Internet DRAFT - draft-hennessy-bsp-suiteb-profile
draft-hennessy-bsp-suiteb-profile
Network Working Group K. Burgin
Internet-Draft A. Hennessy
Intended status: Informational National Security Agency
Expires: September 6, 2012 March 5, 2012
Suite B Profile for the Bundle Security Protocol
draft-hennessy-bsp-suiteb-profile-00
Abstract
The United States Government has published guidelines for "NSA Suite
B Cryptography" dated July, 2005, which defines cryptographic
algorithm policy for national security applications. This document
specifies the conventions for using Suite B cryptography in the
Bundle Security Protocol (BSP)
Since many of the Suite B algorithms enjoy uses in other environments
as well, the majority of the conventions needed for the Suite B
algorithms are already specified in other documents. This document
references the source of these conventions, with some relevant
details repeated to aid developers that choose to support Suite B.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 6, 2012.
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
Burgin & Hennessy Expires September 6, 2012 [Page 1]
Internet-Draft Suite B Profile for BSP March 2012
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Requirements Language . . . . . . . . . . . . . . . . . . . . . 3
3. Suite B Requirements . . . . . . . . . . . . . . . . . . . . . 3
4. Minimum Levels of Security (minLOS) . . . . . . . . . . . . . . 4
4.1. Non-signature Primitives . . . . . . . . . . . . . . . . . 4
4.2. Suite B Authentication . . . . . . . . . . . . . . . . . . 4
4.3. Digital Signatures and Certificates . . . . . . . . . . . . 5
5. Suite B Ciphersuites . . . . . . . . . . . . . . . . . . . . . 5
6. Security Considerations . . . . . . . . . . . . . . . . . . . . 6
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 7
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 7
8.1. Normative References . . . . . . . . . . . . . . . . . . . 7
8.2. Informative References . . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 8
Burgin & Hennessy Expires September 6, 2012 [Page 2]
Internet-Draft Suite B Profile for BSP March 2012
1. Introduction
This document specifies the conventions for using NSA Suite B
Cryptography [SuiteB] in the Bundle Security Protocol (BSP).
The Bundle Security Protocol (BSP) provides source authentication,
data integrity, and data confidentiality services for the Bundle
Protocol.
[SuiteB-suites] defines eight ciphersuites for BSP that are comprised
of Suite B algorithms for use with the security block types BAB, PIB,
PCB, and ESB. Suite B compliant implementations for BSP MUST use one
of these eight ciphersuites depending upon the desired security level
and security services.
2. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
3. Suite B Requirements
Suite B requires that key establishment and signature algorithms be
based upon Elliptic Curve Cryptography and that the encryption
algorithm be AES [FIPS197]. Suite B includes [SuiteB]:
Encryption: Advanced Encryption Standard (AES) [FIPS197]
(key sizes of 128 and 256 bits)
Digital Signature: Elliptic Curve Digital Signature Algorithm
(ECDSA) [FIPS186-3] (using the curves with
256- and 384-bit prime moduli)
Key Exchange: Elliptic Curve Diffie-Hellman (ECDH)
[SP800-56A] (using the curves with 256- and
384-bit prime moduli)
Hashes: SHA-256 and SHA-384 [FIPS180-3]
The two elliptic curves used in Suite B appear in the literature
under two different names. For sake of clarity, we list both names
below:
Burgin & Hennessy Expires September 6, 2012 [Page 3]
Internet-Draft Suite B Profile for BSP March 2012
Curve NIST Name SECG Name OID [FIPS186-3]
---------------------------------------------------------
P-256 nistp256 secp256r1 1.2.840.10045.3.1.7
P-384 nistp384 secp384r1 1.3.132.0.34
4. Minimum Levels of Security (minLOS)
Suite B provides for two levels of cryptographic security, namely a
128-bit minimum level of security (minLOS_128) and a 192-bit minimum
level of security (minLOS_192). Each level defines a minimum
strength that all cryptographic algorithms must provide.
4.1. Non-signature Primitives
We divide the Suite B non-signature primitives into two columns as
shown in Table 1.
Column 1 Column 2
+-------------------+-------------------+
Encryption | AES-128 | AES-256 |
+-------------------+-------------------+
Key Agreement | ECDH on P-256 | ECDH on P-384 |
+-------------------+-------------------+
Key Wrap | AES-128 Key Wrap | AES-256 Key Wrap |
+-------------------+-------------------+
Hash for PRF/MAC | SHA-256 | SHA-384 |
+-------------------+-------------------+
Table 1: Suite B Cryptographic Non-Signature Primitives
At the 128-bit minimum level of security:
o the non-signature primitives MUST either come exclusively from
Column 1 or exclusively from Column 2, with Column 1 being the
preferred suite.
At the 192-bit minimum level of security:
o the non-signature primitives MUST come exclusively from Column 2.
4.2. Suite B Authentication
Digital signatures using ECDSA MUST be used for authentication by
Suite B compliant BSP implementations. To simplify notation, ECDSA-
256 will be used to represent an instantiation of the ECDSA algorithm
using the P-256 curve and the SHA-256 hash function, and ECDSA-384
Burgin & Hennessy Expires September 6, 2012 [Page 4]
Internet-Draft Suite B Profile for BSP March 2012
will be used to represent an instantiation of the ECDSA algorithm
using the P-384 curve and the SHA-384 hash function.
If configured at a minimum level of security of 128 bits, a Suite B
compliant BSP implementation MUST use either ECDSA-256 or ECDSA-384
for authentication. It is allowable for one party to authenticate
with ECDSA-256 and the other party to authenticate with ECDSA-384.
This flexibility will allow interoperability between a security
source and a security destination that have different sizes of ECDSA
authentication keys.
Security-aware nodes in a Suite B compliant BSP implementation
configured at a minimum level of security of 128 bits MUST be able to
verify ECDSA-256 signatures and SHOULD be able to verify ECDSA-384
signatures unless it is absolutely certain that the implementation
will never need to verify certificates from an authority which uses
an ECDSA-384 signing key.
Security-aware nodes in a Suite B compliant BSP implementation
configured at a minimum level of security of 192 bits MUST use ECDSA-
384 for authentication and MUST be able to verify ECDSA-384
signatures.
4.3. Digital Signatures and Certificates
Security-aware nodes in a Suite B compliant BSP implementation, at
both minimum levels of security, MUST each use an X.509 certificate
that complies with the "Suite B Certificate and Certificate
Revocation List (CRL) Profile" [RFC5759] and that contains an
elliptic curve public key with the key usage field set for digital
signature. The endpoint IDs MUST be placed in the subjectAltName
field of the X.509 certificate.
5. Suite B Ciphersuites
Each system MUST specify a security level of a minimum of 128 bits or
192 bits. The security level determines which suites from [SuiteB-
suites] are allowed.
Each of the eight ciphersuites specified in [SuiteB-suites]: BAB-
HMAC256, BAB-HMAC384, PIB-ECDSA-SHA256, PIB-ECDSA-SHA384, PCB-ECDH-
SHA256-AES128, PCB-ECDH-SHA384-AES256, ESB-ECDH-SHA256-AES128, and
ESB-ECDH-SHA384-AES256, satisfy the Suite B requirements in Section 3
of this document.
At the 128-bit minimum level of security:
Burgin & Hennessy Expires September 6, 2012 [Page 5]
Internet-Draft Suite B Profile for BSP March 2012
o If a Bundle Authentication Block (BAB) is included in the bundle,
one of BAB-HMAC256 or BAB-HMAC384 MUST be used by Suite B
compliant BSP implementations.
o If a Payload Integrity Block (PIB) is included in the bundle, one
of PIB-ECDSA-SHA256 or PIB-ECDSA-SHA384 MUST be used by Suite B
compliant BSP implementations.
o If a Payload Confidentiality Block (PCB) is included in the
bundle, one of PCB-ECDH-SHA256-AES128 or PCB-ECDH-SHA384-AES256
MUST be used by Suite B compliant BSP implementations.
o If a Extension Security Block (ESB) is included in the bundle, one
of ESB-ECDH-SHA256-AES128 or and ESB-ECDH-SHA384-AES256 MUST be
used by Suite B compliant BSP implementations.
At the 192-bit minimum level of security:
o If a Bundle Authentication Block (BAB) is included in the bundle,
BAB-HMAC384 MUST be used by Suite B compliant BSP implementations.
o If a Payload Integrity Block (PIB) is included in the bundle, PIB-
ECDSA-SHA384 MUST be used by Suite B compliant BSP
implementations.
o If a Payload Confidentiality Block (PCB) is included in the
bundle, PCB-ECDH-SHA384-AES256 MUST be used by Suite B compliant
BSP implementations.
o If a Extension Security Block (ESB) is included in the bundle,
ESB-ECDH-SHA384-AES256 MUST be used by Suite B compliant BSP
implementations.
6. Security Considerations
Two levels of security may be achieved using this specification.
Users must consider their risk environment to determine which level
is appropriate for their own use.
The default security policy in Section 6 of [RFC6257] holds for Suite
B compliant BSP implementations with the exception that the
ciphersuites of [SuiteB-suites] MUST be used instead of the mandatory
ciphersuites of [RFC6257]. The security considerations in [RFC6257]
discuss the Bundle Security Protocol and apply here as well.
RFC 6257 [RFC6257] Section 2.5 requires a different key be used for
protecting ESBs than is used to protect other security blocks. To
Burgin & Hennessy Expires September 6, 2012 [Page 6]
Internet-Draft Suite B Profile for BSP March 2012
satisfy this requirement, Suite B compliant BSP implementations
SHOULD perform a new ECDH key exchange when protecting ESBs. This is
accomplished by the security source generating a new ephemeral key
pair.
Details for using CMS in Suite B can be found in [RFC6318]. The
security considerations in [RFC5652] discuss the CMS as a method for
digitally signing data and encrypting data.
7. IANA Considerations
none.
8. References
8.1. Normative References
[FIPS180-3]
National Institute of Standards and Technology, "Secure
Hash Standard", FIPS PUB 180-3, October 2008.
[FIPS186-3]
National Institute of Standards and Technology, "Digital
Signature Standard (DSS)", FIPS PUB 186-3, June 2009.
[FIPS197] National Institute of Standards and Technology, "Advanced
Encryption Standard (AES)"", FIPS PUB 197, November 2001.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", STD 70,
RFC 5652, September 2009.
[RFC5759] Solinas, J. and L. Zieglar, "Suite B Certificate and
Certificate Revocation List (CRL) Profile", RFC 5759,
January 2010.
[RFC6257] Symington, S., Farrell, S., Weiss, H., and P. Lovell,
"Bundle Security Protocol Specification", RFC 6257,
May 2011.
[RFC6318] Housley, R. and J. Solinas, "Suite B in Secure/
Multipurpose Internet Mail Extensions (S/MIME)", RFC 6318,
June 2011.
Burgin & Hennessy Expires September 6, 2012 [Page 7]
Internet-Draft Suite B Profile for BSP March 2012
[SuiteB-suites]
Burgin, K. and A. Hennessy, "Suite B Ciphersuites for the
Bundle Security Protocol",
draft-hennessy-bsp-suiteb-ciphersuites (work in progress),
January 2012.
8.2. Informative References
[SP800-56A]
National Institute of Standards and Technology,
"Recommendation for Pair-wise Key Establishment Schemes
Using Discrete Logarithm Cryptography", NIST Special
Publication 800-56A, March 2007.
[SuiteB] U.S. National Security Agency, "Fact Sheet NSA Suite B
Cryptography", January 2009,
<http://www.nsa.gov/ia/programs/suiteb_cryptography/>.
Authors' Addresses
Kelley Burgin
National Security Agency
Email: kwburgi@tycho.ncsc.mil
Angela Hennessy
National Security Agency
Email: amhenne@nsa.gov
Burgin & Hennessy Expires September 6, 2012 [Page 8]