RFC 4359

The Use of RSA/SHA-1 Signatures within Encapsulating Security Payload (ESP) and Authentication Header (AH)

📅 published January 2006, from ietf

RFC 4359 🎀 The Use of RSA/SHA-1 Signatures within Encapsulating Security Payload (ESP) and Authentication Header (AH)

Part 1 of 3 💖

Okay bestie, let's get the deets first 💅

Author: B. Weis, Cisco Systems
Category: Standards Track
Date: January 2006
Obsoletes / Updates: the header doesn't list anything it obsoletes or updates ✨

Status of This Memo 📜

This doc specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🫶 If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share it with everyone 🌈

Copyright Notice

Abstract ✨

Okay so this memo explains how to use the RSA digital signature algorithm as an authentication algorithm inside the revised IP Encapsulating Security Payload (ESP) from RFC 4303 and the revised IP Authentication Header (AH) from RFC 4302. A digital signature algorithm like RSA gives you data origin authentication in situations where a secret key method (like HMAC) can't, and one example is using ESP and AH to authenticate the sender of an IP multicast packet. It's giving main character energy 👑

Table of Contents 🧚

1. Introduction ....................................................2
2. Algorithm and Mode ..............................................3
   2.1. Key Size Discussion ........................................4
3. Performance .....................................................5
4. Interaction with the ESP Cipher Mechanism .......................6
5. Key Management Considerations ...................................6
6. Security Considerations .........................................7
   6.1. Eavesdropping ..............................................7
   6.2. Replay .....................................................7
   6.3. Message Insertion ..........................................8
   6.4. Deletion ...................................................8
   6.5. Modification ...............................................8
   6.6. Man in the Middle ..........................................8
   6.7. Denial of Service ..........................................8
7. IANA Considerations .............................................9
8. Acknowledgements ...............................................10
9. References .....................................................10
   9.1. Normative References ......................................10
   9.2. Informative References ....................................10

1. Introduction 🦋

Okay so ESP [ESP] and AH [AH] headers can protect both unicast traffic and group traffic (like IPv4 and IPv6 multicast). When unicast traffic is protected between a pair of entities, HMAC transforms (such as [HMAC-SHA]) are good enough to prove data origin authentication. An HMAC works in that setup because only the two entities in the conversation have the key, and proving you have the key in the HMAC construct authenticates the sender 🔐

Here's where it gets messy ngl. When ESP and AH authenticate group traffic, that property stops holding, because all group members share one single HMAC key. So the identity of the sender isn't uniquely established, since any of the key holders can form the HMAC transform. The HMAC transform does establish a group-level security property, but data origin authentication is not achieved 😭

Some group apps really need true data origin authentication, where one group member can't successfully impersonate another group member. Asymmetric digital signature algorithms, like RSA, can provide that true data origin authentication 💜

With asymmetric algorithms, the sender generates a pair of keys. One of them is never shared (the "private key") and the other is distributed to the other group members (the "public key") 🗝️

When the private key is used to sign the output of a cryptographic hash algorithm, the result is called a "digital signature". A receiver uses the public key, the signature value, and an independently computed hash to figure out whether the claimed origin of the packet is correct 🕵️‍♀️

This memo describes how RSA digital signatures can be applied as an ESP and AH authentication mechanism to provide data origin authentication. It's the whole plot 🎬

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT","SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. These are the official BCP 14 vibes, so read them carefully 🙈

2. Algorithm and Mode 🔥

The RSA Public Key Algorithm [RSA] is widely deployed and commonly used for digital signatures. Compared to other public key algorithms, signature verification is relatively efficient, which is super useful for groups where receivers might have limited processing power. RSA is also commonly supported in hardware 🍓

Two digital signature encoding methods are supported in [RSA]. RSASSA-PKCS1-v1_5 MUST be supported by a conforming implementation. RSASSA-PSS is generally believed to be more secure, but at the time of this writing it isn't ubiquitous yet. RSASSA-PSS SHOULD be used whenever it's available. SHA-1 [SHA] MUST be used as the signature hash algorithm for the RSA digital signature algorithm. Iconic ✨

When it's specified for ESP, the Integrity Check Value (ICV) is equal in size to the RSA modulus, unless the RSA modulus isn't a multiple of 8 bits. In that case, the ICV MUST be prepended with between 1 and 7 bits set to zero so the ICV is a multiple of 8 bits. This spec matches the output S [RSA, Section 8.1.1] (RSASSA-PSS) and [RSA, Section 8.2.1] (RSASSA-PKCS1-v1_5) when the RSA modulus isn't a multiple of 8 bits. No implicit ESP ICV Padding bits are necessary 🫶

When it's specified for AH, the ICV is equal in size to the RSA modulus, unless the RSA modulus isn't a multiple of 32 bits (IPv4) or 64 bits (IPv6) [AH, Section 2.6]. In that case, explicit ICV Padding bits are necessary to create a suitably sized ICV [AH, Section 3.3.3.2.1] 🧩

The distribution mechanism for the RSA public key and its replacement interval are a group policy matter. Using an ephemeral key pair with a lifetime of the ESP or AH Security Association (SA) is RECOMMENDED. This recommended policy cuts down the exposure of the RSA private key to the lifetime of the data being signed by it. It also means you don't need to revoke or transmit the validity period of the key pair. Galaxy brain move 🧠

Digital signature generation is done as described in [RSA, Section 8.1.1] (RSASSA-PSS) and [RSA, Section 8.2.1] (RSASSA-PKCS1-v1_5). The authenticated portion of the AH or ESP packet ([AH, Section 3.3.3], [ESP, Section 3.3.2]) is used as the message M, which gets passed to the signature generation function. The signer's RSA private key is passed as K. Summing it up: the signature generation process computes a SHA-1 hash of the authenticated packet bytes, signs that SHA-1 hash using the private key, and encodes the result with the specified RSA encoding type. This gives you a value S, which is known as the ICV in AH and ESP ✨

Digital signature verification is done as described in [RSA, Section 8.1.2] (RSASSA-PSS) and [RSA, Section 8.2.2] (RSASSA-PKCS1-v1_5). When the ICV is received, it gets passed to the verification function as S. The authenticated portion of the AH or ESP packet is used as the message M, and the RSA public key is passed as (n, e). In short, the verification function computes a SHA-1 hash of the authenticated packet bytes, decrypts the SHA-1 hash in the ICV, and checks that the right encoding was applied and was correct. The two SHA-1 hashes get compared, and if they're identical, the validation is successful 🎉

2.1. Key Size Discussion 🔑

The choice of RSA modulus size must be made carefully, bestie. If the modulus is too small, an attacker may be able to reconstruct the private key used to sign packets before the key stops being used by the sender to sign packets. That order of events can compromise the data origin authentication property 😱 But choosing a modulus size bigger than necessary means an unnecessarily high CPU cost for the sender and for all receivers of the packet, so it's a balancing act 🥲

A conforming implementation MUST support a modulus size of 1024 bits. No skipping this one 💀

Recent guidance [TWIRL, RSA-TR] on key sizes estimates how much effort an attacker would need to spend to reconstruct an RSA private key. Table 1 sums up the maximum length of time that selected modulus sizes should be used. Note that these recommendations are based on factors like the cost of processing and memory, as well as cryptographic analysis methods, which were current when these documents were published. As those factors change, choices of key lifetimes should take them into account ⏳

                    Number of     Recommended Maximum
                   Modulus Bits         Lifetime
                   ------------    -------------------
                       768               1 week
                       1024              1 year

             Table 1.  RSA Key Use Lifetime Recommendations

3. Performance ✨

okay so RSA is SUPER expensive compared to the HMAC algorithms in terms of processing time 😭 but honestly? it's getting cheaper over time 🫶 faster general-purpose processors are rolling out, software implementations keep getting faster, and hardware acceleration for the algorithm is becoming way more common 🔥

bestie, be careful. RSA signatures should not be used for applications when the potential receivers are known to lack enough processing power to verify the signature 💀 it's also important to use this scheme judiciously when any receiver might be battery powered 🔋

the RSA asymmetric key algorithm is best suited to protect network traffic where:

The sender has a substantial amount of processing power, and
The network traffic is small enough that adding a relatively large authentication tag (in the range of 62 to 256 bytes) does not cause packet fragmentation.

RSA key pair generation and signing are way more expensive than signature verification, but that cost is isolated to the sender 💅 receivers don't have to carry it.

the size of the RSA modulus affects how much processing is needed to create and verify RSA digital signatures 🧚 so you need to figure out the modulus size your application actually needs. smaller modulus sizes can be chosen as long as the network traffic protected by the private key flows for less time than it is estimated an attacker would take to discover the private key. this lifetime is considerably smaller than in most public key applications that store signed data for a period of time 🌸 but since the digital signature is only used for sender verification, a modulus that is considered weak in another context may be satisfactory. lowkey genius 🦋

the size of the RSA public exponent can affect how much processing is needed to verify RSA digital signatures. low-exponent RSA signatures may result in a lower verification processing cost ✨ at the time of this writing, no attacks are known against low-exponent RSA signatures that would let an attacker create a valid signature using the RSAES-OAEP scheme 💖

the digital signature used as an authentication tag adds a significant number of bytes to the packet 😬 this increases the likelihood that the packet encapsulated in ESP or AH gets fragmented.

4. Interaction with the ESP Cipher Mechanism 🎀

the RSA signature algorithm cannot be used with an ESP Combined Mode algorithm that includes an explicit ICV. the Combined Mode algorithm adds the ESP ICV field itself, which doesn't allow a separate authentication algorithm to add the ESP ICV field 🙈 one example of such an algorithm is the ESP Galois/Counter Mode algorithm [AES-GCM].

5. Key Management Considerations 🔑

key management mechanisms negotiating the use of RSA signatures must include the length of the RSA modulus during policy negotiation, using the Authentication Key Length SA Attribute. MUST include, bestie, this one is not optional 💅 it gives a device the chance to decline the algorithm, which is especially important for devices with constrained processors that might not be able to verify signatures using larger key sizes 🥺

key management mechanisms negotiating the use of RSA signatures also MUST include the encoding method during policy negotiation, using the Signature Encoding Algorithm SA Attribute 🫶

a receiver must have the RSA public key in order to verify the integrity of the packet 🔐 when used with a group key management system (e.g., RFC 3547 [GDOI]), the public key SHOULD be sent as part of the key download policy. if the group has multiple senders, the public key of each sender SHOULD be sent as part of the key download policy too 🌈

using this transform to get data origin authentication for pairwise SAs is NOT RECOMMENDED 🙅‍♀️ for pairwise SAs (like the ones negotiated by the Internet Key Exchange [IKEV2]), data origin authentication can be achieved with an HMAC transform. because the performance impact of an RSA signature is typically greater than an HMAC, the value of using this transform for a pairwise connection is limited 😭

6. Security Considerations 🛡️

bestie, this section is seriously important. read it all 🚨

this document provides a method of authentication for ESP and AH using digital signatures. this feature provides the following protections:

Message modification integrity. The digital signature lets the receiver of the message verify that it was exactly the same as when the sender signed it ✅
Host authentication. The asymmetric nature of the RSA public key algorithm lets the sender be uniquely verified, even when the message is sent to a group 👑

non-repudiation is NOT claimed as a property of this transform 🙅 at times, non-repudiation may be applied to digital signatures on application-level objects (e.g., electronic mail). however, this document describes a means of authenticating network-level objects (i.e., IP packets), which are ephemeral and not directly correlated to any application. non-repudiation is not applicable to network-level objects (i.e., IP packets) 💀

a number of attacks are suggested by [RFC3552]. the following sections describe the risks those attacks present when RSA signatures are used for ESP and AH packet authentication 🧐

SHA-1 has been scheduled to be phased out in 2010, because of the steady advances in technology by which an adversary can double its computing power in roughly eighteen months ⏳ recent attacks on SHA-1 underscore the importance of replacing SHA-1, but have not motivated replacing it before that date [SHA-COMMENTS]. the use of this transform after that date SHOULD be preceded by an analysis of its continued suitability 🔍

6.1. Eavesdropping 👀

this document does not address confidentiality. if that function is desired, it must be addressed by an ESP cipher that is used with the RSA signatures authentication method 🔒 the RSA signature itself does not need to be protected from an eavesdropper.

6.2. Replay 🔁

this document does not address replay attacks. if that function is desired, it is addressed through the use of ESP and AH sequence numbers as defined in [ESP] and [AH] 🔢

6.3. Message Insertion 💉

this document directly addresses message insertion attacks. inserted messages will fail authentication and be dropped by the receiver 🚫

6.4. Deletion 🗑️

this document does not address deletion attacks. it is concerned only with validating the legitimacy of messages that are not deleted 🤷‍♀️

6.5. Modification ✏️

this document directly addresses message modification attacks. modified messages will fail authentication and be dropped by the receiver 💅

6.6. Man in the Middle 🕵️

as long as a receiver is given the sender RSA public key in a trusted manner (e.g., by a key management protocol), it will be able to verify that the digital signature is correct ✅ a man in the middle will not be able to spoof the actual sender unless it acquires the RSA private key through some means.

the RSA modulus size must be chosen carefully to make sure the time a man in the middle needs to determine the RSA private key through cryptanalysis is longer than the amount of time packets are signed with that private key ⏰

6.7. Denial of Service 🌪️

according to IPsec processing rules, a receiver of an ESP and AH packet begins by looking up the Security Association in the SA database. if one is found, the ESP or AH sequence number in the packet is verified. no further processing will be applied to packets with an invalid sequence number 🚷

an attacker that sends an ESP or AH packet matching a valid SA on the system and also having a valid sequence number will cause the receiver to perform the ESP or AH authentication step. because verifying an RSA digital signature consumes relatively large amounts of processing, many such packets could lead to a denial of service (DoS) attack on the receiver 😱

if the message was sent to an IPv4 or IPv6 multicast group, all group members that received the packet would be under attack simultaneously 🚨

this attack can be mitigated against most attackers by encapsulating ESP or AH using an RSA signature for authentication within ESP or AH using an HMAC transform for authentication. in this case, the HMAC transform would be validated first, and as long as the attacker does not possess the HMAC key, no digital signatures would be evaluated on the attacker's packets 🛡️ however, if the attacker does possess the HMAC key (e.g., the attacker is a legitimate member of the group using the SA), then the DoS attack cannot be mitigated 💀

7. IANA Considerations 📋

an assigned number is required in the "IPSec Authentication Algorithm" name space in the Internet Security Association and Key Management Protocol (ISAKMP) registry [ISAKMP-REG]. the mnemonic should be "SIG-RSA" 🏷️

an assigned number is also required in the "IPSEC AH Transform Identifiers" name space in the ISAKMP registry. its mnemonic should be "AH_RSA" 🦋

a new "IPSEC Security Association Attribute" is required in the ISAKMP registry to pass the RSA modulus size. the attribute class should be called "Authentication Key Length", and it should be a Variable type ✨

a second "IPSEC Security Association Attribute" is required in the ISAKMP registry to pass the RSA signature encoding type. the attribute class should be called "Signature Encoding Algorithm", and it should be a Basic type. the following rules apply to define the values of the attribute:

             Name                Value
             ----                -----
             Reserved            0
             RSASSA-PKCS1-v1_5   1
             RSASSA-PSS          2

values 3-61439 are reserved to IANA. new values MUST be added due to a Standards Action as defined in [RFC2434]. values 61440-65535 are for private use and may be allocated by implementations for their own purposes 🧚

8. Acknowledgements 🫶

Scott Fluhrer and David McGrew provided advice regarding applicable key sizes 💜 Scott Fluhrer also provided advice regarding key lifetimes. Ian Jackson, Steve Kent, and Ran Canetti provided many helpful comments. Sam Hartman, Russ Housley, and Lakshminth Dondeti provided valuable guidance in the development of this document 🙌

9. References 📚

9.1. Normative References

[AH]           Kent, S., "IP Authentication Header", RFC 4302,
               December 2005.

[ESP]          Kent, S., "IP Encapsulating Security Payload (ESP)",
               RFC 4303, December 2005.

[ISAKMP-REG]   http://www.iana.org/assignments/isakmp-registry

[RFC2119]      Bradner, S., "Key words for use in RFCs to Indicate
               Requirement Level", BCP 14, RFC 2119, March 1997.

[RFC3552]      Rescorla, E. and B. Korver, "Guidelines for Writing
               RFC Text on Security Considerations", BCP 72, RFC
               3552, July 2003.

[RSA]          Jonsson, J. and B. Kaliski,  "Public-Key Cryptography
               Standard (PKCS) #1: RSA Cryptography Specifications
               Version 2.1", RFC 3447, February 2003.

[SHA]          FIPS PUB 180-2: Specifications for the Secure Hash
               Standard, August 2002.  http://csrc.nist.gov/
               publications/fips/fips180-2/fips180-2.pdf.

9.2. Informative References ✨

okay bestie, last stretch 💅 these are the "if you're curious, go read this" sources, not required reading, just the receipts 📚

[AES-GCM]      Viega, J. and D. McGrew, "The Use of Galois/Counter
               Mode (GCM) in IPsec Encapsulating Security Payload
               (ESP)", RFC 4106, June 2005.

[GDOI]         Baugher, M., Weis, B., Hardjono, T., and H. Harney,
               "The Group Domain of Interpretation", RFC 3547,
               December 2002.

[HMAC-SHA]     Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96
               within ESP and AH", RFC 2404, November 1998.

[IKEV2]        Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
               RFC 4306, December 2005.

[RFC2434]      Narten, T. and H. Alvestrand, "Guidelines for Writing
               an IANA Considerations Section in RFCs", BCP 26, RFC
               2434, October 1998.

[RSA-TR]       B. Kaliski, "TWIRL and RSA Key Size", RSA Laboratories
               Technical Note, http://www.rsasecurity.com/rsalabs/
               node.asp?id=2004, May 6, 2003.

[SHA-COMMENTS] NIST Brief Comments on Recent Cryptanalytic Attacks on
               Secure Hashing Functions and the Continued Security
               Provided by SHA-1, August, 2004.
               http://csrc.nist.gov/hash_standards_comments.pdf.

[TWIRL]        Shamir, A., and E. Tromer, "Factoring Large Numbers
               with the TwIRL Device", Work in Progress, February 9,
               2003.

Author's Address 🎀

and here's who wrote it, the main character behind this whole thing 🦋

Brian Weis
Cisco Systems
170 W. Tasman Drive,
San Jose, CA 95134-1706, USA

Phone: (408) 526-4796
EMail: bew@cisco.com

Full Copyright Statement 📜

ok so the document is covered by the rights, licenses and restrictions in BCP 78 🔒 and, unless BCP 78 says otherwise, the authors keep all their rights 💜

the document and everything in it is handed over "AS IS" 🫠 the contributor, the organization they represent or are sponsored by (if any), the Internet Society, and the Internet Engineering Task Force all disclaim every warranty, express or implied. that includes no warranty that using the info won't infringe any rights, and no implied warranty of merchantability or fitness for a particular purpose. not giving you a guarantee, bestie 😭

Intellectual Property 🔥

the IETF doesn't take a side on whether any IP rights or other rights claimed over the tech in this document are valid, how far they reach, or whether a license is even available 🤷‍♀️ it also hasn't tried to dig up any of those rights itself. info about how RFC documents handle rights lives in BCP 78 and BCP 79 📚

copies of IPR disclosures sent to the IETF Secretariat, any licensing assurances, and the results of any attempt to get a general license or permission for implementers or users are available from the IETF's online IPR repository at http://www.ietf.org/ipr 🌈

if you know of any copyrights, patents, patent applications, or other proprietary rights that might cover tech needed to implement this standard, the IETF wants you to tell them. send it to ietf-ipr@ietf.org 💌

Acknowledgement 🫶

the RFC Editor function is funded by the IETF Administrative Support Activity (IASA) 💖 and that's a wrap 🎀✨

📦 where this page comes from

ietf: rfc4359 2006-01
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms