IKE and IKEv2 Authentication Using the Elliptic Curve Digital Signature Algorithm (ECDSA)
Extracted elements (16)
Additional efficiency can be gained by simultaneously using ECDSA for IKE/IKEv2 authentication and elliptic curve groups for key exchange, making an all-ECC deployment attractive for constrained environments.
ECDSA cannot be specified for IKEv2 independently of an associated hash function because IKEv2 has no transform type for hash functions. Therefore, the hash function and elliptic curve group must be bundled into named algorithm identifiers (ECDSA-256, ECDSA-384, ECDSA-521) rather than negotiated separately.
ECDSA signatures are smaller than RSA signatures of similar cryptographic strength, and ECDSA public keys and certificates are smaller than comparable-strength DSA keys. This results in improved communications efficiency and motivates its addition as a third authentication option alongside RSA and DSA in IKE/IKEv2.
For consistency with IKEv2, the document also defines IKE Phase 1 signatures using the same three named ECDSA variants (ECDSA-256, ECDSA-384, ECDSA-521), even though IKE has a generic ECDSA attribute (number 8). This avoids a divergence between how IKE and IKEv2 specify ECDSA.
The IANA-assigned attribute number for generic ECDSA in IKE is 8, but the IKEv2 authentication method registry did not originally include ECDSA. This document resolves the gap by introducing three specific named methods (ECDSA-256, ECDSA-384, ECDSA-521) added to both registries.
The bit lengths of r and s are enforced, if necessary, by pre-pending the value with zeros. For ECDSA-256 r and s are each 256 bits; for ECDSA-384, 384 bits; for ECDSA-521, 528 bits (padded to 528-bit field size).
When ECDSA-256, ECDSA-384, or ECDSA-521 is used as the digital signature in IKE or IKEv2, the signature payload SHALL contain an encoding of the computed signature consisting of the concatenation of the pair of integers r and s.
ECDSA-256 uses the 256-bit random ECP group (NIST P-256) with SHA-256 and was assigned IANA ID value 9 in the IKEv2 authentication method registry.
ECDSA-384 uses the 384-bit random ECP group (NIST P-384) with SHA-384 and was assigned IANA ID value 10 in the IKEv2 authentication method registry.
ECDSA-521 uses the 521-bit random ECP group (NIST P-521) with SHA-512 and was assigned IANA ID value 11 in the IKEv2 authentication method registry.
The ECDSA signature components r and s are defined as: r equals the x-coordinate of the ephemeral public key g^k reduced modulo q; s equals (h + r*w)*kinv reduced modulo q, where h is the message hash, w is the static private key, and kinv is the modular inverse of the ephemeral private key k.
Three ECDSA signature algorithms are defined for use in IKE and IKEv2: ECDSA-256 (256-bit random ECP group, SHA-256), ECDSA-384 (384-bit random ECP group, SHA-384), and ECDSA-521 (521-bit random ECP group, SHA-512). Each algorithm specifies the elliptic curve group, hash function, and authentication method as a unit.
IANA updated its registry of IPsec authentication methods (IANA-IKE) and its registry of IKEv2 authentication methods (IANA-IKEv2) to include ECDSA-256 (ID 9), ECDSA-384 (ID 10), and ECDSA-521 (ID 11).
ECDSA-256, ECDSA-384, and ECDSA-521 are designed to offer security comparable to AES-128, AES-192, and AES-256 respectively, providing a consistent security level ladder aligned with symmetric key strengths.
Implementers should ensure that appropriate security measures are in place when deploying ECDSA within IKE or IKEv2; the security considerations in the base IKE and IKEv2 specifications also apply to this extension.
The IKE/IKEv2 authentication payload for ECDSA is a concatenation of integers r and s, each zero-padded to a fixed bit length. ECDSA-256 produces a 512-bit (64-byte) signature; ECDSA-384 produces 768 bits (96 bytes); ECDSA-521 produces 1056 bits (132 bytes).