Browse Prior Art Database

Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2) (RFC4307)

IP.com Disclosure Number: IPCOM000132541D
Original Publication Date: 2005-Dec-01
Included in the Prior Art Database: 2005-Dec-21
Document File: 7 page(s) / 13K

Publishing Venue

Internet Society Requests For Comment (RFCs)

Related People

J. Schiller: AUTHOR

Abstract

The IPsec series of protocols makes use of various cryptographic algorithms in order to provide security services. The Internet Key Exchange (IKE (RFC 2409) and IKEv2) provide a mechanism to negotiate which algorithms should be used in any given association. However, to ensure interoperability between disparate implementations, it is necessary to specify a set of mandatory-to-implement algorithms to ensure that there is at least one algorithm that all implementations will have available. This document defines the current set of algorithms that are mandatory to implement as part of IKEv2, as well as algorithms that should be implemented because they may be promoted to mandatory at some future time.

This text was extracted from an ASCII text file.
This is the abbreviated version, containing approximately 21% of the total text.

Network Working Group                                        J. Schiller
Request for Comments: 4307         Massachusetts Institute of Technology
Category: Standards Track                                  December 2005


                Cryptographic Algorithms for Use in the
                Internet Key Exchange Version 2 (IKEv2)

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2005).

Abstract

   The IPsec series of protocols makes use of various cryptographic
   algorithms in order to provide security services.  The Internet Key
   Exchange (IKE (RFC 2409) and IKEv2) provide a mechanism to negotiate
   which algorithms should be used in any given association.  However,
   to ensure interoperability between disparate implementations, it is
   necessary to specify a set of mandatory-to-implement algorithms to
   ensure that there is at least one algorithm that all implementations
   will have available.  This document defines the current set of
   algorithms that are mandatory to implement as part of IKEv2, as well
   as algorithms that should be implemented because they may be promoted
   to mandatory at some future time.

1.  Introduction

   The Internet Key Exchange protocol provides for the negotiation of
   cryptographic algorithms between both endpoints of a cryptographic

   association.  Different implementations of IPsec and IKE may provide
   different algorithms.  However, the IETF desires that all
   implementations should have some way to interoperate.  In particular,
   this requires that IKE define a set of mandatory-to-implement
   algorithms because IKE itself uses such algorithms as part of its own
   negotiations.  This requires that some set of algorithms be specified
   as "mandatory-to-implement" for IKE.

Schiller                    Standards Track                     [Page 1]
RFC 4307             IKEv2 Cryptographic Algorithms        December 2005


   The nature of cryptography is that new algorithms surface
   continuously and existing algorithms are continuously attacked.  An
   algorithm believed to be strong today may be demonstrated to be weak
   tomorrow.  Given this, the choice of mandatory-to-implement algorithm
   should be conservative so as to minimize the likelihood of it being
   compromised quickly.  Thought should also be given to performance
   considerations as many uses of IPsec will be in en...