RFC 7427
Signature Authentication in the Internet Key Exchange Version 2 (IKEv2)
Signature Authentication in the Internet Key Exchange Version 2 (IKEv2) ✨
okay bestie, this is RFC 7427 🎀 It's a Standards Track document from January 2015, written by T. Kivinen (INSIDE Secure) and J. Snyder (Opus One). It's published by the Internet Engineering Task Force, and it updates RFC 7296 🦋 The ISSN is 2070-1721.
Abstract ✨
okay so IKEv2 (the Internet Key Exchange Version 2 protocol) has pretty limited ECDSA support 😭 Right now it only covers three Elliptic Curve groups, and each one has a fixed hash algorithm stuck to it. This doc glows it up by generalizing IKEv2 signature support so it can use any signature method PKIX supports, and it also adds signature hash algorithm negotiation 💅 It's a generic mechanism, so it isn't just for ECDSA. Other signature algorithms can use it too 🌈
Status of This Memo 🌸
This is an Internet Standards Track document 💜
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more about Internet Standards, check out Section 2 of RFC 5741 📚
For the current status of this document, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc7427 🧚
Copyright Notice 💖
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info as they were in effect on the date this document was published. Please read these carefully, because they explain your rights and restrictions for this document 👀 Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They also come with no warranty, as described in the Simplified BSD License ✨
Table of Contents 🎀
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Authentication Payload . . . . . . . . . . . . . . . . . . . 4
4. Hash Algorithm Notification . . . . . . . . . . . . . . . . . 6
5. Selecting the Public Key Algorithm . . . . . . . . . . . . . 7
6. Security Considerations . . . . . . . . . . . . . . . . . . . 8
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 10
8.1. Normative References . . . . . . . . . . . . . . . . . . 10
8.2. Informative References . . . . . . . . . . . . . . . . . 10
Appendix A. Commonly Used ASN.1 Objects . . . . . . . . . . . . 12
A.1. PKCS#1 1.5 RSA Encryption . . . . . . . . . . . . . . . . 12
A.1.1. sha1WithRSAEncryption . . . . . . . . . . . . . . . . 12
A.1.2. sha256WithRSAEncryption . . . . . . . . . . . . . . . 12
A.1.3. sha384WithRSAEncryption . . . . . . . . . . . . . . . 13
A.1.4. sha512WithRSAEncryption . . . . . . . . . . . . . . . 13
A.2. DSA . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
A.2.1. dsa-with-sha1 . . . . . . . . . . . . . . . . . . . . 13
A.2.2. dsa-with-sha256 . . . . . . . . . . . . . . . . . . . 14
A.3. ECDSA . . . . . . . . . . . . . . . . . . . . . . . . . . 14
A.3.1. ecdsa-with-sha1 . . . . . . . . . . . . . . . . . . . 14
A.3.2. ecdsa-with-sha256 . . . . . . . . . . . . . . . . . . 14
A.3.3. ecdsa-with-sha384 . . . . . . . . . . . . . . . . . . 15
A.3.4. ecdsa-with-sha512 . . . . . . . . . . . . . . . . . . 15
A.4. RSASSA-PSS . . . . . . . . . . . . . . . . . . . . . . . 15
A.4.1. RSASSA-PSS with Empty Parameters . . . . . . . . . . 15
A.4.2. RSASSA-PSS with Default Parameters . . . . . . . . . 16
A.4.3. RSASSA-PSS with SHA-256 . . . . . . . . . . . . . . . 17
Appendix B. IKEv2 Payload Example . . . . . . . . . . . . . . . 17
B.1. sha1WithRSAEncryption . . . . . . . . . . . . . . . . . . 17
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 18
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 181. Introduction 🦋
okay so this document adds a brand new IKEv2 [RFC7296] authentication method that supports signature methods in a more general way 💅 Right now, the signature-based authentication methods in IKEv2 are per algorithm. There's one for RSA digital signatures, one for DSS digital signatures (using SHA-1), and three for different ECDSA curves, and each of those is tied to exactly one hash algorithm 😭 This design gets cumbersome fast once you need more signature algorithms, hash algorithms, and elliptic curves:
- In IKEv2, authentication using RSA digital signatures calls for padding based on
RSASSA-PKCS1-v1_5, even though the newerRSASSA-PSSpadding method is now recommended. (See Section 5 of "Additional Algorithms and Identifiers for RSA Cryptography for use in PKIX Profile" [RFC4055].) - With ECDSA and the Digital Signature Standard (DSS), there's no way to pull the hash algorithm out of the signature. So for every new hash function you want with ECDSA or DSA, you'd need brand new authentication methods 🙈 New hash functions are especially needed for DSS, because sticking to SHA-1 limits its security. Basically, there's no point in using long keys with SHA-1 💀
- Tying ECDSA authentication methods to particular elliptic curve groups means you need to define more methods for every new group. Combine new ECDSA groups with new hash functions and the number of required authentication methods gets totally unmanageable 😵 Also, restricting ECDSA authentication to one specific group is inconsistent with how DSS does it.
With SHA-3 selected, it might be possible for a signature method to be used with either SHA-3 or SHA-2. That means we need a new mechanism for negotiating the hash algorithm for a signature algorithm ✨
This document specifies two things:
- A new authentication method that includes enough information inside the Authentication payload data so the signature hash algorithm can be extracted (see Section 3).
- A method to indicate supported signature hash algorithms (see Section 4). This lets the peer know which hash algorithms the other end supports, so it can use one of them (as long as policy allows it). There's no requirement to actually negotiate one common hash algorithm, because different hash algorithms can be used in different directions if needed 🌸
The new digital signature method is flexible enough to cover all current signature methods (RSA, DSA, ECDSA, RSASSA-PSS, etc.) and to add new ones (ECGDSA, ElGamal, etc.) in the future 🔥 To make that work, the signature algorithm is specified the same way PKIX [RFC5280] specifies the signature of the Digital Certificate. A simple ASN.1 object goes right before the actual signature data. This ASN.1 object contains an OID that specifies the algorithm and its associated parameters. When an IKEv2 implementation supports a fixed set of signature methods with commonly used parameters, it's acceptable to treat the ASN.1 object as a binary blob and compare it against that fixed set of known values 🧚 IKEv2 implementations can also parse the ASN.1 and pull out the signature algorithm and its associated parameters.
2. Terminology 💜
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀
3. Authentication Payload 💅
okay bestie, this is the big one 🫶 this doc adds a brand new "Digital Signature" auth method, and it works with any type of signature 🖊️ fr. authentication methods aren't negotiated in IKEv2, so a peer only gets to use this method if the Notify payload of type SIGNATURE_HASH_ALGORITHMS has been sent AND received by each peer. no notify, no digital signature, periodt 🙅♀️
the way this one is different: the Authentication Data field doesn't just hold the signature value like every other IKEv2 Authentication payload 😭 instead, the signature value gets a prefix, an ASN.1 object that tells you which algorithm made the signature 🔍 that ASN.1 object has the algorithm identification OID, and the OID tells you BOTH the signature algorithm AND the hash used when calculating the signature. it can also carry optional parameters for algorithms that need them, like RSASSA-PSS (see Section 8.1 of [RFC3447]) ✨
to make life easier, the ASN.1 object gets an 8-bit length field in front of it 🧚 this lets simple implementations know how long the object is without parsing it, so they can treat it as a binary blob and compare it against known signature algorithm ASN.1 objects. so simple implementations may not need to parse or generate ASN.1 at all, which is giving "easy mode" 💖 see Appendix A for the commonly used ASN.1 objects.
the ASN.1 here is the same ASN.1 used in the AlgorithmIdentifier of PKIX (see Section 4.1.1.2 of [RFC5280]), encoded with distinguished encoding rules (DER) [CCITT.X690.2002] 🎀 the algorithm OID inside it specifies the signature algorithm and the hash function, and you need both of those to verify a signature 🔥
right now only RSASSA-PSS uses the optional parameters 👑 every other signature algorithm has parameters that are either NULL or missing. ngl, some algorithms have two possible encodings: one with the optional parameters included but set to NULL, and one where they're omitted 💀 both exist because of how those algorithms were specified. when encoding, implementations SHOULD use the preferred format the algorithm specification calls for. if the spec says "preferredPresent", the parameters object needs to be there (it'll be NULL if no parameters are specified). if it says "preferredAbsent", the whole optional parameters object is missing 🌸
the Authentication payload is defined in IKEv2 like this:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Auth Method | RESERVED |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Authentication Data ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 1: Authentication Payload Format
- Auth Method (1 octet) - the method of authentication being used 🔐
Mechanism Value
-----------------------------------------------------------------
Digital Signature 14computed as specified in Section 2.15 of [RFC7296], using a private key associated with the public key sent in the Certificate payload, and using one of the hash algorithms the other end sent in the Notify payload of type SIGNATURE_HASH_ALGORITHMS. if both ends send and receive SIGNATURE_HASH_ALGORITHMS Notify payloads, and signature authentication is to be used, then the authentication method specified in this Authentication payload MUST be used. the format of the Authentication Data field is different from other Authentication methods, and it's specified below 🦋
- Authentication Data (variable length) - see Section 2.15 of [RFC7296]. for the "Digital Signature" format, the Authentication Data is formatted like this:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ASN.1 Length | AlgorithmIdentifier ASN.1 object |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ AlgorithmIdentifier ASN.1 object continuing ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Signature Value ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 2: Authentication Data Format
- ASN.1 Length (1 octet) - the length of the ASN.1-encoded AlgorithmIdentifier object 📏
- Algorithm Identifier (variable length) - the AlgorithmIdentifier ASN.1 object 🧩
- Signature Value (variable length) - the actual signature value ✍️
there's no padding between the ASN.1 object and the signature value. for hash truncation, the method specified in ANSI X9.62:2005 [X9.62] MUST be used 💅
4. Hash Algorithm Notification 🔔
the supported hash algorithms that can be used with the signature algorithms get indicated with a Notify payload of type SIGNATURE_HASH_ALGORITHMS, sent inside the IKE_SA_INIT exchange ✨
this notification also implicitly tells everyone the sender supports the new "Digital Signature" auth method, plus the list of hash functions the sending peer supports 🫧
both ends send their list of supported hash algorithms. when calculating the digital signature, a peer MUST pick one algorithm sent by the other peer 🎯 different algorithms can be used in different directions, so don't assume they match both ways 🙈 the algorithm OID that indicates the selected hash algorithm (and signature algorithm) is sent inside the Authentication Data field of the Authentication payload (with Auth Method "Digital Signature", as defined above) 💌
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Protocol ID | SPI Size | Notify Message Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Security Parameter Index (SPI) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Notification Data ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 3: Notify Payload Format
the Notify payload format is defined in Section 3.10 of [RFC7296] 📜 when a Notify payload of type SIGNATURE_HASH_ALGORITHMS is sent, the Protocol ID field is set to 0, the SPI Size is set to 0, and the Notify Message Type is set to 16431 🧁
the Notification Data field holds the list of 16-bit hash algorithm identifiers from the Hash Algorithm Identifiers of IANA's "Internet Key Exchange Version 2 (IKEv2) Parameters" registry 🗂️ there's no padding between the hash algorithm identifiers 🌈
5. Selecting the Public Key Algorithm 🔑
okay this part is about figuring out which public/private key pair type to use, and this spec doesn't give peers a way to say which key types they have 🤷♀️ so the question becomes: how does the responder pick a key pair type the initiator supports? there are a few ways to find out 🕵️♀️
method one: the initiator signals the key it wants the responder to use in the IDr (Identification - Responder) payload of its IKE_AUTH request. here the responder has different identities configured, and each identity is tied to a public/private key or key type. so the IDr payload basically says "use this one, pls" 💁♀️
method two: the initiator's Certificate Request payload. for example, the initiator could say it trusts a certificate authority certificate signed with an ECDSA key. that implies the initiator can process ECDSA signatures, so the responder can safely use ECDSA keys when authenticating 🫶
method three: the responder checks which key type the initiator used and just uses the same one 🪞 this doesn't work if the initiator is using shared secret or Extensible Authentication Protocol (EAP) authentication (aka not using public keys). but if the initiator IS using public key auth, this is the best way for the responder to figure out what key type it supports ✨
if the initiator uses a public key type the responder doesn't support, the responder replies with a Notify message with error type AUTHENTICATION_FAILED 💔 if the initiator has multiple different keys, it may try a different key (and maybe a different key type) until it finds one the other end accepts 🔄 the initiator can also use the Certificate Request payload sent by the responder to help decide which public key to try 🧭 in normal cases, when the initiator has multiple public keys, out-of-band configuration is used to pick a public key for each connection 🎀
6. Security Considerations 🔐
Okay bestie, this part is serious, so let's get into it 🫶 Tables 2 and 3 of "Recommendations for Key Management" [NIST800-57] give you recommendations for picking suitable hash functions for the signature 📚
This new digital signature method does not tie the Elliptic Curve to one specific hash function, which the old IKEv2 ECDSA methods did. That means you can mix different security levels 😬 For example, you could use a 512-bit Elliptic Curve with SHA1. So the security of the authentication method is only as strong as its weakest component (signature algorithm, hash algorithm, or curve). This makes the security analysis of the system way more complicated 💀
IKEv2 peers have a series of policy databases (see Section 4.4 of [RFC4301]) that define which security algorithms and methods should be used when security associations are being set up. To help end users pick the security levels they want for communications protected by IPsec, implementers may wish to add a mechanism to the IKE policy databases that limits mixing of security levels or restricts combos of protocols 🎀
Security downgrade attacks are when a man-in-the-middle deletes or modifies the stronger methods in a payload to force a lower level of security. These are not a significant concern in IKEv2 Authentication payloads, as discussed in this RFC. Why? Because a modified AUTH payload gets caught when the peer computes a signature over the IKE messages 🙅♀️✨
One specific class of downgrade attacks needs selection of catastrophically weak ciphers. In this kind of attack, the man-in-the-middle is able to "break" the cryptography in real time. This type of downgrade attack should be blocked by policy about cipher algorithm selection, as discussed above. Don't let it happen, periodt 🚫
The hash algorithm registry does not include MD5 as a supported hash algorithm, because it is not considered safe enough for signature use [WY05]. Bye MD5 👋
The current IKEv2 protocol uses RSASSA-PKCS1-v1_5, which has known security vulnerabilities [KA08] [ME01] and does not allow newer padding methods like RSASSA-PSS. The new method described in this RFC lets you use other padding methods, so it's giving upgrade 🔥
The current IKEv2 protocol only allows normal DSA with SHA-1, which means the security of the authentication is capped at the security of SHA-1. This new method lets you use longer keys and longer hashes with DSA 💜
7. IANA Considerations 🦋
This document creates a brand new IANA registry for IKEv2 Hash Algorithms. Changes and additions to this registry are handled by Expert Review [RFC5226] 📋
The initial values of this registry are:
Hash Algorithm Value
-------------- -----
RESERVED 0
SHA1 1
SHA2-256 2
SHA2-384 3
SHA2-512 4MD5 is not in the hash algorithm list, because it is not considered safe enough for signature hash uses 🙈
Values 5-1023 are Unassigned. Values 1024-65535 are reserved for Private Use among mutually consenting parties 🌸
This specification also adds a new value for SIGNATURE_HASH_ALGORITHMS (16431) to the "IKEv2 Notify Message Types - Status Types" registry, and adds a new value for Digital Signature (14) to the "IKEv2 Authentication Method" registry 🧚
8. References 📚
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997, http://www.rfc-editor.org/info/rfc2119.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008, http://www.rfc-editor.org/info/rfc5280.
[RFC7296] Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T. Kivinen, "Internet Key Exchange Protocol Version 2 (IKEv2)", RFC 7296, October 2014, http://www.rfc-editor.org/info/rfc7296.
8.2. Informative References
[CCITT.X690.2002] International Telephone and Telegraph Consultative Committee, "ASN.1 encoding rules: Specification of basic encoding Rules (BER), Canonical encoding rules (CER) and Distinguished encoding rules (DER)", CCITT Recommendation X.690, July 2002.
[KA08] Kuehn, U., Pyshkin, A., Tews, E., and R. Weinmann, "Variants of Bleichenbacher's Low-Exponent Attack on PKCS#1 RSA Signatures", Proceedings of Sicherheit 2008, pp.97-109, 2008.
[ME01] Menezes, A., "Evaluation of Security Level of Cryptography: RSA-OAEP, RSA-PSS, RSA Signature", December 2001.
[NIST800-57] Barker, E., Barker, W., Burr, W., Polk, W., and M. Smid, "Recommendation for Key Management - Part 1: General (Revised)", NIST Special Publication 800-57, March 2007.
[RFC3279] Bassham, L., Polk, W., and R. Housley, "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3279, April 2002, http://www.rfc-editor.org/info/rfc3279.
[RFC3447] Jonsson, J. and B. Kaliski, "Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1", RFC 3447, February 2003, http://www.rfc-editor.org/info/rfc3447.
[RFC4055] Schaad, J., Kaliski, B., and R. Housley, "Additional Algorithms and Identifiers for RSA Cryptography for use in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 4055, June 2005, http://www.rfc-editor.org/info/rfc4055.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", RFC 4301, December 2005, http://www.rfc-editor.org/info/rfc4301.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs)", BCP 26, RFC 5226, May 2008, http://www.rfc-editor.org/info/rfc5226.
[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk, "Elliptic Curve Cryptography Subject Public Key Information", RFC 5480, March 2009, http://www.rfc-editor.org/info/rfc5480.
[RFC5758] Dang, Q., Santesson, S., Moriarty, K., Brown, D., and T. Polk, "Internet X.509 Public Key Infrastructure: Additional Algorithms and Identifiers for DSA and ECDSA", RFC 5758, January 2010, http://www.rfc-editor.org/info/rfc5758.
[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, June 2010, http://www.rfc-editor.org/info/rfc5912.
[WY05] Wang, X. and H. Yu, "How to break MD5 and other hash functions", Proceedings of EuroCrypt 2005, Lecture Notes in Computer Science Vol. 3494, 2005.
[X9.62] American National Standards Institute, "Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA)", ANSI X9.62, November 2005.
Appendix A. Commonly Used ASN.1 Objects 🧾
This section lists commonly used ASN.1 objects in binary form. This section is not normative, and these values should only be used as examples. If the ASN.1 object listed in Appendix A and the ASN.1 object specified by the algorithm differ, then the algorithm specification must be used. These values are taken from "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)" [RFC5912] 💖
A.1. PKCS#1 1.5 RSA Encryption
The algorithm identifiers here include several different ASN.1 objects with different hash algorithms. This document only includes the commonly used ones, i.e., the ones using SHA-1 or SHA-2 as the hash function. Some other algorithms (such as MD2 and MD5) are not safe enough to be used as signature hash algorithms and are omitted. The IANA registry does not have code points for these other algorithms with RSA Encryption. Note that there are no optional parameters in any of these algorithm identifiers, but all included here need NULL optional parameters present in the ASN.1 ✨
See "Algorithms and Identifiers for PKIX Profile" [RFC3279] and "Additional Algorithms and Identifiers for RSA Cryptography for use in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile" [RFC4055] for more information.
A.1.1. sha1WithRSAEncryption
sha1WithRSAEncryption OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5 }Parameters are required, and they must be NULL.
Name = sha1WithRSAEncryption, oid = 1.2.840.113549.1.1.5
Length = 15
0000: 300d 0609 2a86 4886 f70d 0101 0505 00A.1.2. sha256WithRSAEncryption
sha256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 11 }Parameters are required, and they must be NULL.
Name = sha256WithRSAEncryption, oid = 1.2.840.113549.1.1.11
Length = 15
0000: 300d 0609 2a86 4886 f70d 0101 0b05 00A.1.3. sha384WithRSAEncryption
sha384WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 12 }Parameters are required, and they must be NULL.
Name = sha384WithRSAEncryption, oid = 1.2.840.113549.1.1.12
Length = 15
0000: 300d 0609 2a86 4886 f70d 0101 0c05 00A.1.4. sha512WithRSAEncryption
sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 }Parameters are required, and they must be NULL.
Name = sha512WithRSAEncryption, oid = 1.2.840.113549.1.1.13
Length = 15
0000: 300d 0609 2a86 4886 f70d 0101 0d05 00A.2. DSA
With DSA algorithms, optional parameters are always omitted. Only algorithm combinations for DSA that are listed in the IANA registry are included 🎀
See "Algorithms and Identifiers for PKIX Profile" [RFC3279] and "PKIX Additional Algorithms and Identifiers for DSA and ECDSA" [RFC5758] for more information.
A.2.1. dsa-with-sha1
dsa-with-sha1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
x9-57(10040) x9algorithm(4) 3 }Parameters are absent.
Name = dsa-with-sha1, oid = 1.2.840.10040.4.3
Length = 11
0000: 3009 0607 2a86 48ce 3804 03A.2.2. dsa-with-sha256
dsa-with-sha256 OBJECT IDENTIFIER ::= { joint-iso-ccitt(2)
country(16) us(840) organization(1) gov(101) csor(3) algorithms(4)
id-dsa-with-sha2(3) 2 }Parameters are absent.
Name = dsa-with-sha256, oid = 2.16.840.1.101.3.4.3.2
Length = 13
0000: 300b 0609 6086 4801 6503 0403 02A.3. ECDSA
With ECDSA algorithms, the optional parameters are always omitted. Only algorithm combinations for the ECDSA listed in the IANA registry are included 💅
See "Elliptic Curve Cryptography Subject Public Key Information" [RFC5480], "Algorithms and Identifiers for PKIX Profile" [RFC3279], and "PKIX Additional Algorithms and Identifiers for DSA and ECDSA" [RFC5758] for more information.
A.3.1. ecdsa-with-sha1
ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
ansi-X9-62(10045) signatures(4) 1 }Parameters are absent.
Name = ecdsa-with-sha1, oid = 1.2.840.10045.4.1
Length = 11
0000: 3009 0607 2a86 48ce 3d04 01A.3.2. ecdsa-with-sha256 🌸
Next up is the SHA-256 flavour of ECDSA. Its OID is 1.2.840.10045.4.3.2, and the parameters are absent 🙈
ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 }
Parameters are absent.
Name = ecdsa-with-sha256, oid = 1.2.840.10045.4.3.2
Length = 12
0000: 300a 0608 2a86 48ce 3d04 0302A.3.3. ecdsa-with-sha384 🦋
Same energy, but now it's the SHA-384 version. The OID ends in 3, and the parameters are absent again ✨
ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 3 }
Parameters are absent.
Name = ecdsa-with-sha384, oid = 1.2.840.10045.4.3.3
Length = 12
0000: 300a 0608 2a86 48ce 3d04 0303A.3.4. ecdsa-with-sha512 👑
And the last ECDSA variant is SHA-512. The OID ends in 4, and the parameters are absent. We're literally finishing the ECDSA set 💅
ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 4 }
Parameters are absent.
Name = ecdsa-with-sha512, oid = 1.2.840.10045.4.3.4
Length = 12
0000: 300a 0608 2a86 48ce 3d04 0304A.4. RSASSA-PSS 🎀
Okay, RSASSA-PSS is a bit different, so pay attention bestie 👀 The algorithm OID has to be id-RSASSA-PSS every single time, and the hash function and padding details live in the parameters. In this case the parameters aren't optional, so they can't be skipped. For the full story, check out [RFC4055], which is Additional RSA Algorithms and Identifiers.
A.4.1. RSASSA-PSS with Empty Parameters 🧚
The OID here is id-RSASSA-PSS, which is { pkcs-1 10 }. The parameters are empty, but the ASN.1 part of the sequence must be present. That means the default parameters get used. Lowkey a clean trick ✨
id-RSASSA-PSS OBJECT IDENTIFIER ::= { pkcs-1 10 }
Parameters are empty, but the ASN.1 part of the sequence must be
present. This means default parameters are used.
0000 : SEQUENCE
0002 : OBJECT IDENTIFIER RSASSA-PSS (1.2.840.113549.1.1.10)
000d : SEQUENCE
Length = 15
0000: 300d 0609 2a86 4886 f70d 0101 0a30 00A.4.2. RSASSA-PSS with Default Parameters 🍓
Same OID as before, but this time the parameters are actually there and they hold the default values. Those defaults are: hashAlgorithm of SHA-1, maskGenAlgorithm of mgf1SHA1, saltLength of 20, and trailerField of 1. So it's the same result, just written out in full 💜
id-RSASSA-PSS OBJECT IDENTIFIER ::= { pkcs-1 10 }
0000 : SEQUENCE
0002 : OBJECT IDENTIFIER RSASSA-PSS (1.2.840.113549.1.1.10)
000d : SEQUENCE
000f : CONTEXT 0
0011 : SEQUENCE
0013 : OBJECT IDENTIFIER id-sha1 (1.3.14.3.2.26)
001a : NULL
001c : CONTEXT 1
001e : SEQUENCE
0020 : OBJECT IDENTIFIER 1.2.840.113549.1.1.8
002b : SEQUENCE
002d : OBJECT IDENTIFIER id-sha1 (1.3.14.3.2.26)
0034 : NULL
0036 : CONTEXT 2
0038 : INTEGER 0x14 (5 bits)
003b : CONTEXT 3
003d : INTEGER 0x1 (1 bits)
Name = RSASSA-PSS with default parameters,
oid = 1.2.840.113549.1.1.10
Length = 64
0000: 303e 0609 2a86 4886 f70d 0101 0a30 31a0
0010: 0b30 0906 052b 0e03 021a 0500 a118 3016
0020: 0609 2a86 4886 f70d 0101 0830 0906 052b
0030: 0e03 021a 0500 a203 0201 14a3 0302 0101A.4.3. RSASSA-PSS with SHA-256 💖
Now we're going full SHA-256 🔥 The parameters are here, and they say hashAlgorithm of SHA-256, maskGenAlgorithm of SHA-256, saltLength of 32, and trailerField of 1. Slay the hex dump 😭
id-RSASSA-PSS OBJECT IDENTIFIER ::= { pkcs-1 10 }
0000 : SEQUENCE
0002 : OBJECT IDENTIFIER RSASSA-PSS (1.2.840.113549.1.1.10)
000d : SEQUENCE
000f : CONTEXT 0
0011 : SEQUENCE
0013 : OBJECT IDENTIFIER id-sha256 (2.16.840.1.101.3.4.2.1)
001e : NULL
0020 : CONTEXT 1
0022 : SEQUENCE
0024 : OBJECT IDENTIFIER 1.2.840.113549.1.1.8
002f : SEQUENCE
0031 : OBJECT IDENTIFIER id-sha256 (2.16.840.1.101.3.4.2.1)
003c : NULL
003e : CONTEXT 2
0040 : INTEGER 0x20 (6 bits)
0043 : CONTEXT 3
0045 : INTEGER 0x1 (1 bits)
Name = RSASSA-PSS with sha-256, oid = 1.2.840.113549.1.1.10
Length = 72
0000: 3046 0609 2a86 4886 f70d 0101 0a30 39a0
0010: 0f30 0d06 0960 8648 0165 0304 0201 0500
0020: a11c 301a 0609 2a86 4886 f70d 0101 0830
0030: 0d06 0960 8648 0165 0304 0201 0500 a203
0040: 0201 20a3 0302 0101Appendix B. IKEv2 Payload Example 🌈
B.1. sha1WithRSAEncryption 💅
Here's what the start of an IKEv2 AUTH payload looks like:
00000000: NN00 00LL 0e00 0000 0f30 0d06 092a 8648
00000010: 86f7 0d01 0105 0500 ....So the NN is the next payload type. Its value depends on whichever payload comes after this Authentication payload. The LL is the length of this payload. After the sha1WithRSAEncryption ASN.1 block, which is 15 bytes, comes the actual signature. We've left that out here, because it isn't shown in this example 🫶
Acknowledgements 💜
Most of this work was built on what the IPsecME design team did for ECDSA. The design team members were Dan Harkins, Johannes Merkle, Tero Kivinen, David McGrew, and Yoav Nir. Honestly, a whole squad 👑
Authors' Addresses 🦋
Tero Kivinen INSIDE Secure Eerikinkatu 28 Helsinki FI-00180 Finland
EMail: kivinen@iki.fi
Joel Snyder Opus One 1404 East Lind Road Tucson, AZ 85719
Phone: +1 520 324 0494 EMail: jms@opus1.com
And that's the whole thing, bestie! 🎀✨
📦 where this page comes from
- ietf: rfc7427 2015-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms