...' == Line 931 has weird spacing: '... mode gost2...' == (4 more instances...) == The document seems to lack the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. (The document does seem to have the reference to RFC 2119 which the ID-Checklist requires). -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (February 15, 2004) is 7377 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '8' on line 253 -- Looks like a reference, but probably isn't: '0' on line 262 -- Looks like a reference, but probably isn't: '7' on line 262 == Missing Reference: 'GOST341194' is mentioned on line 438, but not defined ** Obsolete normative reference: RFC 2246 (ref. 'TLS') (Obsoleted by RFC 4346) Summary: 5 errors (**), 0 flaws (~~), 9 warnings (==), 5 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Internet Draft Vladimir Popov, CRYPTO-PRO 3 Igor Kurepkin, CRYPTO-PRO 4 Expires August 15, 2004 Serguei Leontiev, CRYPTO-PRO 5 Intended Category: Informational February 15, 2004 7 Additional cryptographic algorithms for use with GOST 28147-89, 8 GOST R 34.10-94, GOST R 34.10-2001, and GOST R 34.11-94 algorithms. 10 12 Status of this Memo 14 This document is an Internet-Draft and is subject to all provisions 15 of Section 10 of RFC2026. 17 Internet-Drafts are working documents of the Internet Engineering 18 Task Force (IETF), its areas, and its working groups. Note that 19 other groups may also distribute working documents as Internet- 20 Drafts. 22 Internet-Drafts are draft documents valid for a maximum of six months 23 and may be updated, replaced, or made obsolete by other documents at 24 any time. It is inappropriate to use Internet-Drafts as reference 25 material or to cite them other than as "work in progress." 27 The list of current Internet-Drafts can be accessed at 28 http://www.ietf.org/1id-abstracts.html 30 The list of Internet-Draft Shadow Directories can be accessed at 31 http://www.ietf.org/shadow.html 33 Abstract 35 This document describes cryprographic algorithms and parameters, 36 supplementary to GOST 28147-89, GOST R 34.10-94, GOST R 34.10-2001 37 and GOST R 34.11-94, for use in internet applications. 39 Table of Contents 40 1 Introduction . . . . . . . . . . . . . . . . . . . . . . 2 41 1.2 Terminology. . . . . . . . . . . . . . . . . . . . . . . 3 42 2 Cipher algorithms. . . . . . . . . . . . . . . . . . . . 3 43 2.1 GOST 28147-89 CBC mode . . . . . . . . . . . . . . . . . 3 44 2.2 Key meshing algorithms . . . . . . . . . . . . . . . . . 3 45 3 HMAC_GOSTR3411 . . . . . . . . . . . . . . . . . . . . . 4 46 4 PRF_GOSTR3411. . . . . . . . . . . . . . . . . . . . . . 4 47 5 Key establishment algorithms . . . . . . . . . . . . . . 4 48 5.1 Creating exchange key using GOST R 34.10-94 keys . . . . 4 49 5.2 Creating exchange key using GOST R 34.10-2001 keys . . . 4 50 5.3 Generating export key from exchange key. . . . . . . . . 4 51 5.4 Key export using export key. . . . . . . . . . . . . . . 4 52 5.5 Key export using exchange key. . . . . . . . . . . . . . 4 53 5.6 Key Diversification. . . . . . . . . . . . . . . . . . . 4 54 5.7 VKO GOST R 34.10-94 and VKO GOST R 34.10-2001 algorithms 4 55 5.7.1 'Simple export' mode . . . . . . . . . . . . . . . . . . 4 56 5.7.2 'CryptoPro' mode . . . . . . . . . . . . . . . . . . . . 4 57 6 Algorithm parameters . . . . . . . . . . . . . . . . . . 4 58 6.1 Encryption algorithm parameters . . . . . . . . . . . . 4 59 6.2 Digest algorithm parameters. . . . . . . . . . . . . . . 4 60 6.3 GOST R 34.10-94 public key algorithm parameters . . . . 4 61 6.4 GOST R 34.10-2001 public key algorithm parameters. . . . 4 62 7 Security Considerations. . . . . . . . . . . . . . . . . 11 63 8 Appendix ASN.1 Modules . . . . . . . . . . . . . . . . . 27 64 9 References . . . . . . . . . . . . . . . . . . . . . . . 27 65 10 Acknowledgments. . . . . . . . . . . . . . . . . . . . . 29 66 Author's Address. . . . . . . . . . . . . . . . . . . . . . . . 29 67 Full Copyright Statement. . . . . . . . . . . . . . . . . . . . 30 69 1 Introduction 71 This document describes cryprographic algorithms, used in supplement 72 to GOST 28147-89, GOST R 34.10-94, GOST R 34.10-2001 and GOST R 73 34.11-94, proposed by CRYPTO-PRO Company for "Russian Cryptographic 74 Software Compatibility Agreement" community. GOST 28147-89, GOST R 75 34.10-94, GOST R 34.10-2001 and GOST R 34.11-94 are defined in 76 corresponding national standards - [GOST28147], [GOSTR341094], 77 [GOSTR34102001] and [GOSTR341194]. Their brief technical description 78 in english can be found in [Schneier95]. 80 1.2 Terminology 82 In this document, the key words MUST, MUST NOT, REQUIRED, SHOULD, 83 SHOULD NOT, RECOMMENDED, and MAY are to be interpreted as described 84 in [RFC 2119]. 86 The following functions and operators are also used in this document: 88 encryptECB (K, D) - is D, encrypted with key K using GOST 28147-89 in 89 "prostaya zamena" (ECB) mode 91 decryptECB (K, D) - is D, decrypted with key K using GOST 28147-89 in 92 ECB mode 94 encryptCFB (I, K, D) - is D, encrypted with key K using GOST 28147-89 95 in "gammirovanie s obratnoj svyaziyu" (64-bit CFB) mode, and I as 96 initialization vector. 98 encryptOFB (I, K, D) - is D, encrypted with key K using GOST 28147-89 99 in "gammirovanie" (64-bit OFB) mode, and I as initialization vector. 101 gostR3411 (D) - is the 256-bit result of GOST R 34.11-94 hash 102 function, used with zero intitialization vector, and UZ parameter, 103 defined by gostR3411CryptoProParamSetAI (see Appendix, 104 GostR3411-94-ParamSetSyntax module). 106 gost28147IMIT (I, K, D) - is the 32-bit result of GOST 28147-89 in 107 "imitovstavka" (MAC) mode, used with D as plaintext, K as key and I 108 as initialization vector. Note, that standard specifies it's use in 109 this mode only with zero initialization vector. 111 2 Cipher parameters 113 [GOST28147] defines only the basic cryptographic operations, which 114 can be used to encrypt or decrypt data. This document defines an 115 additional cipher mode GOST 28147-89 CBC, and key meshing algorithm, 116 which can be used to protect a symmetric key, when it is used to 117 process large amounts of data. 119 The cipher mode, key meshing algorithm, padding mode and S-box are 120 specified by algorithm parameters. 122 2.1 GOST 28147-89 CBC mode 124 Algorithm GOST 28147-89 CBC mode is a block cipher with block 125 chaining, based on GOST 28147-89 in ECB mode. 127 Before each plaintext block is encrypted, it is combined with the 128 cipher text of the previous block by a bitwise exclusive OR 129 operation. This ensures that even if the plaintext contains many 130 identical blocks, they will each encrypt to a different cipher text 131 block. The initialization vector is combined with the first 132 plaintext block by a bitwise exclusive OR operation before the block 133 is encrypted. 135 Let x (0 < x < 8) be the number of bytes in the last (possibly, 136 incomplete) block of data. There are three padding modes: 137 * Zero padding: 8-x remaining bytes are filled with zero 138 * PKCS#5 padding: 8-x remaining bytes are filled with value of 8-x. 139 If there's no incomplete block, one extra block filled with value 140 8 is added. 141 * Random padding: 8-x remaining bytes of the last block are set to 142 random. 144 2.2 Key meshing algorithms 146 When there is a need to limit the amount of data, enciphered with the 147 same key, several key meshing algorithms can be used. 149 id-Gost28147-89-None-KeyMeshing OBJECT IDENTIFIER ::= 150 { id-CryptoPro-algorithms keyMeshing(14) none(0) } 152 This is a zero key meshing algorithm - key is never changed. 154 id-Gost28147-89-CryptoPro-KeyMeshing OBJECT IDENTIFIER ::= 155 { id-CryptoPro-algorithms keyMeshing(14) cryptoPro(1) } 157 This algorithm transforms the key and initialization vector every 1KB 158 of plaintext data, using the following rule: 160 Let K[i] be the previous key, and S[i] be the previous initialization 161 vector. 163 K[i+1] = decryptECB (K[i], C); S[i+1] = encryptECB (K[i+1],S[i]) 165 Where C = {0x22720069L, 0x2304C964L, 0x96DB3A8DL, 0xC42AE946L, 166 0x94ACFE18L, 0x1207ED00L, 0xC2DC86C0L, 0x2BA94CEFL}; 168 3 HMAC_GOSTR3411 170 HMAC_GOSTR3411 (K,text) function is based on hash function GOST R 171 34.11-94, as defined in [HMAC], with the following parameter values: 172 B = 32, L = 32. 174 4 PRF_GOSTR3411 176 PRF_GOSTR3411 is a pseudorandom function, based on HMAC_GOSTR3411. 177 It is calculated as P_hash, defined in section 5 of [TLS]. 178 PRF_GOSTR3411(K,D) = P_GOSTR3411 (K,D) 180 5 Key establishment algorithms 182 Standards [GOSTR341094] and [GOSTR34102001] do not define any key 183 establishment algorithms. 185 Section 5.7 specifies algorithms VKO GOST R 34.10-94 and VKO GOST R 186 34.10-2001, which can be used to export/import session key using a 187 one-time exchange key (symmetric key, shared by sender and 188 recipient), based on sender's private key and recipient public key, 189 or vice versa. 191 Sections 5.1 and 5.2 describe how to create an exchange key from 192 sender's private key and recipient public key, or vice versa. 194 Section 5.3 describes how to create an export key from an exchange 195 key or symmetric key. 197 Sections 5.4 and 5.5 describe, how a session key can be exported 198 (encrypted) using export key, or using exchange key directly. 200 Section 5.6 describes, how to create session keys, using secret key 201 and diversification data. 203 5.1 Creating exchange key using GOST R 34.10-94 keys 205 This algorithm creates an exchange key using sender's private key and 206 recipient public key, or vice versa, using GOST R 34.10-94 public key 207 algorithm and GOST R 34.11-94 hash function. 209 Exchange key EK is a 256-bit hash of 1024-bit Diffie-Hellman key 210 K(x,y); 212 EK = gostR3411 (K(x,y)) 213 K(x,y) = a^(x*y) (mod p), where 215 x - sender's private key, a^x - sender's public key 216 y - recipient's private key, a^y - recipient's public key 218 Keys x and y MUST comply with [GOSTR341094]. 220 This algorithm MUST NOT be used, when a^x = a (mod p) or a^y = a (mod 221 p). 223 5.2 Creating exchange key using GOST R 34.10-2001 keys 225 This algorithm creates an exchange key using sender's private key and 226 recipient public key, or vice versa, using GOST R 34.10-2001 public 227 key algorithm and GOST R 34.11-94 hash function. 229 Exchange key EK is a 256-bit hash of K(x,y,a); 231 EK(x,y,a) = gostR3411 (K(x,y,a)) 232 K(x,y,a) = ((a*x)(mod q)) . (y.P) (512 bit), where 233 x - sender's private key (256 bit) 234 x.P - sender's public key (512 bit) 235 y - recipient's private key (256 bit) 236 y.P - recipient's public key (512 bit) 237 a - synchrovector (64 bit) 238 P - base point on the elliptic curve (two 256-bit coordinates) 239 a*x - x multiplied by a as integers 240 x.P - a multiple point 242 Keys x and y MUST comply with [GOSTR34102001]. 244 This algorithm MUST NOT be used, when x.P = P, y.P = P 246 5.3 Generating export key from exchange key 248 Given a random 64-bit synchrovector A, and an exchange key K, 249 produced by algorithms from sections 5.1 and 5.2 (or other shared 250 symmetric key K), this algorithm creates an export key K(A), which 251 can be used to export (encrypt) session key. 253 KA = K[8]. K[0]..K[8] are calculated with following algorithm: 255 K[0] = K; 256 K[i+1] = encryptCFB (S[i], K[i], K[i]) 257 S[i] = ((a[i,0]*k[i,0] + ... + a[i,7]*k[i,7]) mod 2^32) 258 | ((~a[i,0]*k[i,0] + ... + ~a[i,7]*k[i,7]) mod 2^32); 260 Here a[i,j] and k[i,j] are components of A and K[i] respectively: 261 K[i] = k[i,0]|k[i,1]|...|k[i,7] (k[i,j] - 32-bit integer) 262 A = a[0]|...|a[7] (a[i] - byte, a[i,0]..a[i,7] - it's bits) 264 5.4 Key export using export key 266 This algorithm exports session key SK using key K and random 64-bit 267 synchrovector A. Outputs of this algorithm are 32-bit SK_mac and 268 256-bit SK_enc. 270 First, export key KA is created using algorithm, specified in 5.3, 271 from the key K and vector A. 273 Then SK_mac is calculated: SK_mac = gost28147IMIT (A, KA, SK). 275 Then SK is encrypted in ECB mode, using key KA: 276 SK_enc = encryptECB (KA, SK); 278 5.5 Key export using exchange key 280 This algorithm exports session key SK using exchange key K and random 281 64-bit synchrovector A. Outputs of this algorithm are 32-bit SK_mac 282 and 256-bit SK_enc. 284 First, SK_mac is calculated: SK_mac = gost28147IMIT (A, K, SK). 286 Then SK is encrypted in ECB mode, using K for key: 288 SK_enc = encryptECB (K, SK); 290 5.6 Key Diversification 292 This algorithm creates a session key SK, given secret key K and 293 diversification data D of size 4..40 bytes. 295 1) 40-byte blob B is created from D by cloning it enough to fill all 296 40 bytes. For example, if D is 40-bytes long, B = D; If D is 4-bytes 297 long, B = D|D|D|D|D|D|D|D|D|D. 299 2) B is split into 8-byte SV and 32-byte SRCKEY (B = SV|SRCKEY). 301 3) Algorithm from section 5.3 is used to create KA from key K and 302 synchrovector SV, with two differences. Instead of S[i], vector 303 (0,0,0,SV[i],ff,ff,ff,ff XOR SV[i]) is used, and during each 304 encryption step, only 8 out of 32 GOST 28147-89 steps are done. 306 4) SK is calculated: 307 SK = encryptCFB (A, KA, SRCKEY). 309 5.7 VKO GOST R 34.10-94 and VKO GOST R 34.10-2001 algorithms. VKO GOST 310 R 34.10-94 and VKO GOST R 34.10-2001 are key establishment algorithms 311 for GOST R 34.10-94 and GOST R 34.10-2001 keys accordingly. 313 There are two modes they can be used in. 315 5.7.1 'Simple export' mode 317 Identifier for this mode: 319 id-Gost28147-89-None-KeyWrap OBJECT IDENTIFIER ::= 320 { id-CryptoPro-algorithms keyWrap(13) none(0) } 322 The first step is calculating an exchange key, using algorithms, 323 defined in sections 5.1 or 5.2, depending on key type. 325 Then, session key can be exported on this exchange key, using 326 algorithm from section 5.5 328 5.7.2 'CryptoPro' mode 330 Identifier for this mode: 332 id-Gost28147-89-CryptoPro-KeyWrap OBJECT IDENTIFIER ::= 333 { id-CryptoPro-algorithms keyWrap(13) cryptoPro(1) } 335 The first step is calculating an exchange key, using algorithms, 336 defined in sections 5.1 or 5.2, depending on key type. 338 Then, session key is exported on the export key (computed from this 339 exchange key) using algorithm from section 5.4; 341 6 Algorithm parameters 343 Standards [GOST28147], [GOST341194], [GOSTR341094] and 344 [GOSTR34102001] do not define specific values for algorithm 345 parameters. 347 This document introduces the use of OIDs to specify algorithm 348 parameters. 350 Identifiers and corresponding parameter values for all of the 351 proposed parameter sets can be found in Appendix in the form of ASN.1 352 modules [X.660]. 354 6.1 Encryption algorithm parameters 356 GOST 28147-89 can be used in several modes, additional CBC mode is 357 defined in section 2.1 this document. It also has an S-Box parameter 358 (see Algorithm Parameters part in [GOST28147] in Russian, description 359 in English see in [Schneier95] ch. 14.1, p. 331). 361 This table contains the list of proposed parameter sets for GOST 362 28147-89: 364 Gost28147-89-ParamSetAlgorithms ALGORITHM-IDENTIFIER ::= { 365 { Gost28147-89-ParamSetParameters IDENTIFIED BY 366 id-Gost28147-89-TestParamSet } | 367 { Gost28147-89-ParamSetParameters IDENTIFIED BY 368 id-Gost28147-89-CryptoPro-A-ParamSet } | 369 { Gost28147-89-ParamSetParameters IDENTIFIED BY 370 id-Gost28147-89-CryptoPro-B-ParamSet } | 371 { Gost28147-89-ParamSetParameters IDENTIFIED BY 372 id-Gost28147-89-CryptoPro-C-ParamSet } | 373 { Gost28147-89-ParamSetParameters IDENTIFIED BY 374 id-Gost28147-89-CryptoPro-D-ParamSet } | 375 { Gost28147-89-ParamSetParameters IDENTIFIED BY 376 id-Gost28147-89-CryptoPro-Simple-A-ParamSet } | 377 { Gost28147-89-ParamSetParameters IDENTIFIED BY 378 id-Gost28147-89-CryptoPro-Simple-B-ParamSet } | 379 { Gost28147-89-ParamSetParameters IDENTIFIED BY 380 id-Gost28147-89-CryptoPro-Simple-C-ParamSet } | 381 { Gost28147-89-ParamSetParameters IDENTIFIED BY 382 id-Gost28147-89-CryptoPro-Simple-D-ParamSet } 383 } 385 Identifier values can be found in Appendix. 387 Parameters for GOST 28147-89 are presented in the following form: 389 Gost28147-89-ParamSetParameters ::= SEQUENCE { 390 eUZ Gost28147-89-UZ, 391 mode INTEGER { 392 gost28147-89-OFB(0), 393 gost28147-89-CFB(1), 394 cryptoPro-CBC(2) 395 }, 396 shiftBits INTEGER { gost28147-89-block(64) }, 397 keyWrap AlgorithmIdentifier {{ 398 Gost28147-89-KeyWrapAlgorithms 399 }}, 400 keyMeshing AlgorithmIdentifier {{ 401 Gost28147-89-KeyMixAlgorithms 402 }} 403 } 404 Gost28147-89-UZ ::= OCTET STRING (SIZE (64)) 405 Gost28147-89-KeyMixAlgorithms ALGORITHM-IDENTIFIER ::= { 406 { NULL IDENTIFIED BY id-Gost28147-89-CryptoPro-KeyMix } | 407 { NULL IDENTIFIED BY id-Gost28147-89-None-KeyMix } 408 } 409 Gost28147-89-KeyWrapAlgorithms ALGORITHM-IDENTIFIER ::= { 410 { NULL IDENTIFIED BY id-Gost28147-89-CryptoPro-KeyWrap } | 411 { NULL IDENTIFIED BY id-Gost28147-89-None-KeyWrap } 412 } 414 where 415 eUZ - S-box value; 416 mode - cipher mode; 417 shiftBits - cipher parameter; 418 keyWrap - key export algorithm identifier; 419 keyMeshing - key meshing algorithm identifier. 421 6.2 Digest algorithm parameters 423 This table contains the list of proposed parameter sets for 424 [GOST341194]: 426 GostR3411-94-ParamSetAlgorithms ALGORITHM-IDENTIFIER ::= { 427 { GostR3411-94-ParamSetParameters IDENTIFIED BY 428 id-GostR3411-94-TestParamSet 429 } | 430 { GostR3411-94-ParamSetParameters IDENTIFIED BY 431 id-GostR3411-94-CryptoProParamSet 432 } 434 } 436 Identifier values can be found in Appendix. 438 Parameters for [GOST341194] are presented in the following form: 440 GostR3411-94-ParamSetParameters ::= 441 SEQUENCE { 442 hUZ Gost28147-89-UZ, -- S-Box for digest 443 h0 GostR3411-94-Digest -- start digest value 444 } 445 GostR3411-94-Digest ::= OCTET STRING (SIZE (32)) 447 6.3 GOST R 34.10-94 public key algorithm parameters 449 This table contains the list of proposed parameter sets for GOST R 450 34.10-94: 452 GostR3410-94-ParamSetAlgorithm ALGORITHM-IDENTIFIER ::= { 453 { GostR3410-94-ParamSetParameters IDENTIFIED BY 454 id-GostR3410-94-TestParamSet } | 455 { GostR3410-94-ParamSetParameters IDENTIFIED BY 456 id-GostR3410-94-CryptoPro-A-ParamSet } | 457 { GostR3410-94-ParamSetParameters IDENTIFIED BY 458 id-GostR3410-94-CryptoPro-B-ParamSet } | 459 { GostR3410-94-ParamSetParameters IDENTIFIED BY 460 id-GostR3410-94-CryptoPro-C-ParamSet } | 461 { GostR3410-94-ParamSetParameters IDENTIFIED BY 462 id-GostR3410-94-CryptoPro-D-ParamSet } | 463 { GostR3410-94-ParamSetParameters IDENTIFIED BY 464 id-GostR3410-94-CryptoPro-XchA-ParamSet } | 465 { GostR3410-94-ParamSetParameters IDENTIFIED BY 466 id-GostR3410-94-CryptoPro-XchB-ParamSet } | 467 { GostR3410-94-ParamSetParameters IDENTIFIED BY 468 id-GostR3410-94-CryptoPro-XchC-ParamSet } 469 } 471 Identifier values can be found in Appendix. 473 Parameters for GOST R 34.10-94 are presented in the following form: 475 GostR3410-94-ParamSetParameters ::= 476 SEQUENCE { 477 p INTEGER, 478 q INTEGER, 479 a INTEGER, 480 validationAlgorithm AlgorithmIdentifier {{ 481 GostR3410-94-ValidationAlgorithms 482 }} OPTIONAL 483 } 485 GostR3410-94-ValidationParameters ::= 486 SEQUENCE { 487 t INTEGER, 488 x0 INTEGER, 489 c INTEGER, 490 d INTEGER OPTIONAL 491 } 493 Where 494 p - modulus, prime number, 2^1023