| Delay-Tolerant Networking | E. Birrane |
| Internet-Draft | JHU/APL |
| Intended status: Experimental | December 31, 2015 |
| Expires: July 3, 2016 |
Suite B Profile for Bundle Protocol Security (BPSec)
draft-birrane-dtn-bpsec-suiteb-profile-00
The United States Government has published guidelines for "NSA Suite B Cryptography" dated July, 2005, which defines cryptographic algorithm policy for national security applications. This document specifies the conventions for using Suite B cryptography with Bundle Protocol Security (BPSec).
Since many of the Suite B algorithms enjoy uses in other environments as well, the majority of the conventions needed for the Suite B algorithms are already specified in other documents. This document references the source of these conventions, with some relevant details repeated to aid developers that choose to support Suite B within BPSec.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 3, 2016.
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
This document specifies the conventions for using NSA Suite B Cryptography [SuiteB] with Bundle Protocol Security (BPSec) [I-D.ietf-dtn-bpsec]. This document is an update to the Suite-B profile created by Burgin and Hennessy [I-D.hennessy-bsp-suiteb-profile]. This update adapts the profile from BSP [RFC6257] to BPSec.
BPSec provides source authentication, data integrity, and data confidentiality services for the Bundle Protocol (BP) [RFC5050].
[I-D.birrane-dtn-bpsec-suiteb-ciphersuites] defines ciphersuites for BPSec that are comprised of Suite B algorithms for use with the security block types BAB, BIB, and BCB. Suite B compliant implementations for BPSec MUST use one of these ciphersuites, depending upon the desired security level and security services.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
Suite B requires that key establishment and signature algorithms be based upon Elliptic Curve Cryptography and that the encryption algorithm be AES [FIPS197]. Suite B includes [SuiteB]:
The two elliptic curves used in Suite B appear in the literature under two different names. For sake of clarity, we list both names below.
| Curve | NIST Name | SECG Name | OID [FIPS186-3] |
|---|---|---|---|
| P-256 | nistp256 | secp256r1 | 1.2.840.10045.3.1.7 |
| P-384 | nistp384 | secp384r1 | 1.3.132.0.34 |
Suite B provides for two levels of cryptographic security, namely a 128-bit minimum level of security (minLOS_128) and a 192-bit minimum level of security (minLOS_192). Each level defines a minimum strength that all cryptographic algorithms must provide.
We divide the Suite B non-signature primitives into two columns as shown in Table 1.
| Column 1 | Column 2 | |
|---|---|---|
| Encryption | AES-128 | AES-256 |
| Key Agreement | ECDH on P-256 | ECDH on P-384 |
| Key Wrap | AES-128 Key Wrap | AES-256 Key Wrap |
| Hash for PRF/MAC | SHA-256 | SHA-384 |
At the 128-bit minimum level of security:
At the 192-bit minimum level of security:
Digital signatures using ECDSA MUST be used for authentication by Suite B compliant BPSec implementations. To simplify notation, ECDSA- 256 will be used to represent an instantiation of the ECDSA algorithm using the P-256 curve and the SHA-256 hash function, and ECDSA-384 will be used to represent an instantiation of the ECDSA algorithm using the P-384 curve and the SHA-384 hash function.
If configured at a minimum level of security of 128 bits, a Suite B compliant BPSec implementation MUST use either ECDSA-256 or ECDSA-384 for authentication. It is allowable for one party to authenticate with ECDSA-256 and the other party to authenticate with ECDSA-384.
Security-aware nodes in a Suite B compliant BPSec implementation configured at a minimum level of security of 128 bits MUST be able to verify ECDSA-256 signatures and SHOULD be able to verify ECDSA-384 signatures unless it is absolutely certain that the implementation will never need to verify certificates from an authority which uses an ECDSA-384 signing key.
Security-aware nodes in a Suite B compliant BPSec implementation configured at a minimum level of security of 192 bits MUST use ECDSA- 384 for authentication and MUST be able to verify ECDSA-384 signatures.
Security-aware nodes in a Suite B compliant BPSec implementation, at both minimum levels of security, MUST each use an X.509 certificate that complies with the "Suite B Certificate and Certificate Revocation List (CRL) Profile" [RFC5759] and that contains an elliptic curve public key with the key usage field set for digital signature. The endpoint IDs MUST be placed in the subjectAltName field of the X.509 certificate.
Each system MUST specify a security level of a minimum of 128 bits or 192 bits. The security level determines which suites from [I-D.birrane-dtn-bpsec-suiteb-ciphersuites] are allowed.
Each of the ciphersuites specified in [I-D.birrane-dtn-bpsec-suiteb-ciphersuites] satisfy the Suite B requirements in Section 3 of this document.
At the 128-bit minimum level of security:
At the 192-bit minimum level of security:
Two levels of security may be achieved using this specification. Users must consider their risk environment to determine which level is appropriate for their own use.
This specification does not consider the CMS Block of the BPSec specification. Details for using CMS in Suite B can be found in [RFC6318]. The security considerations in [RFC5652] discuss the CMS as a method for digitally signing data and encrypting data.
None.
| [I-D.hennessy-bsp-suiteb-ciphersuites] | Burgin, K. and A. Hennessy, "Suite B Ciphersuites for the Bundle Security Protocol", Internet-Draft draft-hennessy-bsp-suiteb-ciphersuites-00, March 2012. |
| [I-D.hennessy-bsp-suiteb-profile] | Burgin, K. and A. Hennessy, "Suite B Profile for the Bundle Security Protocol", Internet-Draft draft-hennessy-bsp-suiteb-profile-00, March 2012. |
| [RFC5050] | Scott, K. and S. Burleigh, "Bundle Protocol Specification", RFC 5050, DOI 10.17487/RFC5050, November 2007. |
| [RFC6257] | Symington, S., Farrell, S., Weiss, H. and P. Lovell, "Bundle Security Protocol Specification", RFC 6257, DOI 10.17487/RFC6257, May 2011. |
| [SP800-56A] | National Institute of Standards and Technology, "Recommendation for Pair-wise Key Establishment Schemes Using Discrete Logarithm Cryptography", NIST Special Publication 800-56A, March 2007. |
| [SuiteB] | U.S. National Security Agency, "Fact Sheet NSA Suite B Cryptography", NIST Special Publication 800-56A, January 2009. |