RFC 4754

IKE and IKEv2 Authentication Using the Elliptic Curve Digital Signature Algorithm (ECDSA)

📅 published January 2007, from ietf

RFC 4754 📜🎀

Network Working Group 💅 Request for Comment: 4754 ✨ Category: Standards Track 🌸 Authors: D. Fu and J. Solinas, NSA 🔐 Date: January 2007 📅

This RFC is called IKE and IKEv2 Authentication Using the Elliptic Curve Digital Signature Algorithm (ECDSA) 💖. The title block doesn't list anything it obsoletes or updates, so it's a standalone add-on ✨.

Status of This Memo 📋

This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🗣️. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📚. Distribution of this memo is unlimited 🦋.

Copyright (C) The IETF Trust (2007).

Abstract 🌈

Okay bestie, so this doc explains how the Elliptic Curve Digital Signature Algorithm (ECDSA) can be used as the authentication method inside the Internet Key Exchange (IKE) and Internet Key Exchange version 2 (IKEv2) protocols 🔑. ECDSA may bring benefits like computational efficiency, small signature sizes, and minimal bandwidth compared to other digital signature methods out there 🧚. The main vibe is that it adds ECDSA to IKE and IKEv2 without changing how IKE already works 🫶.

Table of Contents

   1. Introduction ....................................................2
   2. Requirements Terminology ........................................2
   3. ECDSA ...........................................................2
   4. Specifying ECDSA within IKE and IKEv2 ...........................3
   5. Security Considerations .........................................3
   6. IANA Considerations .............................................4
   7. ECDSA Data Formats ..............................................4
   8. Test Vectors ....................................................4
      8.1. ECDSA-256 ..................................................5
      8.2. ECDSA-384 ..................................................7
      8.3. ECDSA-521 .................................................10
   9. References .....................................................13
      9.1. Normative References ......................................13
      9.2. Informative References ....................................14

1. Introduction ✨

Okay so, IKE (the Internet Key Exchange, [IKE]) is a key agreement and security negotiation protocol 🔐. It's how keys get set up for IPsec, and it's giving main character energy 👑. In the first set of exchanges, both parties must authenticate each other using a negotiated authentication method 🤝. In the original version of IKE, that happens in Phase 1 💫. In IKEv2, it happens in the exchange called IKE-AUTH 🎀. One option for the authentication method is digital signatures using public key cryptography 🔑. Right now there are two digital signature methods for Phase 1 and IKE-AUTH: RSA signatures and Digital Signature Algorithm (DSA) Digital Signature Standard (DSS) signatures 🌸. This document introduces ECDSA signatures as a third method 🦋.

Here's the lowkey flex: for any given level of security against the best known attacks, ECDSA signatures are smaller than RSA signatures, and ECDSA keys need less bandwidth than DSA keys [LV] 💅. There are also speed and efficiency wins in many settings ⚡. You can get even more efficiency by using ECDSA for IKE/IKEv2 authentication and using elliptic curve groups for the IKE/IKEv2 key exchange at the same time 🫶. So implementers of IPsec and IKE/IKEv2 may find it desirable to use ECDSA as the Phase 1/IKE-AUTH authentication method 💜.

2. Requirements Terminology 📝

The key word "SHALL" in this document is to be interpreted as described in [RFC2119] 🎀.

3. ECDSA 🌷

The Elliptic Curve Digital Signature Algorithm (ECDSA) is the elliptic curve version of the DSA (DSS) signature method [DSS] ✨. It's defined in the ANSI X9.62 standard [X9.62-2003] 📘. Other compatible specifications include FIPS 186-2 [DSS], IEEE 1363 [IEEE-1363], IEEE 1363A [IEEE-1363A], and SEC1 [SEC] 🧠.

ECDSA signatures are smaller than RSA signatures of similar cryptographic strength 🦢. ECDSA public keys (and certificates) are smaller than DSA keys of similar strength, which means better communications efficiency 🚀. On many platforms, ECDSA operations can be computed more quickly than RSA or DSA operations of similar strength (see [LV] for a security analysis of key sizes across public key algorithms) 🏃‍♀️. These wins in signature size, bandwidth, and computational efficiency may make ECDSA an attractive choice for many IKE and IKEv2 implementations 💖.

4. Specifying ECDSA within IKE and IKEv2 🧩

The original IKE key negotiation protocol has two phases, Phase 1 and Phase 2 🍓. In Phase 1, the two negotiating parties authenticate each other using pre-shared keys, digital signatures, or public key encryption 🔐.

The IKEv2 key negotiation protocol starts with two exchanges, IKE-SA-INIT and IKE-AUTH 🎬. When extensible authentication isn't being used, the IKE-AUTH exchange includes a digital signature or Message Authentication Code (MAC) on a block of data 📦.

Here's where it gets a little messy 🙈. The IANA-assigned attribute number for authentication using generic ECDSA in IKE is 8 (see [IANA-IKE]), but the matching list of IKEv2 authentication methods does not include ECDSA (see [IANA-IKEv2]) 😭. Also, ECDSA can't be specified for IKEv2 on its own, without an associated hash function, since IKEv2 has no transform type for hash functions 💀. That's why the hash function has to be specified as part of the signature algorithm 🔧. The elliptic curve group also has to be specified, because the choice of hash function depends on it too 🌈. So it's necessary to specify three signature algorithms, named ECDSA-256, ECDSA-384, and ECDSA-521 👑. Each one is an instance of the ECDSA algorithm using a particular elliptic curve group and hash function ✨. The three hash functions are specified in [SHS] 🦋. For consistency, this document defines the signatures for IKE in the same way 🫶.

        Digital
       Signature
       Algorithm            Elliptic Curve Group        Hash Function
      -----------        --------------------------    ---------------
       ECDSA-256          256-bit random ECP group        SHA-256
       ECDSA-384          384-bit random ECP group        SHA-384
       ECDSA-521          521-bit random ECP group        SHA-512

The elliptic curve groups, including their base points, are specified in [IKE-ECP] 💜.

5. Security Considerations 🔥

Since this document proposes new digital signatures for IKE and IKEv2, a lot of the security considerations in [IKE] and [IKEv2] apply here too 🚨. Implementers should make sure appropriate security measures are in place when they deploy ECDSA within IKE or IKEv2 🛡️. This is not the place to cut corners, bestie 😤.

ECDSA-256, ECDSA-384, and ECDSA-521 are designed to offer security comparable with AES-128, AES-192, and AES-256 respectively 🔒.

6. IANA Considerations 🗂️

IANA updated its registry of IPsec authentication methods in [IANA-IKE], and its registry of IKEv2 authentication methods in [IANA-IKEv2], to include ECDSA-256, ECDSA-384, and ECDSA-521 🎀.

7. ECDSA Data Formats 💌

When ECDSA-256, ECDSA-384, or ECDSA-521 is used as the digital signature in IKE or IKEv2, the signature payload SHALL contain an encoding of the computed signature, made by concatenating a pair of integers r and s 🫶. The definitions of r and s are given in Section 8 of this document 📖.

        Digital
       Signature            Bit Lengths        Bit Length
       Algorithm            of r and s        of Signature
      -----------          -------------     --------------
       ECDSA-256                256                512
       ECDSA-384                384                768
       ECDSA-521                528               1056

If needed, the bit lengths of r and s are enforced by pre-pending the value with zeros 🧚.

gux:
 94B90657 77A3B5BE 399CEE66 A9DB4E64 8422E370 F19ED1A9 C699769E 01EC9A30
 E544EB10 7D35F7C9 3FA8FB11 8DCB91ED

guy:
 45882DC2 CF367F74 3FC02961 2D5B96FC F9A09E28 1C3C162D 0D189267 83841606
 87E9953A CC634CEF 2D9897B8 BEE32BC2

gwvx:
 6A142FF2 B0B8C552 9B7F78E2 1B014764 440ED8C0 339B2187 13DB9500 3D1A8BA5
 0811C3B8 41B34CA6 E1785BC8 DB9111F4

gwvy:
 98C2A76C 7E6EDB56 6B1DB657 ED3019F8 2FB94FBB F36124DE C23BB7DE 4B181357
 173F1ABF F3980DF1 F7EC4335 B185CEBF

sumx:
 FB017B91 4E291494 32D8BAC2 9A514640 B46F53DD AB2C6994 8084E293 0F1C8F7E
 08E07C9C 63F2D21A 07DCB56A 6AF56EB3

sumy:
 2C735822 48686C41 8485E7B7 4E707625 A1832769 F7F56E81 7CF83B1E 4690E782
 65B7AD37 BC2F865F DC290DB6 15CDF17F

Okay bestie, the signature check is giving "does this math actually work" and yes, it does 💅✨ The signature is valid since sumx modulo q equals r 🦋

If the signature (r,s) were the one sitting in the authentication payload, the payload would look like this 🎀

 00000068 000A0000 FB017B91 4E291494 32D8BAC2 9A514640 B46F53DD AB2C6994
 8084E293 0F1C8F7E 08E07C9C 63F2D21A 07DCB56A 6AF56EB3 B263A130 5E057F98
 4D38726A 1B468741 09F417BC A112674C 528262A4 0A629AF1 CBB9F516 CE0FA7D2
 FF630863 A00E8B9F

8.2. ECDSA-384 🌸

IANA assigned the ID value 10 to ECDSA-384, so this one is officially in the group chat 👑

The parameters for the group for this signature are:

p:
 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE
 FFFFFFFF 00000000 00000000 FFFFFFFF

b:
 B3312FA7 E23EE7E4 988E056B E3F82D19 181D9C6E FE814112 0314088F 5013875A
 C656398D 8A2ED19D 2A85C8ED D3EC2AEF

q:
 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF C7634D81 F4372DDF
 581A0DB2 48B0A77A ECEC196A CCC52973

gx:
 AA87CA22 BE8B0537 8EB1C71E F320AD74 6E1D3B62 8BA79B98 59F741E0 82542A38
 5502F25D BF55296C 3A545E38 72760AB7

gy:
 3617DE4A 96262C6F 5D9E98BF 9292DC29 F8F41DBD 289A147C E9DA3113 B5F0B8C0
 0A60B1CE 1D7E819D 7A431D7C 90EA0E5F

The static and ephemeral keys are given by:

w:
 0BEB6466 34BA8773 5D77AE48 09A0EBEA 865535DE 4C1E1DCB 692E8470 8E81A5AF
 62E528C3 8B2A81B3 5309668D 73524D9F

gwx:
 96281BF8 DD5E0525 CA049C04 8D345D30 82968D10 FEDF5C5A CA0C64E6 465A97EA
 5CE10C9D FEC21797 41571072 1F437922

gwy:
 447688BA 94708EB6 E2E4D59F 6AB6D7ED FF9301D2 49FE49C3 3096655F 5D502FAD
 3D383B91 C5E7EDAA 2B714CC9 9D5743CA

k:
 B4B74E44 D71A13D5 68003D74 89908D56 4C7761E2 29C58CBF A1895009 6EB7463B
 854D7FA9 92F934D9 27376285 E63414FA

gkx:
 FB017B91 4E291494 32D8BAC2 9A514640 B46F53DD AB2C6994 8084E293 0F1C8F7E
 08E07C9C 63F2D21A 07DCB56A 6AF56EB3

gky:
 2C735822 48686C41 8485E7B7 4E707625 A1832769 F7F56E81 7CF83B1E 4690E782
 65B7AD37 BC2F865F DC290DB6 15CDF17F

The SHA-384 hash of the message "abc" (hex 616263) is:

h:
 CB00753F 45A35E8B B5A03D69 9AC65007 272C32AB 0EDED163 1A8B605A 43FF5BED
 8086072B A1E7CC23 58BAECA1 34C825A7

The signature of the message is (r,s) where:

kinv:
 EB12876B F6191A29 1AA5780A 3887C3BF E7A5C7E3 21CCA674 886B1228 D9BB3D52
 918EF19F E5CE67E9 80BEDC1E 613D39C0

r:
 FB017B91 4E291494 32D8BAC2 9A514640 B46F53DD AB2C6994 8084E293 0F1C8F7E
 08E07C9C 63F2D21A 07DCB56A 6AF56EB3

s:
 B263A130 5E057F98 4D38726A 1B468741 09F417BC A112674C 528262A4 0A629AF1
 CBB9F516 CE0FA7D2 FF630863 A00E8B9F

The quantities required for verification of the signature are:

sinv:
 06EFACEE 8A657F77 584C5A03 9F7E2720 D61DF84C 8FAC6FA4 9A06F6C4 6E8CDA28
 6ADD7D3B 90E1CDA4 79BD899B EE14B99D

u:
 CA5E3714 B4B68BB8 5AF0BC69 E12B16C8 8FAFA26A A6598D7E 2D5C3C40 26F7A944
 7D731721 ABE62CC0 1165ABFD 847088E9

v:
 1342C935 5F1A4563 5435899A C24AEF06 3947CA47 951E89F6 83D73172 F964C359
 69E75EF9 06DA2396 2C747C04 A01137B8

gux:
 94B90657 77A3B5BE 399CEE66 A9DB4E64 8422E370 F19ED1A9 C699769E 01EC9A30
 E544EB10 7D35F7C9 3FA8FB11 8DCB91ED

guy:
 45882DC2 CF367F74 3FC02961 2D5B96FC F9A09E28 1C3C162D 0D189267 83841606
 87E9953A CC634CEF 2D9897B8 BEE32BC2

gwvx:
 6A142FF2 B0B8C552 9B7F78E2 1B014764 440ED8C0 339B2187 13DB9500 3D1A8BA5
 0811C3B8 41B34CA6 E1785BC8 DB9111F4

gwvy:
 98C2A76C 7E6EDB56 6B1DB657 ED3019F8 2FB94FBB F36124DE C23BB7DE 4B181357
 173F1ABF F3980DF1 F7EC4335 B185CEBF

sumx:
 FB017B91 4E291494 32D8BAC2 9A514640 B46F53DD AB2C6994 8084E293 0F1C8F7E
 08E07C9C 63F2D21A 07DCB56A 6AF56EB3

sumy:
 2C735822 48686C41 8485E7B7 4E707625 A1832769 F7F56E81 7CF83B1E 4690E782
 65B7AD37 BC2F865F DC290DB6 15CDF17F

The signature is valid since sumx modulo q equals r, so the math checks out again 🥰

If the signature (r,s) were the one in the authentication payload, the payload would be:

 00000068 000A0000 FB017B91 4E291494 32D8BAC2 9A514640 B46F53DD AB2C6994
 8084E293 0F1C8F7E 08E07C9C 63F2D21A 07DCB56A 6AF56EB3 B263A130 5E057F98
 4D38726A 1B468741 09F417BC A112674C 528262A4 0A629AF1 CBB9F516 CE0FA7D2
 FF630863 A00E8B9F

8.3. ECDSA-521 🦋

IANA assigned the ID value 11 to ECDSA-521, the biggest curve in the room 👑🌈

The parameters for the group for this signature are:

p:
 01FFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
 FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
 FFFF

b:
 0051953E B9618E1C 9A1F929A 21A0B685 40EEA2DA 725B99B3 15F3B8B4 89918EF1
 09E15619 3951EC7E 937B1652 C0BD3BB1 BF073573 DF883D2C 34F1EF45 1FD46B50
 3F00

q:
 01FFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
 FFFA5186 8783BF2F 966B7FCC 0148F709 A5D03BB5 C9B8899C 47AEBB6F B71E9138
 6409

gx:
 00C6858E 06B70404 E9CD9E3E CB662395 B4429C64 8139053F B521F828 AF606B4D
 3DBAA14B 5E77EFE7 5928FE1D C127A2FF A8DE3348 B3C1856A 429BF97E 7E31C2E5
 BD66

gy:
 01183929 6A789A3B C0045C8A 5FB42C7D 1BD998F5 4449579B 446817AF BD17273E
 662C97EE 72995EF4 2640C550 B9013FAD 0761353C 7086A272 C24088BE 94769FD1
 6650

The static and ephemeral keys are given by:

w:
 0065FDA3 409451DC AB0A0EAD 45495112 A3D813C1 7BFD34BD F8C1209D 7DF58491
 20597779 060A7FF9 D704ADF7 8B570FFA D6F062E9 5C7E0C5D 5481C5B1 53B48B37
 5FA1

gwx:
 0151518F 1AF0F563 517EDD54 85190DF9 5A4BF57B 5CBA4CF2 A9A3F647 4725A35F
 7AFE0A6D DEB8BEDB CD6A197E 592D4018 8901CECD 650699C9 B5E456AE A5ADD190
 52A8

gwy:
 006F3B14 2EA1BFFF 7E2837AD 44C9E4FF 6D2D34C7 3184BBAD 90026DD5 E6E85317
 D9DF45CA D7803C6C 20035B2F 3FF63AFF 4E1BA64D 1C077577 DA3F4286 C58F0AEA
 E643

k:
 00C1C2B3 05419F5A 41344D7E 4359933D 734096F5 56197A9B 244342B8 B62F46F9
 373778F9 DE6B6497 B1EF825F F24F42F9 B4A4BD73 82CFC337 8A540B1B 7F0C1B95
 6C2F

gkx:
 0154FD38 36AF92D0 DCA57DD5 341D3053 988534FD E8318FC6 AAAAB68E 2E6F4339
 B19F2F28 1A7E0B22 C269D93C F8794A92 78880ED7 DBB8D936 2CAEACEE 54432055
 2251

gky:
 006D073D 72B272EA 86388D86 8EF64D4C 300A67AC 2981C0F8 E6710AEF A2FCF845
 8117B05E B91BA11C 68BCFC1B C24587E3 A1D0CA2A FE398CDB CFD79CB3 0B36B218
 B437

The hash of the message "abc" (hex 616263) is:

SHA-512(616263):
 DDAF35A1 93617ABA CC417349 AE204131 12E6FA4E 89A97EA2 0A9EEEE6 4B55D39A
 2192992A 274FC1A8 36BA3C23 A3FEEBBD 454D4423 643CE80E 2A9AC94F A54CA49F

Therefore, the quantity h is:

h:
 0000DDAF 35A19361 7ABACC41 7349AE20 413112E6 FA4E89A9 7EA20A9E EEE64B55
 D39A2192 992A274F C1A836BA 3C23A3FE EBBD454D 4423643C E80E2A9A C94FA54C
 A49F

The signature of the message is (r,s) where:

kinv:
 00E90EF3 CE52F8D1 E5A4EEBD 0905F425 2400B0AE 73B49E33 23BCE258 A55F507D
 7C45F3A2 DE3A3EA2 E51D9343 46D71593 A80C8C62 FE229DDF 5D2B64B7 AF4A0837
 0D32

r:
 0154FD38 36AF92D0 DCA57DD5 341D3053 988534FD E8318FC6 AAAAB68E 2E6F4339
 B19F2F28 1A7E0B22 C269D93C F8794A92 78880ED7 DBB8D936 2CAEACEE 54432055
 2251

s:
 017705A7 030290D1 CEB605A9 A1BB03FF 9CDD521E 87A696EC 926C8C10 C8362DF4
 97536710 1F67D1CF 9BCCBF2F 3D239534 FA509E70 AAC851AE 01AAC68D 62F86647
 2660

The quantities required for verification of the signature are:

sinv:
 00DDA6B8 83CB36BF CB21D5B0 B7D1F443 9D3C7797 B23A8D73 58032D5C C917142E
 3F6778BD 977D8460 867853AE 9C74EF5E 417CFA96 F7C937C1 418D9343 738A1BA8
 78E0

u:
 019E5FDB ECC2A88B 72679233 11B27868 427AE2B8 83ED0346 9CBABE65 ACD3F2F8
 D74FA657 8A23C85D 598D1DC6 C1DA074E 0AB83852 BDAAE2F1 857713D3 5BB9BDB7
 32D8

v:
 0069BB0C BA5A6FC8 8A08C0AD AA88F5A5 1EE60477 2D084D98 63DF86FD 958AD9B3
 006E62C4 30CE545E 9C918F04 D852DA13 47CC6A3E FA89BC2C 13B89124 25BA8D60
 BF03

gux:
 00921F3E CEAF579C FDDA6AF9 C1728E5B CA33F77B 57F5984C 624BFF10 F244B577
 144CA24E 20310DEF 2F777892 DA1ED5DE A9A6EF09 85D965AE 98BCF129 855C6C4F
 3311

guy:
 01812CBF E8D08BE9 0CD6AB5D 2ED107A0 123A41A9 C15ACB31 7D65E228 92D89AF8
 C29A4220 83E3495E D14726A0 9868AF1B 399CEF86 6DDDE6B1 0D709696 06525D15
 B4EB

gwvx:
 00AF23A7 7F50CC54 8CEBC506 58FE4A0B A26FF9DE 4E864DE2 7FD059B6 3AE14B5F
 87286BC7 7AAEBA32 4FF675A1 FF7035B6 89AF3835 95F8B5A8 67432FFE 8BF29CF6
 0688

gwvy:
 017A32C4 5A01DF60 3CA96FDF E83493BB 4CB5EE00 C32960A5 4FEB0B39 88841E2F
 9D52B745 C5A7FEC6 777BB899 B65730E9 32D1395D C0574D3C F1093C64 505804D0
 A5B3

sumx:
 0154FD38 36AF92D0 DCA57DD5 341D3053 988534FD E8318FC6 AAAAB68E 2E6F4339
 B19F2F28 1A7E0B22 C269D93C F8794A92 78880ED7 DBB8D936 2CAEACEE 54432055
 2251

sumy:
 006D073D 72B272EA 86388D86 8EF64D4C 300A67AC 2981C0F8 E6710AEF A2FCF845
 8117B05E B91BA11C 68BCFC1B C24587E3 A1D0CA2A FE398CDB CFD79CB3 0B36B218
 B437

The signature is valid since sumx modulo q equals r 💖

If the signature (r,s) were the one appearing in the authentication payload, then the payload would be as follows:

 0000008C 000B0000 0154FD38 36AF92D0 DCA57DD5 341D3053 988534FD E8318FC6
 AAAAB68E 2E6F4339 B19F2F28 1A7E0B22 C269D93C F8794A92 78880ED7 DBB8D936
 2CAEACEE 54432055 22510177 05A70302 90D1CEB6 05A9A1BB 03FF9CDD 521E87A6
 96EC926C 8C10C836 2DF49753 67101F67 D1CF9BCC BF2F3D23 9534FA50 9E70AAC8
 51AE01AA C68D62F8 66472660

9. References ✨

9.1. Normative References 📚

  • [IANA-IKE] Internet Assigned Numbers Authority, Internet Key Exchange (IKE) Attributes. (http://www.iana.org/assignments/ipsec-registry)
  • [IANA-IKEv2] IKEv2 Parameters. (http://www.iana.org/assignments/ikev2-parameters)
  • [IKE] Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.
  • [IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", RFC 4306, December 2005.
  • [IKE-ECP] Fu, D. and J. Solinas, "ECP Groups for IKE and IKEv2", RFC 4753, January 2007.
  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [SHS] FIPS 180-2, "Secure Hash Standard", National Institute of Standards and Technology, 2002.
  • [X9.62-2005] American National Standards Institute, X9.62-2005: Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA).

9.2. Informative References 🌷

  • [DSS] U.S. Department of Commerce/National Institute of Standards and Technology, Digital Signature Standard (DSS), FIPS PUB 186-2, January 2000. (http://csrc.nist.gov/publications/fips/index.html)
  • [IEEE-1363] Institute of Electrical and Electronics Engineers. IEEE 1363-2000, Standard for Public Key Cryptography. (http://grouper.ieee.org/groups/1363/index.html)
  • [IEEE-1363A] Institute of Electrical and Electronics Engineers. IEEE 1363A-2004, Standard for Public Key Cryptography - Amendment 1: Additional Techniques. (http://grouper.ieee.org/groups/1363/index.html)
  • [LV] A. Lenstra and E. Verheul, "Selecting Cryptographic Key Sizes", Journal of Cryptology 14 (2001), pp. 255-293.
  • [SEC] Standards for Efficient Cryptography Group. SEC 1 - Elliptic Curve Cryptography, v. 1.0, 2000. (http://www.secg.org)

Authors' Addresses 🎀

David E. Fu
National Information Assurance Research Laboratory
National Security Agency

EMail: defu@orion.ncsc.mil


Jerome A. Solinas
National Information Assurance Research Laboratory
National Security Agency

EMail: jasolin@orion.ncsc.mil

okay so this part is the legal stuff, but bestie it's still giving 💅. The IETF Trust owns the copyright here, and the copyright year is 2007 🎀.

This document is covered by the rights, licenses and restrictions in BCP 78. Apart from what BCP 78 says, the authors keep all their rights 🦋.

The document and everything in it is provided "AS IS" 🫶. The contributor, the organization they represent or are sponsored by (if any), the Internet Society, the IETF Trust, and the Internet Engineering Task Force all disclaim every warranty, whether express or implied 😭. That includes, but isn't limited to, any promise that using the information won't infringe anyone's rights, and any implied warranty of merchantability or fitness for a particular purpose 💀.

Intellectual Property

The IETF doesn't take a side on whether any Intellectual Property Rights or other rights that someone might claim over the technology in this document are valid or how far they reach 🙈. It also doesn't say whether licenses for those rights are available. And it hasn't done any independent digging to find out whether such rights exist 🔍. If you want to know how rights work for RFC documents, check out BCP 78 and BCP 79 📚.

Copies of IPR disclosures sent to the IETF Secretariat are available, along with any assurances of licenses that have been offered. You can also find out what happened when someone tried to get a general license or permission to use proprietary rights, for implementers or users of this specification 🧚. All of that lives in the IETF online IPR repository at http://www.ietf.org/ipr 🌸.

The IETF also invites anyone who knows about copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard to let them know 🍓. Send that info to the IETF at ietf-ipr@ietf.org 💌.

Acknowledgement

Funding for the RFC Editor function is currently provided by the Internet Society 🌈✨.

📦 where this page comes from