Signature Authentication in the Internet Key Exchange Version 2 (IKEv2)
updates
- rfc-7296 — Internet Key Exchange Protocol Version 2 (IKEv2)
Extracted elements (20)
An 8-bit length field is prepended to the ASN.1 AlgorithmIdentifier object so that simple implementations can determine the ASN.1 object's length without parsing it, allowing the signature value to be located immediately following. This avoids requiring all IKEv2 implementations to implement a full DER parser.
Hash algorithm selection is not a negotiated single common value; each direction independently picks a hash algorithm from the other peer's advertised list. This avoids a mandatory intersection step and allows asymmetric algorithm use, simplifying the protocol while still ensuring each side uses a peer-accepted algorithm.
The existing IKEv2 per-algorithm authentication methods (one for RSA, one for DSS/SHA-1, three for ECDSA curves each tied to one hash) are cumbersome: adding new hash functions or elliptic curves requires defining new authentication method codes, causing the number of required methods to become unmanageable. This RFC introduces a single generic 'Digital Signature' method to replace all per-algorithm methods.
The signature algorithm is specified using the same ASN.1 AlgorithmIdentifier format used in PKIX (RFC 5280), encoded in DER, placed before the actual signature. This allows the OID to identify both the signature algorithm and the hash function, and enables simple implementations to treat the ASN.1 object as a binary blob compared against a fixed set of known values without needing a full ASN.1 parser.
The SIGNATURE_HASH_ALGORITHMS Notify is sent in IKE_SA_INIT (not IKE_AUTH) so that the hash algorithm list is exchanged before authentication occurs, enabling both peers to know which hash algorithms are acceptable before generating or verifying any signature.
For RSASSA-PSS, the AlgorithmIdentifier parameters are mandatory (not optional or NULL) and must encode hashAlgorithm, maskGenAlgorithm, saltLength, and trailerField. For RSA PKCS#1 v1.5 algorithms, NULL parameters must be explicitly present. For DSA and ECDSA algorithms, optional parameters are always omitted.
This specification does not define a mechanism for peers to explicitly advertise their public/private key pair types. Responders can infer the initiator's supported key type via the IDr payload, the Certificate Request payload (e.g., a CA cert signed by an ECDSA key implies the initiator can process ECDSA), or by mirroring the key type used by the initiator. If no compatible key type is found, the responder replies with AUTHENTICATION_FAILED.
For hash truncation in the Digital Signature method, the method specified in ANSI X9.62:2005 MUST be used.
If both ends send and receive SIGNATURE_HASH_ALGORITHMS Notify payloads and signature authentication is to be used, then the 'Digital Signature' authentication method (Auth Method 14) MUST be used.
When calculating the digital signature, a peer MUST pick one hash algorithm sent by the other peer in its SIGNATURE_HASH_ALGORITHMS notification. Different algorithms can be used in different directions.
When encoding the ASN.1 AlgorithmIdentifier, implementations SHOULD use the preferred format called for by the algorithm specification: if the algorithm specification says 'preferredPresent', the parameters object must be present (NULL if no parameters); if 'preferredAbsent', the entire optional parameters object is omitted.
A new IKEv2 authentication method 'Digital Signature' (Auth Method value 14) is defined. It may only be used when the SIGNATURE_HASH_ALGORITHMS Notify payload has been sent and received by each peer. The Authentication Data field includes an ASN.1 AlgorithmIdentifier object before the raw signature value, unlike all other existing IKEv2 authentication methods.
A new Notify payload type SIGNATURE_HASH_ALGORITHMS (value 16431) is sent inside the IKE_SA_INIT exchange by each peer. It implicitly indicates support for the new 'Digital Signature' authentication method and carries a list of 16-bit hash algorithm identifiers (from the new IANA IKEv2 Hash Algorithms registry) that the sender supports.
This document adds SIGNATURE_HASH_ALGORITHMS (value 16431) to the 'IKEv2 Notify Message Types - Status Types' registry and adds Digital Signature (value 14) to the 'IKEv2 Authentication Method' registry.
This document creates a new IANA registry 'IKEv2 Hash Algorithms' with Expert Review policy. Initial values: RESERVED=0, SHA1=1, SHA2-256=2, SHA2-384=3, SHA2-512=4. Values 5-1023 are Unassigned; 1024-65535 are reserved for Private Use. MD5 is intentionally excluded as it is not safe for signature hash use.
MD5 is excluded from the IKEv2 Hash Algorithms registry because it is not considered safe for signature use. The existing IKEv2 RSASSA-PKCS1-v1_5 method has known security vulnerabilities; the new Digital Signature method enables use of RSASSA-PSS and other more secure padding methods. The existing DSS/SHA-1-only method is also replaced, allowing longer keys and hashes.
Security downgrade attacks on IKEv2 Authentication payloads are not a significant concern because any modification to the AUTH payload will be detected when the peer computes the signature over the IKE messages. However, attacks that force catastrophically weak ciphers must be blocked by policy.
The new Digital Signature method does not tie the elliptic curve to a specific hash function, making it possible to mix security levels (e.g., a 512-bit curve with SHA-1). The effective security is determined by the weakest component. Implementers should provide policy mechanisms in IKE databases to limit such mixing or restrict algorithm combinations.
The Authentication Data for Auth Method 14 ('Digital Signature') is structured as: ASN.1 Length (1 octet) | AlgorithmIdentifier ASN.1 object (variable) | Signature Value (variable). There is no padding between the ASN.1 object and the signature value.
The SIGNATURE_HASH_ALGORITHMS Notify payload has Protocol ID set to 0, SPI Size set to 0, Notify Message Type set to 16431, and Notification Data containing a packed list of 16-bit hash algorithm identifiers with no padding between them.