Using the Edwards-Curve Digital Signature Algorithm (EdDSA) in the Internet Key Exchange Protocol Version 2 (IKEv2)
Extracted elements (12)
EdDSA (Ed25519 and Ed448) accepts messages of arbitrary size without prehashing, unlike most signature algorithms that either cannot sign messages larger than their key or truncate them. RFC 7427's SIGNATURE_HASH_ALGORITHMS notification assumes a hashing phase followed by a signing phase, which does not apply to EdDSA; hence the new "Identity" value is introduced to signal no hashing is needed.
Prehashed variants of EdDSA (Ed25519ph, Ed448ph) are not recommended for IKEv2 because there is minimal burden in buffering the entire message to make two passes, as recommended in RFC 8032 Section 8.5. IKEv2 is an appropriate protocol for the non-prehashed forms.
RFC 7427 defines SIGNATURE_HASH_ALGORITHMS where each IKE peer lists supported hash algorithms, assuming all signature schemes involve a hashing phase. EdDSA does not fit this model; RFC 8420 extends that mechanism with the "Identity" identifier to accommodate hash-free signature algorithms.
Ed25519 and Ed448 are only defined with the "Identity" hash and MUST NOT be sent to a receiver that has not indicated support for the "Identity" hash.
Implementations MUST have the "Identity" value in the SIGNATURE_HASH_ALGORITHMS notification when EdDSA is supported and configured. The "Identity" value MUST NOT be used if none of the supported and configured algorithms accept arbitrary-size inputs.
Implementations SHOULD NOT have other hash algorithms in the SIGNATURE_HASH_ALGORITHMS notification if all supported and configured signature algorithms have the property of accepting arbitrary-size inputs.
The prehashed versions of Ed25519 and Ed448 (Ed25519ph and Ed448ph) MUST NOT be used in IKE.
A new value called "Identity" (5) is defined in the "IKEv2 Hash Algorithms" registry for use in the SIGNATURE_HASH_ALGORITHMS notification. Inserting this value signals that the receiver supports at least one signature algorithm accepting messages of arbitrary size, such as Ed25519 and Ed448.
IANA has assigned the value 5 with the name "Identity" in the "IKEv2 Hash Algorithms" registry, referencing RFC 8420.
The "Identity" hash value MUST NOT be used if none of the supported and configured algorithms accept arbitrary-size inputs, as it would provide no benefit and could create misleading capability signals. Conversely, when EdDSA is configured, "Identity" MUST appear in the notification to allow EdDSA to operate correctly.
The ASN.1 OID for Ed25519 is id-Ed25519 ::= { 1.3.101.112 }, with parameters absent, length 7 bytes, and binary encoding 3005 0603 2B65 70.
The ASN.1 OID for Ed448 is id-Ed448 ::= { 1.3.101.113 }, with parameters absent, length 7 bytes, and binary encoding 3005 0603 2B65 71.