Network Working Group D. Brown, Certicom INTERNET-DRAFT October 10, 2006 Expires: April 10, 2007 Additional ECC Groups For IKE and IKEv2 <draft-ietf-ipsec-ike-ecc-groups-10.txt> Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on April 10, 2007. Abstract This document describes additional elliptic curve groups for use in IKE (as defined in RFC 2409) and IKEv2 (as defined in RFC 3406). These groups are defined to align IKE and IKEv2 with other ECC implementations and standards, and in addition, many of them provide higher strength than the previousley defined Oakley groups. 1. Introduction This document describes groups for use in elliptic curve Diffie-Hellman in IKE in addition to the Oakley groups included in [IKE], [IKEv2], and [MODP-IKE]. The document assumes that the reader is familiar with the IKE protocol and the concept of Oakley Groups, as defined in RFC 2409 [IKE] and IKEv2 [IKEv2]. The ECC groups given here are among the fifteen groups that NIST recommends in FIPS 186-2 [FIPS-186-2]. Brown [Page 1] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 RFC2409 [IKE] defines five standard Oakley Groups - three modular exponentiation groups and two elliptic curve groups over GF[2^N]. One modular exponentiation group (768 bits - Oakley Group 1) is mandatory for all implementations to support, while the other four are optional. Both elliptic curve groups (Oakley Groups 3 and 4) are defined over GF[2^N] with N composite. Additional groups that can be used with IKE and IKEv2 are defined in [MODP-IKE]. This document describes all fifteen elliptic curve groups recommended by NIST in [FIPS-186-2]. The reasons for supporting the 15 NIST ellipitc curve groups are for better alignment with other standards, such as [FIPS 186-2], [X9.62], [X9.63], and [SEC-2]. Some of these groups also afford efficiency advantages in hardware applications since the underlying arithmetic is binary field arithmetic. The groups described are capable of providing security consistent with both the new Advanced Encryption Standard [FIPS-197] and with Triple DES [SP-800-67]. These groups could also be defined with the New Group Mode but including them in this document will encourage interoperability of IKE and IKEv2 implementations based on elliptic curve groups. 2. The Additional Elliptic Curve Groups The groups given in this document are capable of providing security consistent with AES keys of 128, 192, and 256 bits, and also with 3DES keys of lengths 168, whose corresponding strengths is often rated at 112 bits. Additionally a lower security level, of 80 bits, is also supported for backwards compatability. The following table, based on tables from [HOF] and [LEN], gives approximate comparable key sizes for security stregnths for selected ECC key sizes by comparison symmetric key sizes. The estimates are based on the running times of the best algorithms known today. Strength ECC2N ECP -------- ----- --- 80 163 192 112 233 224 128 283 256 192 409 384 256 571 521 Table 1: Comparable key sizes Thus, for example, when securing a 192-bit symmetric key, it is prudent to use either 409-bit ECC2N or 384-bit ECP. With smaller ECC key sizes the symmetric keys would be underprotected. Brown [Page 2] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 The fifteen groups described in this document use elliptic curves over GF[2^N] with N prime or over GF[P] with P prime. This addresses concerns expressed by many experts regarding curves defined over GF[2^N] with N composite -- concerns highlighted by the recent attacks on such curves due to Gaudry, Hess, and Smart [WEIL] and due to Jacobson, Menezes and Stein [JMS]. Seven of the groups described here have been assigned identifiers by IANA [IANA] and the remaining eight might later be assigned identifiers by IANA. A brief summary of the IANA identified groups for IKE follows. Groups with IANA numbers 1 through 4 are identified in [IKE]. The group with IANA number 5 is identified in [MODP-IKE]. The group with IANA number 6, [X9.62] and [SEC 2], with object identifier sect163r1, but it is not one of the fifteen curves that NIST recommends [FIPS-186-2]. Nevertheless, it is included here for backwards interoperability with existing implementations. The remaining NIST recommended groups are suggested and anticipated to be assigned IANA numbers as specified in Table 2. id Group Type Group Description NIST Name SEC 2 OID -- ---------- ----------------- --------- --------- 22 2 ECP ECPRGF192Random P-192 secp192r1 23 3 EC2N EC2NGF163Random B-163 sect163r2 7 3 EC2N EC2NGF163Koblitz K-163 sect163k1 6 3 EC2N EC2NGF163Random2 none sect163r1 24 2 ECP ECPRGF224Random P-224 secp224r1 25 3 EC2N EC2NGF233Random B-233 sect233r1 26 3 EC2N EC2NGF233Koblitz K-233 sect233k1 19 2 ECP ECPRGF256Random P-256 secp256r1 8 3 EC2N EC2NGF283Random B-283 sect283r1 9 3 EC2N EC2NGF283Koblitz K-283 sect283k1 20 2 ECP ECPRGF384Random P-384 secp384r1 10 3 EC2N EC2NGF409Random B-409 sect409r1 11 3 EC2N EC2NGF409Koblitz K-409 sect409k1 21 2 ECP ECPRGF521Random P-521 secp521r1 12 3 EC2N EC2NGF571Random B-571 sect571r1 13 3 EC2N EC2NGF571Koblitz K-571 sect571k1 Table 2. Recommended Groups and Names Brown [Page 3] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 Generally, three curves are defined at each strength. Two curves chosen verifiably at random, which helps security in that the elliptic curve is thereby unlikely to belong to some rare but weak classe of curves. One verifiably random is defined over a prime field, and another over a prime field. The third curve is Koblitz curve defined over a binary field. These curves are special curves with some efficient implementation properties due to the special structure of the curve [KOB] and [SOL]. Generally speaking, curves defined over prime field are more efficient than those over binary fields when implemented software, because typical platforms for software have built-in 32-bit integer multipliers or better. In hardware implementations, binary fields potentially offer more efficient implementation. For elliptic curve groups, the data in the KE payload when using this group is the octet string representation specified in [SEC1], [X9.62], [X9.63], [FIPS-186-2], and [IEEE-1363] of the point on the curve chosen by taking the randomly chosen secret Ka and computing Ka*G, where * is the repetition of the group addition. In this representation, a leading octet with value 02,03, or 04, indicates whether the point is compressed and uncompressed, and if compressed, which of the two choices for the y-coordinate. The coordinates are represented as octet strings consisting of initial padding of zero bits, if needed, followed by a bit string of length corresponding to the field size. For binary fields, a polynomial basis representation is used, with irreducible polynomials specified in this document in the corresponding subsection describing the group. If the initiator chooses secret i and the responder chooses secret r, then the KEi is i*G and KEr is r*G. The formatting of KEr is identical to that for KEi. The raw shared secret is the x-coordinate (only) of (ir)*G, using the same representation of field elements as octet strings that is used the x-coordinate inside of KEi and KEr. Implementations of this document MUST support one of the groups in Table 2. The groups in Table 2 are arranged to 5 classes, corresponding to approximately equivalent security strength. To encourage interoperability, implementations that support one of these classes, SHOULD support the one group in that class that is defined over a prime field (which will be one of P-192, P-224, P-256, P-384, or P-521). Implementations SHOULD support one of P-256 or P-384. Implementations MAY support any set of groups. The groups are now described in greater detail. The order follows the proposed id number of the group, which does match not the order of Table 2 (based on security) for historical reasons. Brown [Page 4] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 2.1 Group EC2NGF163Random2 IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 6 (six). The curve is based on the Galois Field GF[2^163]. The field size is 163. The irreducible polynomial used to represent the field is: u^163 + u^7 + u^6 + u^3 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + ax^2 + b. Group Curve a: 07b6882c aaefa84f 9554ff84 28bd88e2 46d2782a e2 Group Curve b: 0713612d cddcb40a ab946bda 29ca91f7 3af958af d9 Group Generator G: 03036997 9697ab43 89778956 6789567f 787a7876 a654 The order of the generator G defined above is the prime: 03ffffff ffffffff ffffff48 aab689c2 9ca71027 9b The curve order is twice this prime. The group was chosen verifiably at random using SHA-1 as specified in [X9.62] from the seed: 24b7b137 c8a14d69 6e676875 6151756f d0da2e5c However, for historical reasons, the method to generate the group from the seed differs slightly from the method described in [X9.62]. Specifically the coefficient Group Curve b produced from the seed is the reverse of the coefficient that would have been produced by the method described in [X9.62]. 2.2 Group EC2NGF163Koblitz IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 7 (seven). The curve is based on the Galois Field GF[2^163]. The field size is 163. The irreducible polynomial used to represent the field is: u^163 + u^7 + u^6 + u^3 + 1. Brown [Page 5] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 The equation for the elliptic curve is: y^2 + xy = x^3 + x^2 + 1. Group Generator G: 0302fe13 c0537bbc 11acaa07 d793de4e 6d5e5c94 eee8 The order of the generator G is the prime: 04000000 00000000 00000201 08a2e0cc 0d99f8a5 ef The curve order is twice this prime. 2.3 Group EC2NGF283Random IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 8 (eight). The curve is based on the Galois Field GF[2^283]. The field size is 283. The irreducible polynomial used to represent the field is: u^283 + u^12 + u^7 + u^5 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + x^2 + b. Group Curve b: 027b680a c8b8596d a5a4af8a 19a0303f ca97fd76 45309fa2 a581485a f6263e31 3b79a2f5 Group Generator G: 0305f939 258db7dd 90e1934f 8c70b0df ec2eed25 b8557eac 9c80e2e1 98f8cdbe cd86b120 53 The order of the generator G is the prime: 03ffffff ffffffff ffffffff ffffffff ffffef90 399660fc 938a9016 5b042a7c efadb307 The curve order is twice this prime. The group was chosen verifiably at random in normal basis representation using SHA-1 as specified in [X9.62] from the seed: Brown [Page 6] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 77e2b073 70eb0f83 2a6dd5b6 2dfc88cd 06bb84be 2.4 Group EC2NGF283Koblitz IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 9 (nine). The curve is based on the Galois Field GF[2^283]. The field size is 283. The irreducible polynomial used to represent the field is: u^283 + u^12 + u^7 + u^5 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + 1. Group Generator G: 02050321 3f78ca44 883f1a3b 8162f188 e553cd26 5f23c156 7a168769 13b0c2ac 24584928 36 The order of the generator G is the prime: 01ffffff ffffffff ffffffff ffffffff ffffe9ae 2ed07577 265dff7f 94451e06 1e163c61 The curve order is four times this prime. 2.5 Group EC2NGF409Random IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 10 (ten). The curve is based on the Galois Field GF[2^409]. The field size is 409. The irreducible polynomial used to represent the field is: u^409 + u^87 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + x^2 + b. Group Curve b: 021a5c2c 8ee9feb5 c4b9a753 b7b476b7 fd6422ef 1f3dd674 761fa99d 6ac27c8a 9a197b27 2822f6cd 57a55aa4 f50ae317 b13545f Group Generator G: 03015d48 60d088dd b3496b0c 60647562 60441cde 4af1771d 4db01ffe 5b34e597 03dc255a 868a1180 515603ae ab60794e 54bb7996 a7 The order of the generator G is the prime: Brown [Page 7] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 10000000 00000000 00000000 00000000 00000000 00000000 00001e2a ad6a612f 33307be5 fa47c3c9 e052f838 164cd37d 9a21173 The curve order is twice this prime. The curve was chosen verifiably at random in normal basis representation using SHA-1 as specified in [X9.62] from the seed: 4099b5a4 57f9d69f 79213d09 4c4bcd4d 4262210b 2.6 Group EC2NGF409Koblitz IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 11 (eleven). The curve is based on the Galois Field GF[2^409]. The field size is 409. The irreducible polynomial used to represent the field is: u^409 + u^87 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + 1. Group Generator G: 030060f0 5f658f49 c1ad3ab1 890f7184 210efd09 87e307c8 4c27accf b8f9f67c c2c46018 9eb5aaaa 62ee222e b1b35540 cfe90237 46 The order of the generator G is the prime: 7fffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffe5f83 b2d4ea20 400ec455 7d5ed3e3 e7ca5b4b 5c83b8e0 1e5fcf The curve order is four times this prime. 2.7 Group EC2NGF571Random IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 12 (twelve). The curve is based on the Galois Field GF[2^571]. The field size is 571. The irreducible polynomial used to represent the field is: u^571 + u^10 + u^5 + u^2 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + x^2 + b. Group Curve b: Brown [Page 8] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 2f40e7e2 221f295d e297117b 7f3d62f5 c6a97ffc b8ceff1c d6ba8ce4 a9a18ad8 4ffabbd8 efa59332 be7ad675 6a66e294 afd185a7 8ff12aa5 20e4de73 9baca0c7 ffeff7f2 955727a Group Generator G: 03030300 1d34b856 296c16c0 d40d3cd7 750a93d1 d2955fa8 0aa5f40f c8db7b2a bdbde539 50f4c0d2 93cdd711 a35b67fb 1499ae60 038614f1 394abfa3 b4c850d9 27e1e776 9c8eec2d 19 The order of the generator G is the prime: 3fffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe 661ce18f f5598730 8059b186 823851ec 7dd9ca11 61de93d5 174d66e8 382e9bb2 fe84e47 The curve order is twice this prime. The group was chosen verifiably at random in normal basis representation using SHA-1 as specified in [X9.62] from the seed: 2aa058f7 3a0e33ab 486b0f61 0410c53a 7f132310 2.8 Group EC2NGF571Koblitz IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 13 (thirteen). The curve is based on the Galois Field GF[2^571]. The field size is 571. The irreducible polynomial used to represent the field is: u^571 + u^10 + u^5 + u^2 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + 1. Group Generator G: 02026eb7 a859923f bc821896 31f8103f e4ac9ca2 970012d5 d4602480 4801841c a4437095 8493b205 e647da30 4db4ceb0 8cbbd1ba 39494776 fb988b47 174dca88 c7e29452 83a01c89 72 The order of the generator G is the prime: 20000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001 31850e1f 19a63e4b 391a8db9 17f4138b 630d84be 5d639381 e91deb45 cfe778f6 37c1001 The group order is four times this prime. Brown [Page 9] INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 2.9 Group ECPRGF384Random IKE and IKEv2 implementations MAY support an ECP group with the following characteristics. This group is assigned id 22 (twenty-two). The curve is based on the integers modulo the generalized Mersenne prime p given by p = 2^192 - 2^64 - 1. The equation for the elliptic curve is: y^2 = x^3 - 3 x + b. Group Curve b: 64210519 e59c80e7 0fa7e9ab 72243049 feb8deec c146b9b1 Group Generator G: 03188da8 0eb03090 f67cbf20 eb43a188 00f4ff0a fd82ff10 12 The order of the generator G is the prime: ffffffff ffffffff ffffffff 99def836 146bc9b1 b4d22831 The group was chosen verifiably at random using SHA-1 as specified in [X9.62] from the seed: 3045ae6f c8422f64 ed579528 d38120ea e12196d5 2.10 Group EC2NGF163Random IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 23 (twenty-three). The curve is based on the Galois Field GF[2^163]. The field size is 163. The irreducible polynomial used to represent the field is: u^163 + u^7 + u^6 + u^3 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + x^2 + b. Group Curve b: 020a6019 07b8c953 ca1481eb 10512f78 744a3205 fd Group Generator G: Brown [Page 10]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 0303f0eb a16286a2 d57ea099 1168d499 4637e834 3e36 The order of the generaotr G above is the prime: 04000000 00000000 00000292 fe77e70c 12a4234c 33 The curve order is twice this prime. The group was chosen verifiably at random in normal basis representation using SHA-1 as specified in [X9.62] from the seed: 85e25bfe 5c86226c db12016f 7553f9d0 e693a268 2.11 Group ECPRGF224Random IKE and IKEv2 implementations MAY support an ECP group with the following characteristics. This group is assigned id 24 (twenty-four). The curve is based on the integers modulo the generalized Mersenne prime p given by p = 2^224 - 2^96 + 1. The equation for the elliptic curve is: y^2 = x^3 - 3 x + b. Group Curve b: b4050a85 0c04b3ab f5413256 5044b0b7 d7bfd8ba 270b3943 2355ffb4 Group Generator G: 02b70e0c bd6bb4bf 7f321390 b94a03c1 d356c211 22343280 d6115c1d 21 The order of the generator G is the prime: ffffffff ffffffff ffffffff ffff16a2 e0b8f03e 13dd2945 5c5c2a3d The group was chosen verifiably at random using SHA-1 as specified in [X9.62] from the seed: bd713447 99d5c7fc dc45b59f a3b9ab8f 6a948bc5 2.12 Group EC2NGF233Random IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 25 (twenty-five). The curve is based on the Galois Field GF[2^233]. The field size is 233. The irreducible polynomial used to represent the field is: Brown [Page 11]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 u^233 + u^74 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + x^2 + b. Group Curve b: 0066647e de6c332c 7f8c0923 bb58213b 333b20e9 ce4281fe 115f7d8f 90ad Group Generator G: 0300fac9 dfcbac83 13bb2139 f1bb755f ef65bc39 1f8b36f8 f8eb7371 fd558b The order of the generator G above is the prime: 01000000 00000000 00000000 00000013 e974e72f 8a692203 1d2603cf e0d7 The curve order is twice this prime. The group was chosen verifiably at random in normal basis representation using SHA-1 as specified in [X9.62] from the seed: 74d59ff0 7f6b413d 0ea14b34 4b20a2db 049b50c3 2.13 Group EC2NGF233Koblitz IKE and IKEv2 implementations MAY support an EC2N group with the following characteristics. This group is assigned id 26 (twenty-six). The curve is based on the Galois Field GF[2^233]. The field size is 233. The irreducible polynomial used to represent the field is: u^233 + u^74 + 1. The equation for the elliptic curve is: y^2 + xy = x^3 + 1. Group Generator G: 02017232 ba853a7e 731af129 f22ff414 9563a419 c26bf50a 4c9d6eef ad6126 The order of the generator G is the prime: 80000000 00000000 00000000 0000069d 5bb915bc d46efb1a d5f173ab df The curve order is four times this prime. Brown [Page 12]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 3. Test Vectors What follows is a set of test vectors, in the form: <SEC 2 name for elliptic curve group> i = <initiator secret value> r = <responder secret value> KEi = <initiator key exchange payload> KEr = <responder key exchange payload> Z = <raw shared secret> Here are the test vectors: secp192r1 i = 7092e5fd 43a17f6a 33753259 89284eba 093564e1 944e176d r = d6185566 ec0b1f52 cc562765 60907cb1 a8683d84 49b882ce KEi = 00000021 00160000 03841c98 8076d857 fdda4ccf 3bae5cf5 f521336a 650fdc7d c4 KEr = 00000021 00160000 03445a52 f30ce615 c53e1175 c04db6f0 bb7a03d3 096e2c20 9e Z = cac49383 d8bf6b5f d8e5d5b7 69c0a91f 68f9b5d0 91b831d8 secp224r1 i = 626167f5 e4365260 7a9cc400 35c6dca7 256fa372 1a68baf4 e40f86e1 r = 38524a05 e71d0233 61bfdb29 0b69d15b 7d8390aa 5ac837a0 c82d9f63 KEi = 00000025 00180000 029167b2 a96e1cbd e468976e 364d4d31 10c8f58f 579c44a0 be3c98a1 a8 KEr = 00000025 00180000 02dc7765 dea1a085 f3f077f1 38854fe0 850ca89c 2e32d037 7bde2458 15 Z = 7b1bf042 33c15681 ba530222 1a2ce34b 18a92dbb b37cc0a7 72a91516 secp256r1 i = 9d3ae814 8192a83f 20530cb2 5edb11e8 b7ea1358 3a70ca34 5b0f571b 91317abe Brown [Page 13]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 r = 922d3e7c 675bb9b4 d9613ff2 1793991b 3623844f 072e53d2 8a6baff8 9cf85ab4 KEi = 00000029 00130000 03084cc4 7b198b64 0da01bc1 0dfcfa03 4db89dbb 072ea0ae 9cd6eac6 0900ffc4 92 KEr = 00000029 00130000 02b9528b 7eb56463 4315ebe2 f1e3e4fa bd671d8e 6f487b6e e35796a6 a6daaed1 f7 Z = 52c8f824 e13b4065 1b0ec4ad 8dbdb116 b15aebc4 8fbc0360 d84ff8cd c3c73e6c secp384r1 i = 52d3051d 6675ed1e 52a4e922 4fb2ad9a 910358bb 9a72ddf7 d96a2383 bad90ef8 15f83a94 edfe52a0 1193f843 d29f1958 r = f13ba470 9dee2f45 32b251bf b3b1b87b 1adac356 299e4ea9 472356ac a6ddad29 0b00f221 4740f693 c6a03c2d c52bd419 KEi = 00000039 00140000 032991ae 8b27d708 0db61914 0023dc72 41cdbcd8 130de451 f9268c42 0674b816 9973f89b e2f3d9f3 082cb049 511457db 35 KEr = 00000039 00140000 0270a447 c2e24022 c3a52f95 634a1705 2a02831c ca790e6f 0c1feff9 515a38cf d7c487ab d9e19e8f 4ef49b8a 4b268b1a 0f Z = f3cde42e 0e9dd289 82294ac1 af62cbd1 429f2899 11b3e053 5a81ebb5 13a2903b c53f0ecd 5c511083 5e5a4a90 3629b0c5 secp521r1 i = ea78946a bd68bb79 a55f8f99 93cf5389 fbb0a10d 3b580624 29c6322a 987c957f 8854a5a4 ec636d70 2a7b0753 7341f631 9cc6d03c 447da5e9 f59d2846 0caa98db eb r = e68807bb dc90cca2 7848c6bc 38426ddf 5b19c09d 144d0417 06bc9ed1 afade9e8 1585faf9 e173f340 001016ef 82ea5b4a 8b785fee 0c403a6e 39228df6 2a337e47 9c KEi = 0000004b 00150000 0300584c 2476258d d61c0987 61710976 c4b50fc4 c47177f4 2562f2d5 75bf933c 7699122b c37c77da 0a7079e0 a4c2d131 8d337642 41e4c562 c7ff7bad 5cf0ce1e dddfa0 KEr = 0000004b 00150000 02011483 326d756d 8600c5d8 c6a0bc60 c80297c3 7e3368f4 5bbcf4d5 db78ad4b 1b1d8584 b019416f 92e8e65f 5fe370fb 35558a61 32790304 2ae79809 5c5638e0 93a0b4 Z = 006ea860 d9c8518c e2de03a0 0a9d4c66 48cd33cb 665302c9 e41163e9 b6b7eded f892c9c8 5c63d7c2 cc76e3c2 f3cfe2fd 8cd13314 658f6f4d a6198dd9 fd99cd42 de1b Brown [Page 14]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 sect163r1 i = 647f8bc4 fa3fa625 b41456b9 1c899269 ffe277bc r = ef8fa305 ed836a8f df206e65 94f086f9 762e6f69 KEi = 0000001e 00060000 0300e772 d9e512e9 71a512b9 406edce9 99b50bee 78b2 KEr = 0000001e 00060000 020115ed 6148869f 8be39923 0825b220 7ee9e494 9381 Z = 01d75dd0 142db15a 25b6f802 4bab20ee 78f90f40 9f sect163r2 i = 027e06da 864be386 2c261654 c15ec556 8e45eb7f b6 r = 03a7c88f a7363f8f f9ff1d28 13027089 bd96e07c 48 KEi = 0000001e 00170000 0302ed80 fc3986c4 a978b09c 34dcbc37 6a7975b9 2276 KEr = 0000001e 00170000 0201aed6 520fb246 8fb424de c3c31c4a 1fc0e1cf 702a Z = 07befaa4 0951cf0d 1c972d4d f6297d5c 30b726cf 98 sect163k1 i = 0137fb36 360a457b 6a23b29e 11a4760a 17788180 8a r = 010c489b bb3b602a 7df626e9 f0625294 b1d795a0 32 KEi = 0000001e 00070000 0305be09 5b082931 8fa0e3e0 096e31bf b829b8ee 95ec KEr = 0000001e 00070000 0205d9c9 45eb02de c3b7ad1b ace077bf 37753e33 26b3 Z = 07b13e8c 9452ab89 11368072 5df13128 c055c9d3 ce sect233r1 i = 5b038de5 0df0f1f4 9a06c1fb 46c45d5a c63e4541 b99df194 21c33b79 02 r = 3b48a626 65e29c5f 78ff6b77 14c1bb82 ad210c8c 29572eac cbdc3abb ce KEi = 00000027 00190000 0301334d 9878fa49 d0dbbf59 78f49e57 aeaad93a 1c3fbd7a 17acc369 dd68d1 Brown [Page 15]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 KEr = 00000027 00190000 030158db 2605ce54 3cc42202 48bcce6c c055d8d4 ee4ea1e4 9ef1b9dd 823797 Z = 00b0dcfc 6d66c3d1 d987f8b0 75edc927 63257bfc baa7af34 b8f6242d 5d3c sect233k1 i = 4ea153c3 05784cf0 23a54756 a99281e1 a8105ab8 5bb63898 0d07de46 a2 r = 424a8945 1d6cd439 305e44f0 6fc574ec 8268b626 560a44ee 85b624d5 89 KEi = 00000027 001a0000 03014e27 1e22edf7 df456f59 b366b846 2c5f6ef2 6bddfb67 ed764a5b 39e6dc KEr = 00000027 001a0000 02014b56 33f29fdf 353ebb63 75ddffec 46f162f4 19d7962a 8d04fdb9 3e38ee Z = 00f3ef41 79b17ceb 7e041581 727d01cf 3d7423ec 249f44d3 53d1e2de 7412 sect283r1 i = 0294203a b7551182 dec6b777 f4d1c65b db752752 17a356a7 efad1303 55aa3f17 aeb3852f r = 03314912 0a7d8d98 4f2c3346 d9ec8896 2f5b0545 1d5ead84 3dd278de df49bd84 24009110 KEi = 0000002d 00080000 0201959e 200deaa6 2d055e1d 4e141ed7 dcdfde81 05708644 31cc5a28 0a229418 b8dfc4c1 86 KEr = 0000002d 00080000 03034237 aff2fae3 1d2bed60 3ba7e0aa 9cbefee1 313bec69 05f40e27 0cf448c3 6ec7d959 81 Z = 066c0249 c890ffed a0ce0fd3 bd76a650 6423f868 5e649d03 5842bf25 a388ec4e dd207eff sect283k1 i = 09024924 08f4d64e 351eabe7 b9da659f 089a20a2 d19f62b9 2499a3eb f2410637 4ab51b r = 0e2a59cb 494b4978 4436e053 2cf25ee4 44225ffd 39139bba 2e19d3ba e482f651 368716 KEi = 0000002d 00090000 02044e95 ad563972 553e8c29 c89e4f57 155c1799 38ec1b86 4487e287 fe94a48b a59de2f4 4b KEr = 0000002d 00090000 030658a1 8c6946e1 9f17a1f8 eb44b461 0d0052c9 7cb52296 2738a584 38a5ecc9 6deffd84 b5 Brown [Page 16]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 Z = 0194027a d85e4075 d89247b2 e3c3500d ebff0dce 5ad63a02 a07652df b7da3b75 afe11e88 sect409r1 i = 18624d82 5f61d687 d6f7707f f35a23b3 29feea91 3ec45afe 81d79e4a 09b7d026 e8da7fb4 0f972a53 d6fa1e6f 0de235c7 81254b r = f73eec0f 98ab794f 0633f4ee 84cca2f8 dc1a1fde be850337 6418029c 5cf14e34 788d8ea3 2857128c 67297413 902e9dd7 b8c730 KEi = 0000003d 000a0000 02016f9e 561b996d 1d3ac272 0e7cace8 6cc96d58 c2518814 ff922096 38daee25 6e405590 cbd7a05c 2a4e24da ec0bf005 777e89eb 49 KEr = 0000003d 000a0000 0300ea45 1ad0be01 cdeba8f3 b7c12708 10f8725f 03e76768 bd07cd78 cbd7a1c4 d354abba 3615658e f81e397d 99b6c261 a77f7103 f5 Z = 00beb0ec d7886e0b c13dead1 43621dd1 7133dbda e112b0f9 168ee853 e259c5b0 26b4582f 6ccb69cd e62c7000 fbb3545d 2d89e25f sect409k1 i = 600b86e2 0b7a66d8 af5cd1e3 a22adbcf 1f6e6556 3dd932af 6589d095 3b517a56 6f6230de 70f36839 9c13533e cba32924 90cbfb r = 77d67725 0e919500 a410cbb0 2c6842d9 c12fa8a8 b57f539d a192a025 b92b4166 e317b757 64a42358 54ed3dac 477483de 03e2f2 KEi = 0000003d 000b0000 0300964b 2b145579 51de6ffe a67eec42 39a26600 22a45b26 59db5d92 4251c400 5b0d4de3 47b6fde7 6fc43bce 546d7cd4 f977d579 7a KEr = 0000003d 000b0000 03016ecd 20beea51 7ae36a40 e330d8a5 6812559f 5e5ffd16 fa6716f9 53814d9b f37570d7 9b180687 b5a385bf b9420f25 50e4b613 8e Z = 00a1f44a 752e980f 3db78ee5 62786949 afa2e586 7d8cc9cf 078c8f54 a7de9107 af70fc87 6f5bd1e1 94c53e7a 56043397 ef2c8b50 sect571r1 i = e422d840 0d8e6299 90c7ca8b 26b74a0d 873d8d6d 906f4af6 e44c6176 63327773 f0a1c5f0 355ac9dc b2c4c0b6 a13e38e1 8b35cda6 65a1e513 4be36044 d3d38778 9e01c2be 6d0713 r = 01e58461 bb4f5bbb 737dfe61 7150968b 2a9773e7 f4425ac5 a40a9ef4 280f97d7 a057b2df 91b3ccf7 7beb2990 596e998f d57b3c42 a46e694f af1923a6 b1899a70 6ce4b346 424b1b7d Brown [Page 17]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 KEi = 00000051 000c0000 0302c17e 8482e65e 8eafd4eb e150bf93 fd8797db 78b7c365 39724d69 79c7b2b9 428be38e 0bbf94f6 43bd6647 477a33e5 89cb491b 1f2015f9 bb5e5999 153de52d 8150e50e c557c720 da KEr = 00000051 000c0000 03030e89 d2c1aa8a 278e43b8 53066adf 742fdd74 91414d90 7a74c011 371bdf64 dc38502f 2e18ae79 ac702400 5398959d e999e259 65294561 024ff0b5 10855f27 263dd0d1 cff78cbe b3 Z = 0579791f f1725f09 c70e7378 278137c0 7dcb5c41 2b30f7ae 681a8681 41404ea9 5d945f26 d4d0da1b a3860291 5b67184e 23288e4f 3021b578 02821d44 94868987 1e68cfc2 82862cc5 sect571k1 i = 01fb96e0 fb6f5c57 03b258e0 32ee9cf3 fc5eb27b 37bfc797 cf7954ef 82e37cfa 551e5492 08af3365 882343cf fc7fca72 949b3346 ff49cd32 51a3a172 00a0eef8 b64bce70 a5087cad r = 2b25d3d5 fd86cb53 a0fef2fb 4ffc4e20 f1ac33a1 47d69d45 31676dfd 8a92a6b9 bf6c3437 9189eba8 7679bdee 05e0f8a4 5790fb77 e4fc47c7 babe4170 839a93be b58e214c 1a8470 KEi = 00000051 000d0000 0301e4dc 1f82924e a99921ba bda3ee48 792836ec 1d033578 e7a3d372 f9360118 2b511589 d2a84d9f ab6e86d5 ea8f00dd df5c8b1c 22bbd9bc 96b191da 5bab247a f9e666e6 824ffe2b 72 KEr = 00000051 000d0000 02049667 3c15e735 aba12ea6 a1413c4e a6e50edd ec8f21b2 22df4092 5f483d85 e779f48e 3439f881 18e325f6 e3aa6e4e e2855440 79ed2ea4 d8680b5d 9c06ab23 2944e62e 93e1cf8f 9b Z = 066c0d8b cf8c17f2 7d7367bf 0e8a9c29 31fa258b e3b7861a 6c021a5b b52d214a b1923528 0e9c6b61 bf72c20a 8d64c26a 9a4b9ff0 75fd3be6 be03c33c 56e6cf3f f7517e5b 08dcbe65 4. Security Considerations Since this document describes some groups for use within IKE and IKEv2, many of the security considerations contained within RFC 2409 apply here as well. Many of the groups described in this document offer higher strength than the groups in RFC 2409. This allows the IKE and IKEv2 to offer security comparable with the AES algorithms. In addition, since all the groups are defined over GF[P] with P prime or GF[2^N] with N prime, they address the concerns expressed regarding the elliptic curve groups included in RFC 2409, which are curves defined over GF[2^N] with N composite. The work of Gaudry, Hess, and Smart [WEIL] reveal some of the weaknesses in such groups. Brown [Page 18]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 5. IANA Considerations It is propose that the id column Table 2 be defined as the IANA numbers that MUST be used in IKE and IKEv2 to identify the groups specified in this document. 6. Intellectual Property Rights The IETF has been notified of intellectual property rights claimed in regard to the specification contained in this document. For more information, consult the online list of claimed rights (http://www.ietf.org/ipr.html). The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat. 7. Acknowledgments Tero Kivinen, Eric Fung, Alfred Hoenes and Russ Housley provided valuable comments and suggestions. 8. References [ECP-IKE] D. Fu, J. Solinas, ECP Groups for IKE and IKEv2, draft-ietf-ipsec-ike-ecp-groups-03.txt, work in progress. [IKE] D. Harkins and D. Carrel, The Internet Key Exchange, RFC 2409, November 1998. [IKEv2] C. Kaufman, Editor, Internet Key Exchange (IKEv2) Protocol, RFC 4306, December 2005. [IANA-IKE] Internet Assigned Numbers Authority. Internet Key Exchange (IKE) - IKE Attributes - Group Descriptions. See http://www.iana.org/assignments/ipsec-registry [IANA-IKEv2] Internet Assigned Numbers Authority. Internet Key Exchange Version 2 (IKEv2) Parameters - Diffie-Hellman Transform Ids. http://www.iana.org/assignments/ikev2-parameters Brown [Page 19]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 [IEEE-1363] Institute of Electrical and Electronics Engineers. IEEE 1363-2000, Standard for Public Key Cryptography. IEEE Microprocessor Standards Committee. August 2001. See: http://grouper.ieee.org/groups/1363/index.html [KOB] N. Koblitz, CM curves with good cryptographic properties. Proceedings of Crypto '91. Pages 279-287. Springer-Verlag, 1992. [FIPS-186-2] National Institute of Standards and Technology. Digital Signature Standard (DSS), FIPS PUB 186-2, January 2000. http://csrc.nist.gov/publications/fips/fips186-2/fips186-2-change1.pdf [FIPS-197] National Institute of Standards and Technology. Advanced Encryption Standard (AES), FIPS PUB 197, November 2001. http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf [SP-800-56] E. Barker, D. Johnson, and M. Smid, NIST Special Publication 800-56A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography. March 2006. http://csrc.nist.gov/publications/nistpubs/800-56A/sp800-56A_May-3-06.pdf [SP-800-67] W. C. Barker, NIST Special Publication 800-67, Recommendation for Triple Data Encryption Algorithm (TDEA) Block Cipher. May 2004. http://csrc.nist.gov/publications/nistpubs/800-67/SP800-67.pdf [HOF] P. Hoffman and H. Orman, Determining strengths for public keys used for exchanging symmetric keys, Internet-draft. August 2000. [LEN] A. Lenstra and E. Verhuel, Selecting cryptographic key sizes. See: http://www.cryptosavvy.com. [JMS] M. Jacobson, A. Menezes and A. Stein, Solving Elliptic Curve Discrete Logarithm Problems Using Weil Descent, Combinatorics and Optimization Research Report 2001-31, May 2001. See: http://www.cacr.math.uwaterloo.ca/. [MODP-IKE] T. Kivinen and M. Kojo, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE), rfc3526.txt, May 2003. [SEC1] Standards for Efficient Cryptography Group. SEC 1 - Elliptic Curve Cryptography. Ver. 1.0., 2000. See: http://www.secg.org [SEC2] Standards for Efficient Cryptography Group. SEC 2 - Recommended Elliptic Curve Domain Parameters. Ver. 1.0., 2000. See: http://www.secg.org [SOL] J. Solinas, An improved algorithm for arithmetic on a family of elliptic curves, Proceedings of Crypto '97, Pages 357-371, Springer-Verlag, 1997. Brown [Page 20]

INTERNET-DRAFT Additional ECC Groups for IKE and IKEv2 January 2006 [WEIL] Gaudry, P., Hess, F., Smart, Nigel P. Constructive and Destructive Facets of Weil Descent on Elliptic Curves, HP Labs Technical Report No. HPL-2000-10, 2000. See: http://www.hpl.hp.com/techreports/2000/HPL-2000-10.html [X9.62] American National Standards Institute, ANS X9.62-2005: Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm. November 2005. [X9.63] American National Standards Institute. ANSI X9.63-2001, Public Key Cryptography for the Financial Services Industry: Key Agreement and Key Transport using Elliptic Curve Cryptography. November 2001. 9. Author's Addresses Daniel R. L. Brown Certicom Corp. 5520 Explorer Drive, 4th Floor, Mississauga, Ontario, L4W 5L1 Canada dbrown@certicom.com 10. Full Copyright Statement Copyright (C) The Internet Society (2006). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Brown [Page 21]