The Associated Press April 20, 1993, Tuesday, PM cycle
SECTION: Domestic News
HEADLINE: South Dakota Gov. George Mickelson, Seven Others Killed in Plane Crash
BYLINE: By GREG SMITH, Associated Press Writer
DATELINE: DUBUQUE, Iowa
BODY: South Dakota Gov. George Mickelson, who followed his father's political footsteps to the state Capitol, was killed along with seven other people when their state-owned plane crashed in a rainstorm. The 52-year-old Republican was on his way back from Cincinnati, where he other state officials had gone on a lobbying mission to protect jobs at a Sioux Falls, S.D., meatpacking plant. State flags were lowered Monday night in South Dakota as tearful state employees gathered in the governor's Capitol office to share their grief. "There are no words to describe the sadness that I and the people of South Dakota feel tonight," Lt. Gov. Walter Dale Miller said in a statement. Miller, a Republican, was to be sworn in this afternoon as South Dakota's 29th governor. He will serve the remaining two years of Mickelson's term. The twin-engine turboprop went down Monday afternoon at a farm 14 miles southwest of Dubuque after the pilot reported engine trouble and was cleared for an emergency landing at the Dubuque airport. The plane sheared off a silo and crashed through a barn, bursting into flames. No one on the ground was hurt. "As far as the plane itself is concerned, it's in many pieces, small pieces, pretty much broken up," Sheriff Bob Lyons said. Jackson County Medical Examiner Paul Koob said seven of the eight were burned beyond recognition but that positive identification should be completed by late today using dental records. Wreckage of the barn still smoldered today. No one was home at the time of the crash but some livestock in the barn died, said Rose Marie Ambrosy, whose family owns the farm. "You can see parts of the plane all over the hay field," Ambrosy said. Heavy rain was reported in the area at the time, but the Federal Aviation Administration said it had not determined if weather was a factor. Investigators from the National Transportation Safety Board were sent to the site. Also killed were state Economic Development Commissioner Roland Dolly; state Energy Policy Commissioner Ron Reed; banker Dave Birkeland, Roger Hainje, director of the Sioux Falls Development Foundation; Angus Anson of Northern States Power; and two pilots, Ron Becker and Dave Hansen. Mickelson was narrowly elected governor in 1986 and won another four-year term in 1990. His father, George T. Mickelson, was governor of South Dakota from 1947 to 1951. "I grew up in a family where government and the political process were part of table conversation," Mickelson said in an interview last year. Mickelson was co-chairman of the National Governors Association's task force on health care. "George didn't ever let partisanship stand in the way of serving the people," said former North Dakota Gov. George Sinner, a Democrat. "Nor did he ever fear doing the tough things when they were right." Mickelson was born in Mobridge, S.D. After earning a law degree from the University of South Dakota in 1965, he spent two years with the Army and served in Vietnam. He served in the state House for six years, his final term in 1979-80 as speaker. After first taking office, Mickelson raised $ 40 million for low-interest business loans through a temporary increase in the sales tax. He won passage of a two-year freeze on property taxes and a debt-restructuring program for farmers. In 1989, he made two record increases in state aid to school districts by setting aside 56 percent of the state's sales tax revenue. Mickleson said his initiatives had created more than 6,000 jobs, raised teacher salaries, held down property taxes and avoided a state income tax. Democrats contended his job loan program didn't support agricultural production and said his increases in education aid barely kept up with inflation. After a 1989 party at the governor's mansion, Mickelson's teen-age son David was charged with a sexual offense stemming from an alleged rape. The governor and his wife were out of town at the time. David Mickelson was acquitted of sexual offenses but was put on probation for underage drinking. Besides his son and his wife, Linda, Mickelson survivors include another son and a daughter. Miller, 67, a rancher and insurance executive, spent 20 years in the South Dakota House, where he was speaker and majority leader. He left the Legislature in 1986 to become Mickelson's running mate.
The Associated Press April 24, 1993, Saturday, AM cycle April 24, 1993, Saturday, AM cycle SECTION: Washington Dateline HEADLINE: Propeller Missing From Governor's Plane BYLINE: By LAWRENCE L. KNUTSON, Associated Press Writer DATELINE: WASHINGTON BODY:
Federal investigators said Saturday they had discovered metal fatigue and fractures on the mountings that connect a missing propeller blade to the plane that crashed Monday, killing South Dakota's governor. The twin-engine Mitsubishi MU-2 aircraft, whose pilot had reported engine trouble, crashed into a 75-foot silo, killing Gov. George Mickelson and seven other people. Alan Pollock, a spokesman for the National Transportation Safety Board, said an agency metallurgist working at the crash site nine miles south of the Dubuque, Iowa, airport found "evidence of a pre-existing crack and a fatigue zone." The aircraft parts have been sent to the safety agency's laboratories here for further testing. Pollock said the Iowa crash resembles a 1991 incident over Utica, N.Y., in which a propeller blade separated in flight and pierced the fuselage of a similar aircraft. He said both planes showed evidence of cracks and fatigue near the hub where the propeller blade was attached. The safety board recommended after the Utica crash that the Federal Aviation Administration develop a means of testing such propeller blades for fatigue and cracks. Pollock said the FAA declined to act because there had been only one such incident. He said that as recently as last August the safety board repeated its concerns and told the FAA that the potential for a catastrophic accident existed. The safety agency also will examine air traffic control records at Chicago and review the taped conversations between the Dubuque air traffic control tower and the aircraft. In the current accident a number of factors point to the missing propeller, although it will probably take the safety board six to nine months to officially determine the cause of the accident. Pollock said eyewitnesses to the crash reported that one engine was not turning. And he said radar data when the aircraft was about 25 miles from Dubuque at an altitude of 24,000 feet shows a small object close to the plane. Radar data at 8,000 feet also shows a small object, this time moving away from the aircraft. "We are very interested in finding that lost propeller," Pollock said, adding that the possibility that it separated in flight is "one of the areas we are focusing on." In addition, Pollock said the safety agency is looking into the background of the pilots and how the state of South Dakota managed and serviced and maintained the aircraft. Jim Brown, chairman of Hartzell Propeller Inc. of Piqua, Ohio, maker of the propeller, said Saturday that so far his company has not been advised by federal investigators on whether anything should be done about the thousands of other aircraft that use some version of the Hartzell propeller. He said the propeller has had a good record, given the numbers in use. "There are well in excess of 35,000 of this style of propeller," he said. "They've been in service for over 30 years. It's been an enormously reliable product for us."
"Know thy self, know thy enemy. A thousand battles, a thousand victories." - Sun Tzu
Thursday, April 14, 2011
United Flight 553
Legend
CAM - Cockpit area microphone
RDO - Radio transmission from accident aircraft
-1 - Voice identified as Captain
-2 - Voice identified as First Officer
-3 - Voice identified as Second officer
-? - Unidentifiable voiceCHI APP = Chicago ApproachMTWR = Chicago-Midway Tower*
- Unintelligible word#
- Expletive deleted()
- Questionable text9VS = Aero Commander 690, N309VS pilot
all times are in GMT
20.25:25.0
CHI APC
Five five three, call the tower on one eighteen seven
20.25:28.0
RDO-2
Eighteen seven, five five three
20.25:35.5
RDO-2
Midway tower, United five five three, an' we'r out of three for two
20.25:39.0
MTWR
United five five three, report passing the outer marker, number two on the approach
20.25:41.0
CAM-3
Chicago, this is five five three (2nd officer calling ARINC)
20.25:44.0
RDO-2
Okay, report the outer marker
20.25:46.5
CAM-1
Let's have the gear down please
20.25:48.0
RDO-1
[Start of first sound of first series off Kedzie outer marker beacon tones]
20.25:50.97
CAM-3
Chicago, five five three (2nd officer calling ARINC)
20.25:51.62
CAM
[Sound of a click - sound similar to sound of landing gear handle going into down detent]
CAM
[Sound of chime - simultaneous with click above]
20.25:52.20
MTWR
Nine Victor Sugar, what's your airspeed?
20.25:54.5
[End sound of first series of Kedzie outer marker beacon tones]
20.25:54.74
9VS
Ah, we're down to ah, hundred twenty knots
20.25:55.06
CAM
[Increase in ambient noise level - similar to increase made by nose landing gear extended]
20.25:56.82
MTWR
Ah hundred and twenty, okay
20.26:00.64
CAM
[Sound of first of four clicks in rapid increase - sounds similar to flap lever moved from 15 degrees to 25 degrees position]
20.26:01.50
CAM-?
Gear 'own
CAM
[Sound of several clicks - similar to sound of stabilizer trim actuation]
20.26:10.02
RDO-1
[Sound of beginning of second series of Kedzie outer marker beacon tones]
20.26:20.02
RDO-1
[End of sound of second series of Kedzie outer marker beacon tones]
20.26:24.66
CAM-1
Final descent check
20.26:25.66
CAM-3
Flight and nav
20.26:27.11
CAM-2
Cross-checked
CAM-?
* * *
CAM
[Sound of clicks - similar to sound of stabilizer trim actuation]
20.26:30.62
RDO-2
United five five three, an, ah Kedzie inbound
20.26:35.97
CAM-?
Flight
20.26:36.38
MTWR
United five five three, continue inbound, you're number two on the approach --'ll keep you advised.
20.26:40.10
CAM
[Sound of several clicks - similar to sound of electrical stabilizer trim actuation]
20.26:40.47
RDO-2
Okay
20.26:40.96
CAM-2
Cross-checked
CAM-3
With a glideslope flag
CAM-2
No glideslope
20.26:41.10
9VS
Eh, nine VS has the runway
20.26:43.06
MTWR
Nine VS, runway three one left cleared to land
20.26:44.67
CAM-3
Aaan the --- landing gear
20.26:46.18
9VS
Okay
20.26:48.40
MTWR
Nine VS, do ya have the right runway in sight by any chance?
20.26:50.41
CAM-2
Down, three greens
20.26:51.37
CAM-3
Speed brake?
20.26:51.37
9VS
Affirmative
20.26:52.45
CAM-2
Ah --- armed
20.26:52.6
MTWR
'ud you swing over to that and land? There's a jet about two m-- and disregard that, ah, okay, I see ya now, you'r cleared to land on thirty-one left
20.26:54.69
CAM
[Sound of click - similar to sound made by moving speed brake lever to armed position]
20.26:56.04
CAM-3
Wing flaps
20.26:58.75
CAM
[Sound of click - similar to sound made by flap lever moving into detent]
20.26:59.42
CAM-2
Thirty, green light, pressure fluid.
20.27:01.48
CAM-3
An the auto-pilot?
CAM
[Sound of click - similar to electrical stabilizer trim actuation]
20.27:02.96
CAM-2
Disarmed
20.27:04.11
CAM-2
Ah thousand feet
20.27:04.50
MTWR
United five fifty-three, execute a missed approach, make a left turn to a heading of --- one eight zero, climb to two thousand [between words 'of' and 'one' there is a pause and a voice in the background says 'one eighty']
20.27:05.74
CAM
[Sound of stickshaker begins and continues to end of recording]
20.27:07.56
CAM-?
[Two to three hurried word at very low amplitude and masked by noise of stickshaker]
CAM
[Sound of click - similar to sound made by flap lever moving into detent]
20.27:12.14
RDO-2
Okay, left turn to one eight zero, --- left turn okay?
20.27:13.88
CAM-3
Want more flaps?
20.27:15.33
CAM-?
Flaps fifteen.
20.27:15.45
MTWR
Yeah, make left turn to one eighty.
20.27:16.14
CAM-?
I'm sorry.
20.27:16.47
CAM
[Sound of click - similar to sound made by flap lever moving into detent]
20.27:19.4
CAM
[Sound of click - similar to sound made by landing gear lever moved out of detent]
20.27:20.14
CAM
[Sound of double click - similar to sound made by landing gear lever moved into up detent]
20.27:10.64
CAM
[Sound of landing gear warning horn begins and continues to end of recording]
20.27:23.55
CAM
[Sound of initial impact and garbled voice]
20.27:24.46
RDO-1
[Sounds of impact and unintelligible voice]
20.27:25.02
RDO-1
end of recording.
Narrative:The aircraft, named "City of Lincoln", took off from Washington-National Airport for flight UA553 to Chicago and Omaha. Departure time was 12:50 CST. Chicago ARTCC cleared the crew to descend to 4000 feet and the flight was given vectors for a Midway Airport Runway 31L localizer course. At 14:19 the flight was transferred to Chicago Approach Control which later requested UA553 to slow down to 180 knots and later down to 160 knots. After issuing a descent clearance down to 2000 feet at 14:23 the controller requested the flight to slow down to approach speed because of separation between UA553 and a preceding Aero Commander. At 14:24 the Aero Commander passed the Outer Marker and was cleared to land on Runway 31L. Two minutes later UA553 passed the Outer Marker inbound. Then, at 14:27:04 the air traffic controller decided to issue a missed approach clearance: "United 553 execute a missed approach make a left turn to a heading of 180 climb to 2000". At the same time, having just reached 1000 feet, the stick shaker suddenly activated. Full power was applied and the gear was retracted in an attempt to execute a missed approach. The Boeing continued to descend however, attaining a high nose up attitude (of at least 30deg, according to some survivors). The aircraft then clipped a tree and impacted trees, houses, utility pole cables and garages before coming to rest. Post crash fire destroyed part of the fuselage. PROBABLE CAUSE: "The captain's failure to exercise positive flight management during the execution of a non-precision approach, which culminated in a critical deterioration of airspeed into the stall regime where level flight could no longer be maintained."
Flight 553
Chicagoan Lawrence O'Connor, who had used United Airlines Flight
553 or its equivalent to fly from Washington to Chicago on Friday
nights for years was warned by a White House source not to take
this flight; among those killed in the crash at Midway Airport,
Chicago, were: Dorothy Hunt who was carrying $50,000 in Watergate
payoff money and close to $2 million she was attempting to place
in foreign banks; Michele Clark, CBS newswoman who was to
interview Mrs. Hunt on a story that could allegedly destroy Nixon;
at least four people alleged to have knowledge of a large labor
union "donation" to the Committee to ReElect the President
(CREEP), paid to stop the indictment of a Chicago labor hoodlum;
and a group of gas pipeline lobbyists, attorneys and gas company
officials (Robert Moreau, Nancy Parker, Ralph Blodgett, James
Drueger, Lon Bayer, Wilbur Erickson) who had allegedly gathered
evidence against former Attorney General John Mitchell in an anti-
trust case involving El Paso Natural Gas Co.; also aboard was a
"hit-man" using the cover of Harold Metcalf, of Drug Abuse Law
Enforcement, who told the pilot, Captain Whitehouse, he was
carrying a gun and was assigned a jump seat near the food galley
and rear door; Captain Whitehouse and six of the Watergate-related
passengers were found to have unexplainably high cyanide content
after the crash, though the other 35 passengers killed did not;
following the crash hit-man Metcalf, in a jump suit, walked out
the cracked open fuselage; up to 200 FBI and CIA agents allegedly
took over the crash site immediately, beating the fire department
to the scene, refusing to allow in a medical team, confiscating
Control Tower tapes, interviewing survivors and witnesses before
National Transportation Safety Board (NTSB) investigators had a
chance to; CBS News requested immediate cremation of Michele
Clark's body; evidence of sabotage includes possible tampering
with altimeter and air data computer, malfunctioning of the runway
visual range recorder and the Kedzie localizer which acted as the
runway's outer marker, a series of misdirections from air traffic
controllers and the failure of Flight 553's standby power system;
an in-flight robbery gang known as the Joseph Sarelli mob
allegedly came into possession of some of the Hunt money and
Mitchell documents soon after the crash and reportedly fenced it
for $5 million; the day after the crash Nixon aide Egil Krogh,
Jr., of Ellsberg burglary fame, appointed Undersecretary of
Transportation and placed in charge of the two agencies
investigating the crash (NTSB and FAA); ten days later Nixon
assistant Alexander Butterfield, a CIA-aviation liaison, appointed
head of Federal Aviation Administration; a few weeks later Nixon
aide Dwight Chapin becomes top executive with United Airlines.
1973 -- Assassinations of US diplomats Cleo A. Nobel, Jr., and
George C. Moore and Belgian diplomat Guy Eid by Palestinian
guerrillas in Khartoum; Richard Sharples of Bermuda, Mohammad
Ali Osman of Yemen, Salvador Allende Gossens of Chile, Luis
Carrero Blanco of Spain and Dr. Marcus Foster in Oakland,
California; assassination of an American Army officer by
insurgent group in Iran. Senator Stennis shot in Washington,
D.C. Bilderberger meeting in Saltsjobaden, Sweden. Trilateral
Commission founded under the direction of David Rockefeller,
with Jimmy Carter and Walter Mondale among the founding members.
Agnew resigns. Sidney Gottlieb, head of CIA's LSD and other drug
programs, destroys records to hide details of program. Kissinger
and his deputy General Scowcroft order a series of CIA spying
operations in Micronesia. Hunt beaten in his cell before
testifying about the Bremer connection. Durham becomes FBI
agent, infiltrates American Indian Movement (AIM), becomes chief
of security. Liberation of Wounded Knee, South Dakota, by AIM.
Blue Dove becomes an FBI agent. DeFreeze escapes from Soledad;
Wheeler escapes from Vacaville. "Race war" in Bay area
culminates in the killing of Dr. Foster which the SLA claims
credit for in its first communique. Experiments with implanting
electrodes in the brain carried out at Vacaville and elsewhere.
Behavior mod unit started at El Reno, Oklahoma, prison; START-
type program introduced to Maryland public schools by Behavior
Research Institute. Sixth UFO flap year.
Flight 553 Revisited
Alex Botto, Jr., who had infiltrated the Joseph Sarelli air piracy
gang for the Citizen's Committee to Clean Up the Courts (CCCUC),
seized by federal marshals, taken to the federal prison hospital
at Springfield, Missouri, and held for 40 days without hearing or
trial; Botto and another CCCUC agent, Joseph Zale, testified to
seeing evidence from the sabotaged United Airlines Flight 553 in
the Sarelli mob's possessions and turned over evidence on this and
an earlier crash robbery to Nixon's Strike Force in Chicago; just
before the reopening of the case Zale was indicted in an alleged
frameup by federal agencies; CCCUC chairman Sherman Skolnich
revealed at the 553 hearings that his group had stolen the entire
government file, 1300 pages of documentation, and was presenting
it as evidence of foul play in the Midway Airport crash.
CAM - Cockpit area microphone
RDO - Radio transmission from accident aircraft
-1 - Voice identified as Captain
-2 - Voice identified as First Officer
-3 - Voice identified as Second officer
-? - Unidentifiable voiceCHI APP = Chicago ApproachMTWR = Chicago-Midway Tower*
- Unintelligible word#
- Expletive deleted()
- Questionable text9VS = Aero Commander 690, N309VS pilot
all times are in GMT
20.25:25.0
CHI APC
Five five three, call the tower on one eighteen seven
20.25:28.0
RDO-2
Eighteen seven, five five three
20.25:35.5
RDO-2
Midway tower, United five five three, an' we'r out of three for two
20.25:39.0
MTWR
United five five three, report passing the outer marker, number two on the approach
20.25:41.0
CAM-3
Chicago, this is five five three (2nd officer calling ARINC)
20.25:44.0
RDO-2
Okay, report the outer marker
20.25:46.5
CAM-1
Let's have the gear down please
20.25:48.0
RDO-1
[Start of first sound of first series off Kedzie outer marker beacon tones]
20.25:50.97
CAM-3
Chicago, five five three (2nd officer calling ARINC)
20.25:51.62
CAM
[Sound of a click - sound similar to sound of landing gear handle going into down detent]
CAM
[Sound of chime - simultaneous with click above]
20.25:52.20
MTWR
Nine Victor Sugar, what's your airspeed?
20.25:54.5
[End sound of first series of Kedzie outer marker beacon tones]
20.25:54.74
9VS
Ah, we're down to ah, hundred twenty knots
20.25:55.06
CAM
[Increase in ambient noise level - similar to increase made by nose landing gear extended]
20.25:56.82
MTWR
Ah hundred and twenty, okay
20.26:00.64
CAM
[Sound of first of four clicks in rapid increase - sounds similar to flap lever moved from 15 degrees to 25 degrees position]
20.26:01.50
CAM-?
Gear 'own
CAM
[Sound of several clicks - similar to sound of stabilizer trim actuation]
20.26:10.02
RDO-1
[Sound of beginning of second series of Kedzie outer marker beacon tones]
20.26:20.02
RDO-1
[End of sound of second series of Kedzie outer marker beacon tones]
20.26:24.66
CAM-1
Final descent check
20.26:25.66
CAM-3
Flight and nav
20.26:27.11
CAM-2
Cross-checked
CAM-?
* * *
CAM
[Sound of clicks - similar to sound of stabilizer trim actuation]
20.26:30.62
RDO-2
United five five three, an, ah Kedzie inbound
20.26:35.97
CAM-?
Flight
20.26:36.38
MTWR
United five five three, continue inbound, you're number two on the approach --'ll keep you advised.
20.26:40.10
CAM
[Sound of several clicks - similar to sound of electrical stabilizer trim actuation]
20.26:40.47
RDO-2
Okay
20.26:40.96
CAM-2
Cross-checked
CAM-3
With a glideslope flag
CAM-2
No glideslope
20.26:41.10
9VS
Eh, nine VS has the runway
20.26:43.06
MTWR
Nine VS, runway three one left cleared to land
20.26:44.67
CAM-3
Aaan the --- landing gear
20.26:46.18
9VS
Okay
20.26:48.40
MTWR
Nine VS, do ya have the right runway in sight by any chance?
20.26:50.41
CAM-2
Down, three greens
20.26:51.37
CAM-3
Speed brake?
20.26:51.37
9VS
Affirmative
20.26:52.45
CAM-2
Ah --- armed
20.26:52.6
MTWR
'ud you swing over to that and land? There's a jet about two m-- and disregard that, ah, okay, I see ya now, you'r cleared to land on thirty-one left
20.26:54.69
CAM
[Sound of click - similar to sound made by moving speed brake lever to armed position]
20.26:56.04
CAM-3
Wing flaps
20.26:58.75
CAM
[Sound of click - similar to sound made by flap lever moving into detent]
20.26:59.42
CAM-2
Thirty, green light, pressure fluid.
20.27:01.48
CAM-3
An the auto-pilot?
CAM
[Sound of click - similar to electrical stabilizer trim actuation]
20.27:02.96
CAM-2
Disarmed
20.27:04.11
CAM-2
Ah thousand feet
20.27:04.50
MTWR
United five fifty-three, execute a missed approach, make a left turn to a heading of --- one eight zero, climb to two thousand [between words 'of' and 'one' there is a pause and a voice in the background says 'one eighty']
20.27:05.74
CAM
[Sound of stickshaker begins and continues to end of recording]
20.27:07.56
CAM-?
[Two to three hurried word at very low amplitude and masked by noise of stickshaker]
CAM
[Sound of click - similar to sound made by flap lever moving into detent]
20.27:12.14
RDO-2
Okay, left turn to one eight zero, --- left turn okay?
20.27:13.88
CAM-3
Want more flaps?
20.27:15.33
CAM-?
Flaps fifteen.
20.27:15.45
MTWR
Yeah, make left turn to one eighty.
20.27:16.14
CAM-?
I'm sorry.
20.27:16.47
CAM
[Sound of click - similar to sound made by flap lever moving into detent]
20.27:19.4
CAM
[Sound of click - similar to sound made by landing gear lever moved out of detent]
20.27:20.14
CAM
[Sound of double click - similar to sound made by landing gear lever moved into up detent]
20.27:10.64
CAM
[Sound of landing gear warning horn begins and continues to end of recording]
20.27:23.55
CAM
[Sound of initial impact and garbled voice]
20.27:24.46
RDO-1
[Sounds of impact and unintelligible voice]
20.27:25.02
RDO-1
end of recording.
Narrative:The aircraft, named "City of Lincoln", took off from Washington-National Airport for flight UA553 to Chicago and Omaha. Departure time was 12:50 CST. Chicago ARTCC cleared the crew to descend to 4000 feet and the flight was given vectors for a Midway Airport Runway 31L localizer course. At 14:19 the flight was transferred to Chicago Approach Control which later requested UA553 to slow down to 180 knots and later down to 160 knots. After issuing a descent clearance down to 2000 feet at 14:23 the controller requested the flight to slow down to approach speed because of separation between UA553 and a preceding Aero Commander. At 14:24 the Aero Commander passed the Outer Marker and was cleared to land on Runway 31L. Two minutes later UA553 passed the Outer Marker inbound. Then, at 14:27:04 the air traffic controller decided to issue a missed approach clearance: "United 553 execute a missed approach make a left turn to a heading of 180 climb to 2000". At the same time, having just reached 1000 feet, the stick shaker suddenly activated. Full power was applied and the gear was retracted in an attempt to execute a missed approach. The Boeing continued to descend however, attaining a high nose up attitude (of at least 30deg, according to some survivors). The aircraft then clipped a tree and impacted trees, houses, utility pole cables and garages before coming to rest. Post crash fire destroyed part of the fuselage. PROBABLE CAUSE: "The captain's failure to exercise positive flight management during the execution of a non-precision approach, which culminated in a critical deterioration of airspeed into the stall regime where level flight could no longer be maintained."
Flight 553
Chicagoan Lawrence O'Connor, who had used United Airlines Flight
553 or its equivalent to fly from Washington to Chicago on Friday
nights for years was warned by a White House source not to take
this flight; among those killed in the crash at Midway Airport,
Chicago, were: Dorothy Hunt who was carrying $50,000 in Watergate
payoff money and close to $2 million she was attempting to place
in foreign banks; Michele Clark, CBS newswoman who was to
interview Mrs. Hunt on a story that could allegedly destroy Nixon;
at least four people alleged to have knowledge of a large labor
union "donation" to the Committee to ReElect the President
(CREEP), paid to stop the indictment of a Chicago labor hoodlum;
and a group of gas pipeline lobbyists, attorneys and gas company
officials (Robert Moreau, Nancy Parker, Ralph Blodgett, James
Drueger, Lon Bayer, Wilbur Erickson) who had allegedly gathered
evidence against former Attorney General John Mitchell in an anti-
trust case involving El Paso Natural Gas Co.; also aboard was a
"hit-man" using the cover of Harold Metcalf, of Drug Abuse Law
Enforcement, who told the pilot, Captain Whitehouse, he was
carrying a gun and was assigned a jump seat near the food galley
and rear door; Captain Whitehouse and six of the Watergate-related
passengers were found to have unexplainably high cyanide content
after the crash, though the other 35 passengers killed did not;
following the crash hit-man Metcalf, in a jump suit, walked out
the cracked open fuselage; up to 200 FBI and CIA agents allegedly
took over the crash site immediately, beating the fire department
to the scene, refusing to allow in a medical team, confiscating
Control Tower tapes, interviewing survivors and witnesses before
National Transportation Safety Board (NTSB) investigators had a
chance to; CBS News requested immediate cremation of Michele
Clark's body; evidence of sabotage includes possible tampering
with altimeter and air data computer, malfunctioning of the runway
visual range recorder and the Kedzie localizer which acted as the
runway's outer marker, a series of misdirections from air traffic
controllers and the failure of Flight 553's standby power system;
an in-flight robbery gang known as the Joseph Sarelli mob
allegedly came into possession of some of the Hunt money and
Mitchell documents soon after the crash and reportedly fenced it
for $5 million; the day after the crash Nixon aide Egil Krogh,
Jr., of Ellsberg burglary fame, appointed Undersecretary of
Transportation and placed in charge of the two agencies
investigating the crash (NTSB and FAA); ten days later Nixon
assistant Alexander Butterfield, a CIA-aviation liaison, appointed
head of Federal Aviation Administration; a few weeks later Nixon
aide Dwight Chapin becomes top executive with United Airlines.
1973 -- Assassinations of US diplomats Cleo A. Nobel, Jr., and
George C. Moore and Belgian diplomat Guy Eid by Palestinian
guerrillas in Khartoum; Richard Sharples of Bermuda, Mohammad
Ali Osman of Yemen, Salvador Allende Gossens of Chile, Luis
Carrero Blanco of Spain and Dr. Marcus Foster in Oakland,
California; assassination of an American Army officer by
insurgent group in Iran. Senator Stennis shot in Washington,
D.C. Bilderberger meeting in Saltsjobaden, Sweden. Trilateral
Commission founded under the direction of David Rockefeller,
with Jimmy Carter and Walter Mondale among the founding members.
Agnew resigns. Sidney Gottlieb, head of CIA's LSD and other drug
programs, destroys records to hide details of program. Kissinger
and his deputy General Scowcroft order a series of CIA spying
operations in Micronesia. Hunt beaten in his cell before
testifying about the Bremer connection. Durham becomes FBI
agent, infiltrates American Indian Movement (AIM), becomes chief
of security. Liberation of Wounded Knee, South Dakota, by AIM.
Blue Dove becomes an FBI agent. DeFreeze escapes from Soledad;
Wheeler escapes from Vacaville. "Race war" in Bay area
culminates in the killing of Dr. Foster which the SLA claims
credit for in its first communique. Experiments with implanting
electrodes in the brain carried out at Vacaville and elsewhere.
Behavior mod unit started at El Reno, Oklahoma, prison; START-
type program introduced to Maryland public schools by Behavior
Research Institute. Sixth UFO flap year.
Flight 553 Revisited
Alex Botto, Jr., who had infiltrated the Joseph Sarelli air piracy
gang for the Citizen's Committee to Clean Up the Courts (CCCUC),
seized by federal marshals, taken to the federal prison hospital
at Springfield, Missouri, and held for 40 days without hearing or
trial; Botto and another CCCUC agent, Joseph Zale, testified to
seeing evidence from the sabotaged United Airlines Flight 553 in
the Sarelli mob's possessions and turned over evidence on this and
an earlier crash robbery to Nixon's Strike Force in Chicago; just
before the reopening of the case Zale was indicted in an alleged
frameup by federal agencies; CCCUC chairman Sherman Skolnich
revealed at the 553 hearings that his group had stolen the entire
government file, 1300 pages of documentation, and was presenting
it as evidence of foul play in the Midway Airport crash.
Tuesday, February 1, 2011
Monday, January 31, 2011
Thursday, January 20, 2011
the Secure Shell Transport Layer Protocol
Network Working Group K. Igoe
Request for Comments: 5647 J. Solinas
Category: Informational National Security Agency
August 2009
AES Galois Counter Mode for
the Secure Shell Transport Layer Protocol
Abstract
Secure shell (SSH) is a secure remote-login protocol. SSH provides
for algorithms that provide authentication, key agreement,
confidentiality, and data-integrity services. The purpose of this
document is to show how the AES Galois Counter Mode can be used to
provide both confidentiality and data integrity to the SSH Transport
Layer Protocol.
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Igoe & Solinas Informational [Page 1]
RFC 5647 AES-GCM for Secure Shell August 2009
Table of Contents
1. Introduction ....................................................2
2. Requirements Terminology ........................................2
3. Applicability Statement .........................................3
4. Properties of Galois Counter Mode ...............................3
4.1. AES GCM Authenticated Encryption ...........................3
4.2. AES GCM Authenticated Decryption ...........................3
5. Review of Secure Shell ..........................................4
5.1. Key Exchange ...............................................4
5.2. Secure Shell Binary Packets ................................5
6. AES GCM Algorithms for Secure Shell .............................6
6.1. AEAD_AES_128_GCM ...........................................6
6.2. AEAD_AES_256_GCM ...........................................6
6.3. Size of the Authentication Tag .............................6
7. Processing Binary Packets in AES-GCM Secure Shell ...............7
7.1. IV and Counter Management ..................................7
7.2. Formation of the Binary Packet .............................7
7.3. Treatment of the Packet Length Field .......................8
8. Security Considerations .........................................8
8.1. Use of the Packet Sequence Number in the AT ................8
8.2. Non-Encryption of Packet Length ............................8
9. IANA Considerations .............................................9
10. References ....................................................10
10.1. Normative References .....................................10
1. Introduction
Galois Counter Mode (GCM) is a block-cipher mode of operation that
provides both confidentiality and data-integrity services. GCM uses
counter mode to encrypt the data, an operation that can be
efficiently pipelined. Further, GCM authentication uses operations
that are particularly well suited to efficient implementation in
hardware, making it especially appealing for high-speed
implementations or for implementations in an efficient and compact
circuit. The purpose of this document is to show how GCM with either
AES-128 or AES-256 can be integrated into the Secure Shell Transport
Layer Protocol [RFC4253].
2. Requirements Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
Igoe & Solinas Informational [Page 2]
RFC 5647 AES-GCM for Secure Shell August 2009
3. Applicability Statement
Using AES-GCM to provide both confidentiality and data integrity is
generally more efficient than using two separate algorithms to
provide these security services.
4. Properties of Galois Counter Mode
Galois Counter Mode (GCM) is a mode of operation for block ciphers
that provides both confidentiality and data integrity. National
Institute of Standards and Technology (NIST) Special Publication SP
800 38D [GCM] gives an excellent explanation of Galois Counter Mode.
In this document, we shall focus on AES GCM, the use of the Advanced
Encryption Algorithm (AES) in Galois Counter Mode. AES-GCM is an
example of an "algorithm for authenticated encryption with associated
data" (AEAD algorithm) as described in [RFC5116].
4.1. AES GCM Authenticated Encryption
An invocation of AES GCM to perform an authenticated encryption has
the following inputs and outputs:
GCM Authenticated Encryption
Inputs:
octet_string PT ; // Plain Text, to be both
// authenticated and encrypted
octet_string AAD; // Additional Authenticated Data,
// authenticated but not encrypted
octet_string IV; // Initialization Vector
octet_string BK; // Block Cipher Key
Outputs:
octet_string CT; // Cipher Text
octet_string AT; // Authentication Tag
Note: in [RFC5116], the IV is called the nonce.
For a given block-cipher key BK, it is critical that no IV be used
more than once. Section 7.1 addresses how this goal is to be
achieved in secure shell.
4.2. AES GCM Authenticated Decryption
An invocation of AES GCM to perform an authenticated decryption has
the following inputs and outputs:
Igoe & Solinas Informational [Page 3]
RFC 5647 AES-GCM for Secure Shell August 2009
GCM Authenticated Decryption
Inputs:
octet_string CT ; // Cipher text, to be both
// authenticated and decrypted
octet_string AAD; // Additional Authenticated Data,
// authenticated only
octet_string AT; // Authentication Tag
octet_string IV; // Initialization Vector
octet_string BK; // Block Cipher Key
Output:
Failure_Indicator; // Returned if the authentication tag
// is invalid
octet_string PT; // Plain Text, returned if and only if
// the authentication tag is valid
AES-GCM is prohibited from returning any portion of the plaintext
until the authentication tag has been validated. Though this feature
greatly simplifies the security analysis of any system using AES-GCM,
this creates an incompatibility with the requirements of secure
shell, as we shall see in Section 7.3.
5. Review of Secure Shell
The goal of secure shell is to establish two secure tunnels between a
client and a server, one tunnel carrying client-to-server
communications and the other carrying server-to-client
communications. Each tunnel is encrypted, and a message
authentication code is used to ensure data integrity.
5.1. Key Exchange
These tunnels are initialized using the secure shell key exchange
protocol as described in Section 7 of [RFC4253]. This protocol
negotiates a mutually acceptable set of cryptographic algorithms and
produces a secret value K and an exchange hash H that are shared by
the client and server. The initial value of H is saved for use as
the session_id.
If AES-GCM is selected as the encryption algorithm for a given
tunnel, AES-GCM MUST also be selected as the Message Authentication
Code (MAC) algorithm. Conversely, if AES-GCM is selected as the MAC
algorithm, it MUST also be selected as the encryption algorithm.
As described in Section 7.2 of [RFC4253], a hash-based key derivation
function (KDF) is applied to the shared secret value K to generate
the required symmetric keys. Each tunnel gets a distinct set of
Igoe & Solinas Informational [Page 4]
RFC 5647 AES-GCM for Secure Shell August 2009
symmetric keys. The keys are generated as shown in Figure 1. The
sizes of these keys varies depending upon which cryptographic
algorithms are being used.
Initial IV
Client-to-Server HASH( K || H ||"A"|| session_id)
Server-to-Client HASH( K || H ||"B"|| session_id)
Encryption Key
Client-to-Server HASH( K || H ||"C"|| session_id)
Server-to-Client HASH( K || H ||"D"|| session_id)
Integrity Key
Client-to-Server HASH( K || H ||"E"|| session_id)
Server-to-Client HASH( K || H ||"F"|| session_id)
Figure 1: Key Derivation in Secure Shell
As we shall see below, SSH AES-GCM requires a 12-octet Initial IV and
an encryption key of either 16 or 32 octets. Because an AEAD
algorithm such as AES-GCM uses the encryption key to provide both
confidentiality and data integrity, the integrity key is not used
with AES-GCM.
Either the server or client may at any time request that the secure
shell session be rekeyed. The shared secret value K, the exchange
hash H, and all the above symmetric keys will be updated. Only the
session_id will remain unchanged.
5.2. Secure Shell Binary Packets
Upon completion of the key exchange protocol, all further secure
shell traffic is parsed into a data structure known as a secure shell
binary packet as shown below in Figure 2 (see also Section 6 of
[RFC4253]).
uint32 packet_length; // 0 <= packet_length < 2^32
byte padding_length; // 4 <= padding_length < 256
byte[n1] payload; // n1 = packet_length-padding_length-1
byte[n2] random_padding; // n2 = padding_length
byte[m] mac; // m = mac_length
Figure 2: Structure of a Secure Shell Binary Packet
The authentication tag produced by AES-GCM authenticated encryption
will be placed in the MAC field at the end of the secure shell binary
packet.
Igoe & Solinas Informational [Page 5]
RFC 5647 AES-GCM for Secure Shell August 2009
6. AES GCM Algorithms for Secure Shell
6.1. AEAD_AES_128_GCM
AEAD_AES_128_GCM is specified in Section 5.1 of [RFC5116]. Due to
the format of secure shell binary packets, the buffer sizes needed to
implement AEAD_AES_128_GCM are smaller than those required in
[RFC5116]. Using the notation defined in [RFC5116], the input and
output lengths for AEAD_AES_128_GCM in secure shell are as follows:
PARAMETER Meaning Value
K_LEN AES key length 16 octets
P_MAX maximum plaintext length 2^32 - 32 octets
A_MAX maximum additional 4 octets
authenticated data length
N_MIN minimum nonce (IV) length 12 octets
N_MAX maximum nonce (IV) length 12 octets
C_MAX maximum cipher length 2^32 octets
6.2. AEAD_AES_256_GCM
AEAD_AES_256_GCM is specified in Section 5.2 of [RFC5116]. Due to
the format of secure shell binary packets, the buffer sizes needed
to implement AEAD_AES_256_GCM are smaller than those required in
[RFC5116]. Using the notation defined in [RFC5116], the input and
output lengths for AEAD_AES_256_GCM in secure shell are as follows:
PARAMETER Meaning Value
K_LEN AES key length 32 octets
P_MAX maximum plaintext length 2^32 - 32 octets
A_MAX maximum additional 4 octets
authenticated data length
N_MIN minimum nonce (IV) length 12 octets
N_MAX maximum nonce (IV) length 12 octets
C_MAX maximum cipher length 2^32 octets
6.3. Size of the Authentication Tag
Both AEAD_AES_128_GCM and AEAD_AES_256_GCM produce a 16-octet
Authentication Tag ([RFC5116] calls this a "Message Authentication
Code"). Some applications allow use of a truncated version of this
tag. This is not allowed in AES-GCM secure shell. All
implementations of AES-GCM secure shell MUST use the full 16-octet
Authentication Tag.
Igoe & Solinas Informational [Page 6]
RFC 5647 AES-GCM for Secure Shell August 2009
7. Processing Binary Packets in AES-GCM Secure Shell
7.1. IV and Counter Management
With AES-GCM, the 12-octet IV is broken into two fields: a 4-octet
fixed field and an 8-octet invocation counter field. The invocation
field is treated as a 64-bit integer and is incremented after each
invocation of AES-GCM to process a binary packet.
uint32 fixed; // 4 octets
uint64 invocation_counter; // 8 octets
Figure 3: Structure of an SSH AES-GCM Nonce
AES-GCM produces a keystream in blocks of 16-octets that is used to
encrypt the plaintext. This keystream is produced by encrypting the
following 16-octet data structure:
uint32 fixed; // 4 octets
uint64 invocation_counter; // 8 octets
uint32 block_counter; // 4 octets
Figure 4: Structure of an AES Input for SSH AES-GCM
The block_counter is initially set to one (1) and incremented as each
block of key is produced.
The reader is reminded that SSH requires that the data to be
encrypted MUST be padded out to a multiple of the block size
(16-octets for AES-GCM).
7.2. Formation of the Binary Packet
In AES-GCM secure shell, the inputs to the authenticated encryption
are:
PT (Plain Text)
byte padding_length; // 4 <= padding_length < 256
byte[n1] payload; // n1 = packet_length-padding_length-1
byte[n2] random_padding; // n2 = padding_length
AAD (Additional Authenticated Data)
uint32 packet_length; // 0 <= packet_length < 2^32
IV (Initialization Vector)
As described in section 7.1.
BK (Block Cipher Key)
The appropriate Encryption Key formed during the Key Exchange.
Igoe & Solinas Informational [Page 7]
RFC 5647 AES-GCM for Secure Shell August 2009
As required in [RFC4253], the random_padding MUST be at least 4
octets in length but no more than 255 octets. The total length of
the PT MUST be a multiple of 16 octets (the block size of AES). The
binary packet is the concatenation of the 4-octet packet_length, the
cipher text (CT), and the 16-octet authentication tag (AT).
7.3. Treatment of the Packet Length Field
Section 6.3 of [RFC4253] requires that the packet length, padding
length, payload, and padding fields of each binary packet be
encrypted. This presents a problem for SSH AES-GCM because:
1) The tag cannot be verified until we parse the binary packet.
2) The packet cannot be parsed until the packet_length has been
decrypted.
3) The packet_length cannot be decrypted until the tag has been
verified.
When using AES-GCM with secure shell, the packet_length field is to
be treated as additional authenticated data, not as plaintext. This
violates the requirements of [RFC4253]. The repercussions of this
decision are discussed in the following Security Considerations
section.
8. Security Considerations
The security considerations in [RFC4251] apply.
8.1. Use of the Packet Sequence Number in the AT
[RFC4253] requires that the formation of the AT involve the packet
sequence_number, a 32-bit value that counts the number of binary
packets that have been sent on a given SSH tunnel. Since the
sequence_number is, up to an additive constant, just the low 32 bits
of the invocation_counter, the presence of the invocation_counter
field in the IV ensures that the sequence_number is indeed involved
in the formation of the integrity tag, though this involvement
differs slightly from the requirements in Section 6.4 of [RFC4253].
8.2. Non-Encryption of Packet Length
As discussed in Section 7.3, there is an incompatibility between
GCM's requirement that no plaintext be returned until the
authentication tag has been verified, secure shell's requirement that
the packet length be encrypted, and the necessity of decrypting the
packet length field to locate the authentication tag. This document
Igoe & Solinas Informational [Page 8]
RFC 5647 AES-GCM for Secure Shell August 2009
addresses this dilemma by requiring that, in AES-GCM, the packet
length field will not be encrypted but will instead be processed as
additional authenticated data.
In theory, one could argue that encryption of the entire binary
packet means that the secure shell dataflow becomes a featureless
octet stream. But in practice, the secure shell dataflow will come
in bursts, with the length of each burst strongly correlated to the
length of the underlying binary packets. Encryption of the packet
length does little in and of itself to disguise the length of the
underlying binary packets. Secure shell provides two other
mechanisms, random padding and SSH_MSG_IGNORE messages, that are far
more effective than encrypting the packet length in masking any
structure in the underlying plaintext stream that might be revealed
by the length of the binary packets.
9. IANA Considerations
IANA added the following two entries to the secure shell Encryption
Algorithm Names registry described in [RFC4250]:
+--------------------+-------------+
| | |
| Name | Reference |
+--------------------+-------------+
| AEAD_AES_128_GCM | Section 6.1 |
| | |
| AEAD_AES_256_GCM | Section 6.2 |
+--------------------+-------------+
IANA added the following two entries to the secure shell MAC
Algorithm Names registry described in [RFC4250]:
+--------------------+-------------+
| | |
| Name | Reference |
+--------------------+-------------+
| AEAD_AES_128_GCM | Section 6.1 |
| | |
| AEAD_AES_256_GCM | Section 6.2 |
+--------------------+-------------+
Igoe & Solinas Informational [Page 9]
RFC 5647 AES-GCM for Secure Shell August 2009
10. References
10.1. Normative References
[GCM] Dworkin, M, "Recommendation for Block Cipher Modes of
Operation: Galois/Counter Mode (GCM) and GMAC", NIST
Special Publication 800-30D, November 2007.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4250] Lehtinen, S. and C. Lonvick, Ed., "The Secure Shell (SSH)
Protocol Assigned Numbers", RFC 4250, January 2006.
[RFC4251] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Protocol Architecture", RFC 4251, January 2006.
[RFC4253] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Transport Layer Protocol", RFC 4253, January 2006.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
Encryption", RFC 5116, January 2008.
Authors' Addresses
Kevin M. Igoe
NSA/CSS Commercial Solutions Center
National Security Agency
USA
EMail: kmigoe@nsa.gov
Jerome A. Solinas
National Information Assurance Research Laboratory
National Security Agency
USA
EMail: jasolin@orion.ncsc.mil
Igoe & Solinas Informational [Page 10]
Html markup produced by rfcmarkup 1.91, available from http://tools.ietf.org/tools/rfcmarkup/
Request for Comments: 5647 J. Solinas
Category: Informational National Security Agency
August 2009
AES Galois Counter Mode for
the Secure Shell Transport Layer Protocol
Abstract
Secure shell (SSH) is a secure remote-login protocol. SSH provides
for algorithms that provide authentication, key agreement,
confidentiality, and data-integrity services. The purpose of this
document is to show how the AES Galois Counter Mode can be used to
provide both confidentiality and data integrity to the SSH Transport
Layer Protocol.
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Igoe & Solinas Informational [Page 1]
RFC 5647 AES-GCM for Secure Shell August 2009
Table of Contents
1. Introduction ....................................................2
2. Requirements Terminology ........................................2
3. Applicability Statement .........................................3
4. Properties of Galois Counter Mode ...............................3
4.1. AES GCM Authenticated Encryption ...........................3
4.2. AES GCM Authenticated Decryption ...........................3
5. Review of Secure Shell ..........................................4
5.1. Key Exchange ...............................................4
5.2. Secure Shell Binary Packets ................................5
6. AES GCM Algorithms for Secure Shell .............................6
6.1. AEAD_AES_128_GCM ...........................................6
6.2. AEAD_AES_256_GCM ...........................................6
6.3. Size of the Authentication Tag .............................6
7. Processing Binary Packets in AES-GCM Secure Shell ...............7
7.1. IV and Counter Management ..................................7
7.2. Formation of the Binary Packet .............................7
7.3. Treatment of the Packet Length Field .......................8
8. Security Considerations .........................................8
8.1. Use of the Packet Sequence Number in the AT ................8
8.2. Non-Encryption of Packet Length ............................8
9. IANA Considerations .............................................9
10. References ....................................................10
10.1. Normative References .....................................10
1. Introduction
Galois Counter Mode (GCM) is a block-cipher mode of operation that
provides both confidentiality and data-integrity services. GCM uses
counter mode to encrypt the data, an operation that can be
efficiently pipelined. Further, GCM authentication uses operations
that are particularly well suited to efficient implementation in
hardware, making it especially appealing for high-speed
implementations or for implementations in an efficient and compact
circuit. The purpose of this document is to show how GCM with either
AES-128 or AES-256 can be integrated into the Secure Shell Transport
Layer Protocol [RFC4253].
2. Requirements Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
Igoe & Solinas Informational [Page 2]
RFC 5647 AES-GCM for Secure Shell August 2009
3. Applicability Statement
Using AES-GCM to provide both confidentiality and data integrity is
generally more efficient than using two separate algorithms to
provide these security services.
4. Properties of Galois Counter Mode
Galois Counter Mode (GCM) is a mode of operation for block ciphers
that provides both confidentiality and data integrity. National
Institute of Standards and Technology (NIST) Special Publication SP
800 38D [GCM] gives an excellent explanation of Galois Counter Mode.
In this document, we shall focus on AES GCM, the use of the Advanced
Encryption Algorithm (AES) in Galois Counter Mode. AES-GCM is an
example of an "algorithm for authenticated encryption with associated
data" (AEAD algorithm) as described in [RFC5116].
4.1. AES GCM Authenticated Encryption
An invocation of AES GCM to perform an authenticated encryption has
the following inputs and outputs:
GCM Authenticated Encryption
Inputs:
octet_string PT ; // Plain Text, to be both
// authenticated and encrypted
octet_string AAD; // Additional Authenticated Data,
// authenticated but not encrypted
octet_string IV; // Initialization Vector
octet_string BK; // Block Cipher Key
Outputs:
octet_string CT; // Cipher Text
octet_string AT; // Authentication Tag
Note: in [RFC5116], the IV is called the nonce.
For a given block-cipher key BK, it is critical that no IV be used
more than once. Section 7.1 addresses how this goal is to be
achieved in secure shell.
4.2. AES GCM Authenticated Decryption
An invocation of AES GCM to perform an authenticated decryption has
the following inputs and outputs:
Igoe & Solinas Informational [Page 3]
RFC 5647 AES-GCM for Secure Shell August 2009
GCM Authenticated Decryption
Inputs:
octet_string CT ; // Cipher text, to be both
// authenticated and decrypted
octet_string AAD; // Additional Authenticated Data,
// authenticated only
octet_string AT; // Authentication Tag
octet_string IV; // Initialization Vector
octet_string BK; // Block Cipher Key
Output:
Failure_Indicator; // Returned if the authentication tag
// is invalid
octet_string PT; // Plain Text, returned if and only if
// the authentication tag is valid
AES-GCM is prohibited from returning any portion of the plaintext
until the authentication tag has been validated. Though this feature
greatly simplifies the security analysis of any system using AES-GCM,
this creates an incompatibility with the requirements of secure
shell, as we shall see in Section 7.3.
5. Review of Secure Shell
The goal of secure shell is to establish two secure tunnels between a
client and a server, one tunnel carrying client-to-server
communications and the other carrying server-to-client
communications. Each tunnel is encrypted, and a message
authentication code is used to ensure data integrity.
5.1. Key Exchange
These tunnels are initialized using the secure shell key exchange
protocol as described in Section 7 of [RFC4253]. This protocol
negotiates a mutually acceptable set of cryptographic algorithms and
produces a secret value K and an exchange hash H that are shared by
the client and server. The initial value of H is saved for use as
the session_id.
If AES-GCM is selected as the encryption algorithm for a given
tunnel, AES-GCM MUST also be selected as the Message Authentication
Code (MAC) algorithm. Conversely, if AES-GCM is selected as the MAC
algorithm, it MUST also be selected as the encryption algorithm.
As described in Section 7.2 of [RFC4253], a hash-based key derivation
function (KDF) is applied to the shared secret value K to generate
the required symmetric keys. Each tunnel gets a distinct set of
Igoe & Solinas Informational [Page 4]
RFC 5647 AES-GCM for Secure Shell August 2009
symmetric keys. The keys are generated as shown in Figure 1. The
sizes of these keys varies depending upon which cryptographic
algorithms are being used.
Initial IV
Client-to-Server HASH( K || H ||"A"|| session_id)
Server-to-Client HASH( K || H ||"B"|| session_id)
Encryption Key
Client-to-Server HASH( K || H ||"C"|| session_id)
Server-to-Client HASH( K || H ||"D"|| session_id)
Integrity Key
Client-to-Server HASH( K || H ||"E"|| session_id)
Server-to-Client HASH( K || H ||"F"|| session_id)
Figure 1: Key Derivation in Secure Shell
As we shall see below, SSH AES-GCM requires a 12-octet Initial IV and
an encryption key of either 16 or 32 octets. Because an AEAD
algorithm such as AES-GCM uses the encryption key to provide both
confidentiality and data integrity, the integrity key is not used
with AES-GCM.
Either the server or client may at any time request that the secure
shell session be rekeyed. The shared secret value K, the exchange
hash H, and all the above symmetric keys will be updated. Only the
session_id will remain unchanged.
5.2. Secure Shell Binary Packets
Upon completion of the key exchange protocol, all further secure
shell traffic is parsed into a data structure known as a secure shell
binary packet as shown below in Figure 2 (see also Section 6 of
[RFC4253]).
uint32 packet_length; // 0 <= packet_length < 2^32
byte padding_length; // 4 <= padding_length < 256
byte[n1] payload; // n1 = packet_length-padding_length-1
byte[n2] random_padding; // n2 = padding_length
byte[m] mac; // m = mac_length
Figure 2: Structure of a Secure Shell Binary Packet
The authentication tag produced by AES-GCM authenticated encryption
will be placed in the MAC field at the end of the secure shell binary
packet.
Igoe & Solinas Informational [Page 5]
RFC 5647 AES-GCM for Secure Shell August 2009
6. AES GCM Algorithms for Secure Shell
6.1. AEAD_AES_128_GCM
AEAD_AES_128_GCM is specified in Section 5.1 of [RFC5116]. Due to
the format of secure shell binary packets, the buffer sizes needed to
implement AEAD_AES_128_GCM are smaller than those required in
[RFC5116]. Using the notation defined in [RFC5116], the input and
output lengths for AEAD_AES_128_GCM in secure shell are as follows:
PARAMETER Meaning Value
K_LEN AES key length 16 octets
P_MAX maximum plaintext length 2^32 - 32 octets
A_MAX maximum additional 4 octets
authenticated data length
N_MIN minimum nonce (IV) length 12 octets
N_MAX maximum nonce (IV) length 12 octets
C_MAX maximum cipher length 2^32 octets
6.2. AEAD_AES_256_GCM
AEAD_AES_256_GCM is specified in Section 5.2 of [RFC5116]. Due to
the format of secure shell binary packets, the buffer sizes needed
to implement AEAD_AES_256_GCM are smaller than those required in
[RFC5116]. Using the notation defined in [RFC5116], the input and
output lengths for AEAD_AES_256_GCM in secure shell are as follows:
PARAMETER Meaning Value
K_LEN AES key length 32 octets
P_MAX maximum plaintext length 2^32 - 32 octets
A_MAX maximum additional 4 octets
authenticated data length
N_MIN minimum nonce (IV) length 12 octets
N_MAX maximum nonce (IV) length 12 octets
C_MAX maximum cipher length 2^32 octets
6.3. Size of the Authentication Tag
Both AEAD_AES_128_GCM and AEAD_AES_256_GCM produce a 16-octet
Authentication Tag ([RFC5116] calls this a "Message Authentication
Code"). Some applications allow use of a truncated version of this
tag. This is not allowed in AES-GCM secure shell. All
implementations of AES-GCM secure shell MUST use the full 16-octet
Authentication Tag.
Igoe & Solinas Informational [Page 6]
RFC 5647 AES-GCM for Secure Shell August 2009
7. Processing Binary Packets in AES-GCM Secure Shell
7.1. IV and Counter Management
With AES-GCM, the 12-octet IV is broken into two fields: a 4-octet
fixed field and an 8-octet invocation counter field. The invocation
field is treated as a 64-bit integer and is incremented after each
invocation of AES-GCM to process a binary packet.
uint32 fixed; // 4 octets
uint64 invocation_counter; // 8 octets
Figure 3: Structure of an SSH AES-GCM Nonce
AES-GCM produces a keystream in blocks of 16-octets that is used to
encrypt the plaintext. This keystream is produced by encrypting the
following 16-octet data structure:
uint32 fixed; // 4 octets
uint64 invocation_counter; // 8 octets
uint32 block_counter; // 4 octets
Figure 4: Structure of an AES Input for SSH AES-GCM
The block_counter is initially set to one (1) and incremented as each
block of key is produced.
The reader is reminded that SSH requires that the data to be
encrypted MUST be padded out to a multiple of the block size
(16-octets for AES-GCM).
7.2. Formation of the Binary Packet
In AES-GCM secure shell, the inputs to the authenticated encryption
are:
PT (Plain Text)
byte padding_length; // 4 <= padding_length < 256
byte[n1] payload; // n1 = packet_length-padding_length-1
byte[n2] random_padding; // n2 = padding_length
AAD (Additional Authenticated Data)
uint32 packet_length; // 0 <= packet_length < 2^32
IV (Initialization Vector)
As described in section 7.1.
BK (Block Cipher Key)
The appropriate Encryption Key formed during the Key Exchange.
Igoe & Solinas Informational [Page 7]
RFC 5647 AES-GCM for Secure Shell August 2009
As required in [RFC4253], the random_padding MUST be at least 4
octets in length but no more than 255 octets. The total length of
the PT MUST be a multiple of 16 octets (the block size of AES). The
binary packet is the concatenation of the 4-octet packet_length, the
cipher text (CT), and the 16-octet authentication tag (AT).
7.3. Treatment of the Packet Length Field
Section 6.3 of [RFC4253] requires that the packet length, padding
length, payload, and padding fields of each binary packet be
encrypted. This presents a problem for SSH AES-GCM because:
1) The tag cannot be verified until we parse the binary packet.
2) The packet cannot be parsed until the packet_length has been
decrypted.
3) The packet_length cannot be decrypted until the tag has been
verified.
When using AES-GCM with secure shell, the packet_length field is to
be treated as additional authenticated data, not as plaintext. This
violates the requirements of [RFC4253]. The repercussions of this
decision are discussed in the following Security Considerations
section.
8. Security Considerations
The security considerations in [RFC4251] apply.
8.1. Use of the Packet Sequence Number in the AT
[RFC4253] requires that the formation of the AT involve the packet
sequence_number, a 32-bit value that counts the number of binary
packets that have been sent on a given SSH tunnel. Since the
sequence_number is, up to an additive constant, just the low 32 bits
of the invocation_counter, the presence of the invocation_counter
field in the IV ensures that the sequence_number is indeed involved
in the formation of the integrity tag, though this involvement
differs slightly from the requirements in Section 6.4 of [RFC4253].
8.2. Non-Encryption of Packet Length
As discussed in Section 7.3, there is an incompatibility between
GCM's requirement that no plaintext be returned until the
authentication tag has been verified, secure shell's requirement that
the packet length be encrypted, and the necessity of decrypting the
packet length field to locate the authentication tag. This document
Igoe & Solinas Informational [Page 8]
RFC 5647 AES-GCM for Secure Shell August 2009
addresses this dilemma by requiring that, in AES-GCM, the packet
length field will not be encrypted but will instead be processed as
additional authenticated data.
In theory, one could argue that encryption of the entire binary
packet means that the secure shell dataflow becomes a featureless
octet stream. But in practice, the secure shell dataflow will come
in bursts, with the length of each burst strongly correlated to the
length of the underlying binary packets. Encryption of the packet
length does little in and of itself to disguise the length of the
underlying binary packets. Secure shell provides two other
mechanisms, random padding and SSH_MSG_IGNORE messages, that are far
more effective than encrypting the packet length in masking any
structure in the underlying plaintext stream that might be revealed
by the length of the binary packets.
9. IANA Considerations
IANA added the following two entries to the secure shell Encryption
Algorithm Names registry described in [RFC4250]:
+--------------------+-------------+
| | |
| Name | Reference |
+--------------------+-------------+
| AEAD_AES_128_GCM | Section 6.1 |
| | |
| AEAD_AES_256_GCM | Section 6.2 |
+--------------------+-------------+
IANA added the following two entries to the secure shell MAC
Algorithm Names registry described in [RFC4250]:
+--------------------+-------------+
| | |
| Name | Reference |
+--------------------+-------------+
| AEAD_AES_128_GCM | Section 6.1 |
| | |
| AEAD_AES_256_GCM | Section 6.2 |
+--------------------+-------------+
Igoe & Solinas Informational [Page 9]
RFC 5647 AES-GCM for Secure Shell August 2009
10. References
10.1. Normative References
[GCM] Dworkin, M, "Recommendation for Block Cipher Modes of
Operation: Galois/Counter Mode (GCM) and GMAC", NIST
Special Publication 800-30D, November 2007.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4250] Lehtinen, S. and C. Lonvick, Ed., "The Secure Shell (SSH)
Protocol Assigned Numbers", RFC 4250, January 2006.
[RFC4251] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Protocol Architecture", RFC 4251, January 2006.
[RFC4253] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Transport Layer Protocol", RFC 4253, January 2006.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
Encryption", RFC 5116, January 2008.
Authors' Addresses
Kevin M. Igoe
NSA/CSS Commercial Solutions Center
National Security Agency
USA
EMail: kmigoe@nsa.gov
Jerome A. Solinas
National Information Assurance Research Laboratory
National Security Agency
USA
EMail: jasolin@orion.ncsc.mil
Igoe & Solinas Informational [Page 10]
Html markup produced by rfcmarkup 1.91, available from http://tools.ietf.org/tools/rfcmarkup/
Suite B in Secure/Multipurpose Internet Mail Extensions (S/MIME)
Network Working Group R. Housley
Request for Comments: 5008 Vigil Security
Category: Informational J. Solinas
NSA
September 2007
Suite B in Secure/Multipurpose Internet Mail Extensions (S/MIME)
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Abstract
This document specifies the conventions for using the United States
National Security Agency's Suite B algorithms in Secure/Multipurpose
Internet Mail Extensions (S/MIME) as specified in RFC 3851.
1. Introduction
This document specifies the conventions for using the United States
National Security Agency's Suite B algorithms [SuiteB] in
Secure/Multipurpose Internet Mail Extensions (S/MIME) [MSG]. S/MIME
makes use of the Cryptographic Message Syntax (CMS) [CMS]. In
particular, the signed-data and the enveloped-data content types are
used.
Since many of the Suite B algorithms enjoy uses in other environments
as well, the majority of the conventions needed for the Suite B
algorithms are already specified in other documents. This document
references the source of these conventions, and the relevant details
are repeated to aid developers that choose to support Suite B. In a
few cases, additional algorithm identifiers are needed, and they are
provided in this document.
1.1. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [STDWORDS].
Housley & Solinas Informational [Page 1]
RFC 5008 Suite B in S/MIME September 2007
1.2. ASN.1
CMS values are generated using ASN.1 [X.208-88], the Basic Encoding
Rules (BER) [X.209-88], and the Distinguished Encoding Rules (DER)
[X.509-88].
1.3. Suite B Security Levels
Suite B offers two security levels: Level 1 and Level 2. Security
Level 2 offers greater cryptographic strength by using longer keys.
For S/MIME signed messages, Suite B follows the direction set by RFC
3278 [CMSECC], but some additional algorithm identifiers are
assigned. Suite B uses these algorithms:
Security Level 1 Security Level 2
---------------- ----------------
Message Digest: SHA-256 SHA-384
Signature: ECDSA with P-256 ECDSA with P-384
For S/MIME-encrypted messages, Suite B follows the direction set by
RFC 3278 [CMSECC] and follows the conventions set by RFC 3565
[CMSAES]. Again, additional algorithm identifiers are assigned.
Suite B uses these algorithms:
Security Level 1 Security Level 2
---------------- ----------------
Key Agreement: ECDH with P-256 ECDH with P-384
Key Derivation: SHA-256 SHA-384
Key Wrap: AES-128 Key Wrap AES-256 Key Wrap
Content Encryption: AES-128 CBC AES-256 CBC
2. SHA-256 and SHA-256 Message Digest Algorithms
This section specifies the conventions employed by implementations
that support SHA-256 or SHA-384 [SHA2]. In Suite B, Security Level
1, the SHA-256 message digest algorithm MUST be used. In Suite B,
Security Level 2, SHA-384 MUST be used.
Within the CMS signed-data content type, message digest algorithm
identifiers are located in the SignedData digestAlgorithms field and
the SignerInfo digestAlgorithm field. Also, message digest values
are located in the Message Digest authenticated attribute. In
addition, message digest values are input into signature algorithms.
The SHA-256 and SHA-384 message digest algorithms are defined in FIPS
Pub 180-2 [SHA2, EH]. The algorithm identifier for SHA-256 is:
Housley & Solinas Informational [Page 2]
RFC 5008 Suite B in S/MIME September 2007
id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistalgorithm(4) hashalgs(2) 1 }
The algorithm identifier for SHA-384 is:
id-sha384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistalgorithm(4) hashalgs(2) 2 }
There are two possible encodings for the AlgorithmIdentifier
parameters field. The two alternatives arise from the fact that when
the 1988 syntax for AlgorithmIdentifier was translated into the 1997
syntax, the OPTIONAL associated with the AlgorithmIdentifier
parameters got lost. Later, the OPTIONAL was recovered via a defect
report, but by then many people thought that algorithm parameters
were mandatory. Because of this history some implementations encode
parameters as a NULL element and others omit them entirely. The
correct encoding for the SHA-256 and SHA-384 message digest
algorithms is to omit the parameters field; however, to ensure
compatibility, implementations ought to also handle a SHA-256 and
SHA-384 AlgorithmIdentifier parameters field, which contains a NULL.
For both SHA-256 and SHA-384, the AlgorithmIdentifier parameters
field is OPTIONAL, and if present, the parameters field MUST contain
a NULL. Implementations MUST accept SHA-256 and SHA-384
AlgorithmIdentifiers with absent parameters. Implementations MUST
accept SHA-256 and SHA-384 AlgorithmIdentifiers with NULL parameters.
Implementations SHOULD generate SHA-256 and SHA-384
AlgorithmIdentifiers with absent parameters.
3. ECDSA Signature Algorithm
This section specifies the conventions employed by implementations
that support Elliptic Curve Digital Signature Algorithm (ECDSA). The
direction set by RFC 3278 [CMSECC] is followed, but additional
message digest algorithms and additional elliptic curves are
employed. In Suite B, Security Level 1, ECDSA MUST be used with the
SHA-256 message digest algorithm and the P-256 elliptic curve. In
Suite B, Security Level 2, ECDSA MUST be used with the SHA-384
message digest algorithm and the P-384 elliptic curve. The P-256 and
P-384 elliptic curves are specified in [DSS].
Within the CMS signed-data content type, signature algorithm
identifiers are located in the SignerInfo signatureAlgorithm field of
SignedData. In addition, signature algorithm identifiers are located
in the SignerInfo signatureAlgorithm field of countersignature
attributes.
Housley & Solinas Informational [Page 3]
RFC 5008 Suite B in S/MIME September 2007
Within the CMS signed-data content type, signature values are located
in the SignerInfo signature field of SignedData. In addition,
signature values are located in the SignerInfo signature field of
countersignature attributes.
As specified in RFC 3279 [PKIX1ALG], ECDSA and Elliptic Curve
Diffie-Hellman (ECDH) use the same algorithm identifier for subject
public keys in certificates, and it is repeated here:
id-ecPublicKey OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-x9-62(10045) keyType(2) 1 }
This object identifier is used in public key certificates for both
ECDSA signature keys and ECDH encryption keys. The intended
application for the key may be indicated in the key usage field (see
RFC 3280 [PKIX1]). The use of separate keys for signature and
encryption purposes is RECOMMENDED; however, the use of a single key
for both signature and encryption purposes is not forbidden.
As specified in RFC 3279 [PKIX1ALG], ECDSA and ECDH use the same
encoding for subject public keys in certificates, and it is repeated
here:
ECPoint ::= OCTET STRING
The elliptic curve public key (an OCTET STRING) is mapped to a
subject public key (a BIT STRING) as follows: the most significant
bit of the OCTET STRING becomes the most significant bit of the BIT
STRING, and the least significant bit of the OCTET STRING becomes the
least significant bit of the BIT STRING. Note that this octet string
may represent an elliptic curve point in compressed or uncompressed
form. Implementations that support elliptic curves according to this
specification MUST support the uncompressed form and MAY support the
compressed form.
ECDSA and ECDH require use of certain parameters with the public key.
The parameters may be inherited from the certificate issuer,
implicitly included through reference to a named curve, or explicitly
included in the certificate. As specified in RFC 3279 [PKIX1ALG],
the parameter structure is:
EcpkParameters ::= CHOICE {
ecParameters ECParameters,
namedCurve OBJECT IDENTIFIER,
implicitlyCA NULL }
Housley & Solinas Informational [Page 4]
RFC 5008 Suite B in S/MIME September 2007
In Suite B, the namedCurve CHOICE MUST be used. The object
identifier for P-256 is:
ansip256r1 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-x9-62(10045) curves(3) prime(1) 7 }
The object identifier for P-384 is:
secp384r1 OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) certicom(132) curve(0) 34 }
The algorithm identifier used in CMS for ECDSA with SHA-256 signature
values is:
ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-sha2(3) 2 }
The algorithm identifier used in CMS for ECDSA with SHA-384 signature
values is:
ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-sha2(3) 3 }
When either the ecdsa-with-SHA256 or the ecdsa-with-SHA384 algorithm
identifier is used, the AlgorithmIdentifier parameters field MUST be
absent.
When signing, the ECDSA algorithm generates two values, commonly
called r and s. To transfer these two values as one signature, they
MUST be encoded using the Ecdsa-Sig-Value type specified in RFC 3279
[PKIX1ALG]:
Ecdsa-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
4. Key Management
CMS accommodates the following general key management techniques: key
agreement, key transport, previously distributed symmetric key-
encryption keys, and passwords. In Suite B, ephemeral-static key
agreement MUST be used as described in Section 4.1.
When a key agreement algorithm is used, a key-encryption algorithm is
also needed. In Suite B, the Advanced Encryption Standard (AES) Key
Wrap, as specified in RFC 3394 [AESWRAP, SH], MUST be used as the
key-encryption algorithm. AES Key Wrap is discussed further in
Section 4.2. The key-encryption key used with the AES Key Wrap
Housley & Solinas Informational [Page 5]
RFC 5008 Suite B in S/MIME September 2007
algorithm is obtained from a key derivation function (KDF). In Suite
B, there are two KDFs, one based on SHA-256 and one based on SHA-384.
These KDFs are discussed further in Section 4.3.
4.1. ECDH Key Agreement Algorithm
This section specifies the conventions employed by implementations
that support ECDH. The direction set by RFC 3278 [CMSECC] is
followed, but additional key derivation functions and key wrap
algorithms are employed. S/MIME is used in store-and-forward
communications, which means that ephemeral-static ECDH is always
employed. This means that the message originator uses an ephemeral
ECDH key and that the message recipient uses a static ECDH key, which
is obtained from an X.509 certificate. In Suite B, Security Level 1,
ephemeral-static ECDH MUST be used with the SHA-256 KDF, AES-128 Key
Wrap, and the P-256 elliptic curve. In Suite B, Security Level 2,
ephemeral-static ECDH MUST be used with the SHA-384 KDF, AES-256 Key
Wrap, and the P-384 elliptic curve.
Within the CMS enveloped-data content type, key agreement algorithm
identifiers are located in the EnvelopedData RecipientInfos
KeyAgreeRecipientInfo keyEncryptionAlgorithm field.
As specified in RFC 3279 [PKIX1ALG], ECDSA and ECDH use the same
conventions for carrying a subject public key in a certificate.
These conventions are discussed in Section 3.
Ephemeral-static ECDH key agreement is defined in [SEC1] and
[IEEE1363]. When using ephemeral-static ECDH, the EnvelopedData
RecipientInfos keyAgreeRecipientInfo field is used as follows:
version MUST be 3.
originator MUST be the originatorKey alternative. The
originatorKey algorithm field MUST contain the id-ecPublicKey
object identifier (see Section 3) with NULL parameters. The
originatorKey publicKey field MUST contain the message
originator's ephemeral public key, which is a DER-encoded ECPoint
(see Section 3). The ECPoint SHOULD be represented in
uncompressed form.
ukm can be present or absent. However, message originators SHOULD
include the ukm. As specified in RFC 3852 [CMS], implementations
MUST support ukm message recipient processing, so interoperability
is not a concern if the ukm is present or absent. When present,
the ukm is used to ensure that a different key-encryption key is
generated, even when the ephemeral private key is improperly used
Housley & Solinas Informational [Page 6]
RFC 5008 Suite B in S/MIME September 2007
more than once. See [RANDOM] for guidance on generation of random
values.
keyEncryptionAlgorithm MUST be one of the two algorithm
identifiers listed below, and the algorithm identifier parameter
field MUST be present and identify the key wrap algorithm. The
key wrap algorithm denotes the symmetric encryption algorithm used
to encrypt the content-encryption key with the pairwise key-
encryption key generated using the ephemeral-static ECDH key
agreement algorithm (see Section 4.3). In Suite B, Security Level
1, the keyEncryptionAlgorithm MUST be dhSinglePass-stdDH-
sha256kdf-scheme, and the keyEncryptionAlgorithm parameter MUST be
a KeyWrapAlgorithm containing id-aes128-wrap (see Section 4.2).
In Suite B, Security Level 2, the keyEncryptionAlgorithm MUST be
dhSinglePass-stdDH-sha384kdf-scheme, and the
keyEncryptionAlgorithm parameter MUST be a KeyWrapAlgorithm
containing id-aes256-wrap (see Section 4.2). The algorithm
identifier for dhSinglePass-stdDH-sha256kdf-scheme and
dhSinglePass-stdDH-sha384kdf-scheme are:
dhSinglePass-stdDH-sha256kdf-scheme OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) certicom(132)
schemes(1) 11 1 }
dhSinglePass-stdDH-sha384kdf-scheme OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) certicom(132)
schemes(1) 11 2 }
Both of these algorithm identifiers use KeyWrapAlgorithm as the
type for their parameter:
KeyWrapAlgorithm ::= AlgorithmIdentifier
recipientEncryptedKeys contains an identifier and an encrypted key
for each recipient. The RecipientEncryptedKey
KeyAgreeRecipientIdentifier MUST contain either the
issuerAndSerialNumber identifying the recipient's certificate or
the RecipientKeyIdentifier containing the subject key identifier
from the recipient's certificate. In both cases, the recipient's
certificate contains the recipient's static ECDH public key.
RecipientEncryptedKey EncryptedKey MUST contain the content-
encryption key encrypted with the ephemeral-static, ECDH-generated
pairwise key-encryption key using the algorithm specified by the
KeyWrapAlgorithm (see Section 4.3).
Housley & Solinas Informational [Page 7]
RFC 5008 Suite B in S/MIME September 2007
4.2. AES Key Wrap
CMS offers support for symmetric key-encryption key management;
however, it is not used in Suite B. Rather, the AES Key Wrap key-
encryption algorithm, as specified in RFC 3394 [AESWRAP, SH], is used
to encrypt the content-encryption key with a pairwise key-encryption
key that is generated using ephemeral-static ECDH. In Suite B,
Security Level 1, AES-128 Key Wrap MUST be used as the key-encryption
algorithm. In Suite B, Security Level 2, AES-256 Key Wrap MUST be
used as the key-encryption algorithm.
Within the CMS enveloped-data content type, wrapped content-
encryption keys are located in the EnvelopedData RecipientInfos
KeyAgreeRecipientInfo RecipientEncryptedKeys encryptedKey field, and
key wrap algorithm identifiers are located in the KeyWrapAlgorithm
parameters within the EnvelopedData RecipientInfos
KeyAgreeRecipientInfo keyEncryptionAlgorithm field.
The algorithm identifiers for AES Key Wrap are specified in RFC 3394
[SH], and the ones needed for Suite B are repeated here:
id-aes128-wrap OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 5 }
id-aes256-wrap OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 45 }
4.3. Key Derivation Functions
CMS offers support for deriving symmetric key-encryption keys from
passwords; however, password-based key management is not used in
Suite B. Rather, KDFs based on SHA-256 and SHA-384 are used to
derive a pairwise key-encryption key from the shared secret produced
by ephemeral-static ECDH. In Suite B, Security Level 1, the KDF
based on SHA-256 MUST be used. In Suite B, Security Level 2, KDF
based on SHA-384 MUST be used.
As specified in Section 8.2 of RFC 3278 [CMSECC], using ECDH with the
CMS enveloped-data content type, the derivation of key-encryption
keys makes use of the ECC-CMS-SharedInfo type, which is repeated
here:
ECC-CMS-SharedInfo ::= SEQUENCE {
keyInfo AlgorithmIdentifier,
entityUInfo [0] EXPLICIT OCTET STRING OPTIONAL,
suppPubInfo [2] EXPLICIT OCTET STRING }
Housley & Solinas Informational [Page 8]
RFC 5008 Suite B in S/MIME September 2007
In Suite B, the fields of ECC-CMS-SharedInfo are used as follows:
keyInfo contains the object identifier of the key-encryption
algorithm that will be used to wrap the content-encryption key and
NULL parameters. In Suite B, Security Level 1, AES-128 Key Wrap
MUST be used, resulting in {id-aes128-wrap, NULL}. In Suite B,
Security Level 2, AES-256 Key Wrap MUST be used, resulting in
{id-aes256-wrap, NULL}.
entityUInfo optionally contains a random value provided by the
message originator. If the ukm is present, then the entityUInfo
MUST be present, and it MUST contain the ukm value. If the ukm is
not present, then the entityUInfo MUST be absent.
suppPubInfo contains the length of the generated key-encryption
key, in bits, represented as a 32-bit unsigned number, as
described in RFC 2631 [CMSDH]. In Suite B, Security Level 1, a
128-bit AES key MUST be used, resulting in 0x00000080. In Suite
B, Security Level 2, a 256-bit AES key MUST be used, resulting in
0x00000100.
ECC-CMS-SharedInfo is DER-encoded and used as input to the key
derivation function, as specified in Section 3.6.1 of [SEC1]. Note
that ECC-CMS-SharedInfo differs from the OtherInfo specified in
[CMSDH]. Here, a counter value is not included in the keyInfo field
because the KDF specified in [SEC1] ensures that sufficient keying
data is provided.
The KDF specified in [SEC1] provides an algorithm for generating an
essentially arbitrary amount of keying material from the shared
secret produced by ephemeral-static ECDH, which is called Z for the
remainder of this discussion. The KDF can be summarized as:
KM = Hash ( Z || Counter || ECC-CMS-SharedInfo )
To generate a key-encryption key, one or more KM blocks are
generated, incrementing Counter appropriately, until enough material
has been generated. The KM blocks are concatenated left to right:
KEK = KM ( counter=1 ) || KM ( counter=2 ) ...
The elements of the KDF are used as follows:
Hash is the one-way hash function, and it is either SHA-256 or
SHA-384 [SHA2]. In Suite B, Security Level 1, the SHA-256 MUST be
used. In Suite B, Security Level 2, SHA-384 MUST be used.
Housley & Solinas Informational [Page 9]
RFC 5008 Suite B in S/MIME September 2007
Z is the shared secret value generated by ephemeral-static ECDH.
Leading zero bits MUST be preserved. In Suite B, Security Level
1, Z MUST be exactly 256 bits. In Suite B, Security Level 2, Z
MUST be exactly 384 bits.
Counter is a 32-bit unsigned number, represented in network byte
order. Its initial value MUST be 0x00000001 for any key
derivation operation. In Suite B, Security Level 1 and Security
Level 2, exactly one iteration is needed; the Counter is not
incremented.
ECC-CMS-SharedInfo is composed as described above. It MUST be DER
encoded.
To generate a key-encryption key, one KM block is generated, with a
Counter value of 0x00000001:
KEK = KM ( 1 ) = Hash ( Z || Counter=1 || ECC-CMS-SharedInfo )
In Suite B, Security Level 1, the key-encryption key MUST be the most
significant 128 bits of the SHA-256 output value. In Suite B,
Security Level 2, the key-encryption key MUST be the most significant
256 bits of the SHA-384 output value.
Note that the only source of secret entropy in this computation is Z.
The effective key space of the key-encryption key is limited by the
size of Z, in addition to any security level considerations imposed
by the elliptic curve that is used. However, if entityUInfo is
different for each message, a different key-encryption key will be
generated for each message.
5. AES CBC Content Encryption
This section specifies the conventions employed by implementations
that support content encryption using AES [AES] in Cipher Block
Chaining (CBC) mode [MODES]. The conventions in RFC 3565 [CMSAES]
are followed. In Suite B, Security Level 1, the AES-128 in CBC mode
MUST be used for content encryption. In Suite B, Security Level 2,
AES-256 in CBC mode MUST be used.
Within the CMS enveloped-data content type, content encryption
algorithm identifiers are located in the EnvelopedData
EncryptedContentInfo contentEncryptionAlgorithm field. The content
encryption algorithm is used to encipher the content located in the
EnvelopedData EncryptedContentInfo encryptedContent field.
The AES CBC content-encryption algorithm is described in [AES] and
[MODES]. The algorithm identifier for AES-128 in CBC mode is:
Housley & Solinas Informational [Page 10]
RFC 5008 Suite B in S/MIME September 2007
id-aes128-CBC OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 2 }
The algorithm identifier for AES-256 in CBC mode is:
id-aes256-CBC OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 42 }
The AlgorithmIdentifier parameters field MUST be present, and the
parameters field must contain AES-IV:
AES-IV ::= OCTET STRING (SIZE(16))
The 16-octet initialization vector is generated at random by the
originator. See [RANDOM] for guidance on generation of random
values.
6. Security Considerations
This document specifies the conventions for using the NSA's Suite B
algorithms in S/MIME. All of the algorithms have been specified in
previous documents, although a few new algorithm identifiers have
been assigned.
Two levels of security may be achieved using this specification.
Users must consider their risk environment to determine which level
is appropriate for their own use.
For signed and encrypted messages, Suite B provides a consistent
level of security for confidentiality and integrity of the message
content.
The security considerations in RFC 3852 [CMS] discuss the CMS as a
method for digitally signing data and encrypting data.
The security considerations in RFC 3370 [CMSALG] discuss
cryptographic algorithm implementation concerns in the context of the
CMS.
The security considerations in RFC 3278 [CMSECC] discuss the use of
elliptic curve cryptography (ECC) in the CMS.
The security considerations in RFC 3565 [CMSAES] discuss the use of
AES in the CMS.
Housley & Solinas Informational [Page 11]
RFC 5008 Suite B in S/MIME September 2007
7. References
7.1. Normative References
[AES] National Institute of Standards and Technology, "Advanced
Encryption Standard (AES)", FIPS PUB 197, November 2001.
[AESWRAP] National Institute of Standards and Technology, "AES Key
Wrap Specification", 17 November 2001. [See
http://csrc.nist.gov/encryption/kms/key-wrap.pdf]
[DSS] National Institute of Standards and Technology, "Digital
Signature Standard (DSS)", FIPS PUB 186-2, January 2000.
[ECDSA] American National Standards Institute, "Public Key
Cryptography For The Financial Services Industry: The
Elliptic Curve Digital Signature Algorithm (ECDSA)", ANSI
X9.62-1998, 1999.
[CMS] Housley, R., "Cryptographic Message Syntax (CMS)", RFC
3852, July 2004.
[CMSAES] Schaad, J., "Use of the Advanced Encryption Standard
(AES) Encryption Algorithm in Cryptographic Message
Syntax (CMS)", RFC 3565, July 2003.
[CMSALG] Housley, R., "Cryptographic Message Syntax (CMS)
Algorithms", RFC 3370, August 2002.
[CMSDH] Rescorla, E., "Diffie-Hellman Key Agreement Method", RFC
2631, June 1999.
[CMSECC] Blake-Wilson, S., Brown, D., and P. Lambert, "Use of
Elliptic Curve Cryptography (ECC) Algorithms in
Cryptographic Message Syntax (CMS)", RFC 3278, April
2002.
[IEEE1363] Institute of Electrical and Electronics Engineers,
"Standard Specifications for Public Key Cryptography",
IEEE Std 1363, 2000.
[MODES] National Institute of Standards and Technology, "DES
Modes of Operation", FIPS Pub 81, 2 December 1980.
[MSG] Ramsdell, B., "Secure/Multipurpose Internet Mail
Extensions (S/MIME) Version 3.1 Message Specification",
RFC 3851, July 2004.
Housley & Solinas Informational [Page 12]
RFC 5008 Suite B in S/MIME September 2007
[PKIX1] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
X.509 Public Key Infrastructure Certificate and
Certificate Revocation List (CRL) Profile", RFC 3280,
April 2002.
[PKIX1ALG] Bassham, L., Polk, W., and R. Housley, "Algorithms and
Identifiers for the Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation
List (CRL) Profile", RFC 3279, April 2002.
[SEC1] Standards for Efficient Cryptography Group, "Elliptic
Curve Cryptography", 2000. [See http://www.secg.org/
collateral/sec1.pdf.]
[SH] Schaad, J., and R. Housley, "Advanced Encryption Standard
(AES) Key Wrap Algorithm", RFC 3394, September 2002.
[SHA2] National Institute of Standards and Technology, "Secure
Hash Standard", FIPS 180-2, 1 August 2002.
[STDWORDS] S. Bradner, "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[X.208-88] CCITT. Recommendation X.208: Specification of Abstract
Syntax Notation One (ASN.1). 1988.
[X.209-88] CCITT. Recommendation X.209: Specification of Basic
Encoding Rules for Abstract Syntax Notation One (ASN.1).
1988.
[X.509-88] CCITT. Recommendation X.509: The Directory -
Authentication Framework. 1988.
7.2. Informative References
[EH] Eastlake 3rd, D. and T. Hansen, "US Secure Hash
Algorithms (SHA and HMAC-SHA)", RFC 4634, July 2006.
[RANDOM] Eastlake, D., 3rd, Schiller, J., and S. Crocker,
"Randomness Requirements for Security", BCP 106, RFC
4086, June 2005.
[SuiteB] National Security Agency, "Fact Sheet NSA Suite B
Cryptography", July 2005. [See http://www.nsa.gov/ia/
industry/crypto_Suite_b.cfm?MenuID=10.2.7)
Housley & Solinas Informational [Page 13]
RFC 5008 Suite B in S/MIME September 2007
Authors' Addresses
Russell Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA 20170
USA
EMail: housley@vigilsec.com
Jerome A. Solinas
National Information Assurance Laboratory
National Security Agency
9800 Savage Road
Fort George G. Meade, MD 20755
USA
EMail: jasolin@orion.ncsc.mil
Housley & Solinas Informational [Page 14]
RFC 5008 Suite B in S/MIME September 2007
Full Copyright Statement
Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Housley & Solinas Informational [Page 15]
Request for Comments: 5008 Vigil Security
Category: Informational J. Solinas
NSA
September 2007
Suite B in Secure/Multipurpose Internet Mail Extensions (S/MIME)
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Abstract
This document specifies the conventions for using the United States
National Security Agency's Suite B algorithms in Secure/Multipurpose
Internet Mail Extensions (S/MIME) as specified in RFC 3851.
1. Introduction
This document specifies the conventions for using the United States
National Security Agency's Suite B algorithms [SuiteB] in
Secure/Multipurpose Internet Mail Extensions (S/MIME) [MSG]. S/MIME
makes use of the Cryptographic Message Syntax (CMS) [CMS]. In
particular, the signed-data and the enveloped-data content types are
used.
Since many of the Suite B algorithms enjoy uses in other environments
as well, the majority of the conventions needed for the Suite B
algorithms are already specified in other documents. This document
references the source of these conventions, and the relevant details
are repeated to aid developers that choose to support Suite B. In a
few cases, additional algorithm identifiers are needed, and they are
provided in this document.
1.1. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [STDWORDS].
Housley & Solinas Informational [Page 1]
RFC 5008 Suite B in S/MIME September 2007
1.2. ASN.1
CMS values are generated using ASN.1 [X.208-88], the Basic Encoding
Rules (BER) [X.209-88], and the Distinguished Encoding Rules (DER)
[X.509-88].
1.3. Suite B Security Levels
Suite B offers two security levels: Level 1 and Level 2. Security
Level 2 offers greater cryptographic strength by using longer keys.
For S/MIME signed messages, Suite B follows the direction set by RFC
3278 [CMSECC], but some additional algorithm identifiers are
assigned. Suite B uses these algorithms:
Security Level 1 Security Level 2
---------------- ----------------
Message Digest: SHA-256 SHA-384
Signature: ECDSA with P-256 ECDSA with P-384
For S/MIME-encrypted messages, Suite B follows the direction set by
RFC 3278 [CMSECC] and follows the conventions set by RFC 3565
[CMSAES]. Again, additional algorithm identifiers are assigned.
Suite B uses these algorithms:
Security Level 1 Security Level 2
---------------- ----------------
Key Agreement: ECDH with P-256 ECDH with P-384
Key Derivation: SHA-256 SHA-384
Key Wrap: AES-128 Key Wrap AES-256 Key Wrap
Content Encryption: AES-128 CBC AES-256 CBC
2. SHA-256 and SHA-256 Message Digest Algorithms
This section specifies the conventions employed by implementations
that support SHA-256 or SHA-384 [SHA2]. In Suite B, Security Level
1, the SHA-256 message digest algorithm MUST be used. In Suite B,
Security Level 2, SHA-384 MUST be used.
Within the CMS signed-data content type, message digest algorithm
identifiers are located in the SignedData digestAlgorithms field and
the SignerInfo digestAlgorithm field. Also, message digest values
are located in the Message Digest authenticated attribute. In
addition, message digest values are input into signature algorithms.
The SHA-256 and SHA-384 message digest algorithms are defined in FIPS
Pub 180-2 [SHA2, EH]. The algorithm identifier for SHA-256 is:
Housley & Solinas Informational [Page 2]
RFC 5008 Suite B in S/MIME September 2007
id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistalgorithm(4) hashalgs(2) 1 }
The algorithm identifier for SHA-384 is:
id-sha384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistalgorithm(4) hashalgs(2) 2 }
There are two possible encodings for the AlgorithmIdentifier
parameters field. The two alternatives arise from the fact that when
the 1988 syntax for AlgorithmIdentifier was translated into the 1997
syntax, the OPTIONAL associated with the AlgorithmIdentifier
parameters got lost. Later, the OPTIONAL was recovered via a defect
report, but by then many people thought that algorithm parameters
were mandatory. Because of this history some implementations encode
parameters as a NULL element and others omit them entirely. The
correct encoding for the SHA-256 and SHA-384 message digest
algorithms is to omit the parameters field; however, to ensure
compatibility, implementations ought to also handle a SHA-256 and
SHA-384 AlgorithmIdentifier parameters field, which contains a NULL.
For both SHA-256 and SHA-384, the AlgorithmIdentifier parameters
field is OPTIONAL, and if present, the parameters field MUST contain
a NULL. Implementations MUST accept SHA-256 and SHA-384
AlgorithmIdentifiers with absent parameters. Implementations MUST
accept SHA-256 and SHA-384 AlgorithmIdentifiers with NULL parameters.
Implementations SHOULD generate SHA-256 and SHA-384
AlgorithmIdentifiers with absent parameters.
3. ECDSA Signature Algorithm
This section specifies the conventions employed by implementations
that support Elliptic Curve Digital Signature Algorithm (ECDSA). The
direction set by RFC 3278 [CMSECC] is followed, but additional
message digest algorithms and additional elliptic curves are
employed. In Suite B, Security Level 1, ECDSA MUST be used with the
SHA-256 message digest algorithm and the P-256 elliptic curve. In
Suite B, Security Level 2, ECDSA MUST be used with the SHA-384
message digest algorithm and the P-384 elliptic curve. The P-256 and
P-384 elliptic curves are specified in [DSS].
Within the CMS signed-data content type, signature algorithm
identifiers are located in the SignerInfo signatureAlgorithm field of
SignedData. In addition, signature algorithm identifiers are located
in the SignerInfo signatureAlgorithm field of countersignature
attributes.
Housley & Solinas Informational [Page 3]
RFC 5008 Suite B in S/MIME September 2007
Within the CMS signed-data content type, signature values are located
in the SignerInfo signature field of SignedData. In addition,
signature values are located in the SignerInfo signature field of
countersignature attributes.
As specified in RFC 3279 [PKIX1ALG], ECDSA and Elliptic Curve
Diffie-Hellman (ECDH) use the same algorithm identifier for subject
public keys in certificates, and it is repeated here:
id-ecPublicKey OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-x9-62(10045) keyType(2) 1 }
This object identifier is used in public key certificates for both
ECDSA signature keys and ECDH encryption keys. The intended
application for the key may be indicated in the key usage field (see
RFC 3280 [PKIX1]). The use of separate keys for signature and
encryption purposes is RECOMMENDED; however, the use of a single key
for both signature and encryption purposes is not forbidden.
As specified in RFC 3279 [PKIX1ALG], ECDSA and ECDH use the same
encoding for subject public keys in certificates, and it is repeated
here:
ECPoint ::= OCTET STRING
The elliptic curve public key (an OCTET STRING) is mapped to a
subject public key (a BIT STRING) as follows: the most significant
bit of the OCTET STRING becomes the most significant bit of the BIT
STRING, and the least significant bit of the OCTET STRING becomes the
least significant bit of the BIT STRING. Note that this octet string
may represent an elliptic curve point in compressed or uncompressed
form. Implementations that support elliptic curves according to this
specification MUST support the uncompressed form and MAY support the
compressed form.
ECDSA and ECDH require use of certain parameters with the public key.
The parameters may be inherited from the certificate issuer,
implicitly included through reference to a named curve, or explicitly
included in the certificate. As specified in RFC 3279 [PKIX1ALG],
the parameter structure is:
EcpkParameters ::= CHOICE {
ecParameters ECParameters,
namedCurve OBJECT IDENTIFIER,
implicitlyCA NULL }
Housley & Solinas Informational [Page 4]
RFC 5008 Suite B in S/MIME September 2007
In Suite B, the namedCurve CHOICE MUST be used. The object
identifier for P-256 is:
ansip256r1 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-x9-62(10045) curves(3) prime(1) 7 }
The object identifier for P-384 is:
secp384r1 OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) certicom(132) curve(0) 34 }
The algorithm identifier used in CMS for ECDSA with SHA-256 signature
values is:
ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-sha2(3) 2 }
The algorithm identifier used in CMS for ECDSA with SHA-384 signature
values is:
ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-sha2(3) 3 }
When either the ecdsa-with-SHA256 or the ecdsa-with-SHA384 algorithm
identifier is used, the AlgorithmIdentifier parameters field MUST be
absent.
When signing, the ECDSA algorithm generates two values, commonly
called r and s. To transfer these two values as one signature, they
MUST be encoded using the Ecdsa-Sig-Value type specified in RFC 3279
[PKIX1ALG]:
Ecdsa-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
4. Key Management
CMS accommodates the following general key management techniques: key
agreement, key transport, previously distributed symmetric key-
encryption keys, and passwords. In Suite B, ephemeral-static key
agreement MUST be used as described in Section 4.1.
When a key agreement algorithm is used, a key-encryption algorithm is
also needed. In Suite B, the Advanced Encryption Standard (AES) Key
Wrap, as specified in RFC 3394 [AESWRAP, SH], MUST be used as the
key-encryption algorithm. AES Key Wrap is discussed further in
Section 4.2. The key-encryption key used with the AES Key Wrap
Housley & Solinas Informational [Page 5]
RFC 5008 Suite B in S/MIME September 2007
algorithm is obtained from a key derivation function (KDF). In Suite
B, there are two KDFs, one based on SHA-256 and one based on SHA-384.
These KDFs are discussed further in Section 4.3.
4.1. ECDH Key Agreement Algorithm
This section specifies the conventions employed by implementations
that support ECDH. The direction set by RFC 3278 [CMSECC] is
followed, but additional key derivation functions and key wrap
algorithms are employed. S/MIME is used in store-and-forward
communications, which means that ephemeral-static ECDH is always
employed. This means that the message originator uses an ephemeral
ECDH key and that the message recipient uses a static ECDH key, which
is obtained from an X.509 certificate. In Suite B, Security Level 1,
ephemeral-static ECDH MUST be used with the SHA-256 KDF, AES-128 Key
Wrap, and the P-256 elliptic curve. In Suite B, Security Level 2,
ephemeral-static ECDH MUST be used with the SHA-384 KDF, AES-256 Key
Wrap, and the P-384 elliptic curve.
Within the CMS enveloped-data content type, key agreement algorithm
identifiers are located in the EnvelopedData RecipientInfos
KeyAgreeRecipientInfo keyEncryptionAlgorithm field.
As specified in RFC 3279 [PKIX1ALG], ECDSA and ECDH use the same
conventions for carrying a subject public key in a certificate.
These conventions are discussed in Section 3.
Ephemeral-static ECDH key agreement is defined in [SEC1] and
[IEEE1363]. When using ephemeral-static ECDH, the EnvelopedData
RecipientInfos keyAgreeRecipientInfo field is used as follows:
version MUST be 3.
originator MUST be the originatorKey alternative. The
originatorKey algorithm field MUST contain the id-ecPublicKey
object identifier (see Section 3) with NULL parameters. The
originatorKey publicKey field MUST contain the message
originator's ephemeral public key, which is a DER-encoded ECPoint
(see Section 3). The ECPoint SHOULD be represented in
uncompressed form.
ukm can be present or absent. However, message originators SHOULD
include the ukm. As specified in RFC 3852 [CMS], implementations
MUST support ukm message recipient processing, so interoperability
is not a concern if the ukm is present or absent. When present,
the ukm is used to ensure that a different key-encryption key is
generated, even when the ephemeral private key is improperly used
Housley & Solinas Informational [Page 6]
RFC 5008 Suite B in S/MIME September 2007
more than once. See [RANDOM] for guidance on generation of random
values.
keyEncryptionAlgorithm MUST be one of the two algorithm
identifiers listed below, and the algorithm identifier parameter
field MUST be present and identify the key wrap algorithm. The
key wrap algorithm denotes the symmetric encryption algorithm used
to encrypt the content-encryption key with the pairwise key-
encryption key generated using the ephemeral-static ECDH key
agreement algorithm (see Section 4.3). In Suite B, Security Level
1, the keyEncryptionAlgorithm MUST be dhSinglePass-stdDH-
sha256kdf-scheme, and the keyEncryptionAlgorithm parameter MUST be
a KeyWrapAlgorithm containing id-aes128-wrap (see Section 4.2).
In Suite B, Security Level 2, the keyEncryptionAlgorithm MUST be
dhSinglePass-stdDH-sha384kdf-scheme, and the
keyEncryptionAlgorithm parameter MUST be a KeyWrapAlgorithm
containing id-aes256-wrap (see Section 4.2). The algorithm
identifier for dhSinglePass-stdDH-sha256kdf-scheme and
dhSinglePass-stdDH-sha384kdf-scheme are:
dhSinglePass-stdDH-sha256kdf-scheme OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) certicom(132)
schemes(1) 11 1 }
dhSinglePass-stdDH-sha384kdf-scheme OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) certicom(132)
schemes(1) 11 2 }
Both of these algorithm identifiers use KeyWrapAlgorithm as the
type for their parameter:
KeyWrapAlgorithm ::= AlgorithmIdentifier
recipientEncryptedKeys contains an identifier and an encrypted key
for each recipient. The RecipientEncryptedKey
KeyAgreeRecipientIdentifier MUST contain either the
issuerAndSerialNumber identifying the recipient's certificate or
the RecipientKeyIdentifier containing the subject key identifier
from the recipient's certificate. In both cases, the recipient's
certificate contains the recipient's static ECDH public key.
RecipientEncryptedKey EncryptedKey MUST contain the content-
encryption key encrypted with the ephemeral-static, ECDH-generated
pairwise key-encryption key using the algorithm specified by the
KeyWrapAlgorithm (see Section 4.3).
Housley & Solinas Informational [Page 7]
RFC 5008 Suite B in S/MIME September 2007
4.2. AES Key Wrap
CMS offers support for symmetric key-encryption key management;
however, it is not used in Suite B. Rather, the AES Key Wrap key-
encryption algorithm, as specified in RFC 3394 [AESWRAP, SH], is used
to encrypt the content-encryption key with a pairwise key-encryption
key that is generated using ephemeral-static ECDH. In Suite B,
Security Level 1, AES-128 Key Wrap MUST be used as the key-encryption
algorithm. In Suite B, Security Level 2, AES-256 Key Wrap MUST be
used as the key-encryption algorithm.
Within the CMS enveloped-data content type, wrapped content-
encryption keys are located in the EnvelopedData RecipientInfos
KeyAgreeRecipientInfo RecipientEncryptedKeys encryptedKey field, and
key wrap algorithm identifiers are located in the KeyWrapAlgorithm
parameters within the EnvelopedData RecipientInfos
KeyAgreeRecipientInfo keyEncryptionAlgorithm field.
The algorithm identifiers for AES Key Wrap are specified in RFC 3394
[SH], and the ones needed for Suite B are repeated here:
id-aes128-wrap OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 5 }
id-aes256-wrap OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 45 }
4.3. Key Derivation Functions
CMS offers support for deriving symmetric key-encryption keys from
passwords; however, password-based key management is not used in
Suite B. Rather, KDFs based on SHA-256 and SHA-384 are used to
derive a pairwise key-encryption key from the shared secret produced
by ephemeral-static ECDH. In Suite B, Security Level 1, the KDF
based on SHA-256 MUST be used. In Suite B, Security Level 2, KDF
based on SHA-384 MUST be used.
As specified in Section 8.2 of RFC 3278 [CMSECC], using ECDH with the
CMS enveloped-data content type, the derivation of key-encryption
keys makes use of the ECC-CMS-SharedInfo type, which is repeated
here:
ECC-CMS-SharedInfo ::= SEQUENCE {
keyInfo AlgorithmIdentifier,
entityUInfo [0] EXPLICIT OCTET STRING OPTIONAL,
suppPubInfo [2] EXPLICIT OCTET STRING }
Housley & Solinas Informational [Page 8]
RFC 5008 Suite B in S/MIME September 2007
In Suite B, the fields of ECC-CMS-SharedInfo are used as follows:
keyInfo contains the object identifier of the key-encryption
algorithm that will be used to wrap the content-encryption key and
NULL parameters. In Suite B, Security Level 1, AES-128 Key Wrap
MUST be used, resulting in {id-aes128-wrap, NULL}. In Suite B,
Security Level 2, AES-256 Key Wrap MUST be used, resulting in
{id-aes256-wrap, NULL}.
entityUInfo optionally contains a random value provided by the
message originator. If the ukm is present, then the entityUInfo
MUST be present, and it MUST contain the ukm value. If the ukm is
not present, then the entityUInfo MUST be absent.
suppPubInfo contains the length of the generated key-encryption
key, in bits, represented as a 32-bit unsigned number, as
described in RFC 2631 [CMSDH]. In Suite B, Security Level 1, a
128-bit AES key MUST be used, resulting in 0x00000080. In Suite
B, Security Level 2, a 256-bit AES key MUST be used, resulting in
0x00000100.
ECC-CMS-SharedInfo is DER-encoded and used as input to the key
derivation function, as specified in Section 3.6.1 of [SEC1]. Note
that ECC-CMS-SharedInfo differs from the OtherInfo specified in
[CMSDH]. Here, a counter value is not included in the keyInfo field
because the KDF specified in [SEC1] ensures that sufficient keying
data is provided.
The KDF specified in [SEC1] provides an algorithm for generating an
essentially arbitrary amount of keying material from the shared
secret produced by ephemeral-static ECDH, which is called Z for the
remainder of this discussion. The KDF can be summarized as:
KM = Hash ( Z || Counter || ECC-CMS-SharedInfo )
To generate a key-encryption key, one or more KM blocks are
generated, incrementing Counter appropriately, until enough material
has been generated. The KM blocks are concatenated left to right:
KEK = KM ( counter=1 ) || KM ( counter=2 ) ...
The elements of the KDF are used as follows:
Hash is the one-way hash function, and it is either SHA-256 or
SHA-384 [SHA2]. In Suite B, Security Level 1, the SHA-256 MUST be
used. In Suite B, Security Level 2, SHA-384 MUST be used.
Housley & Solinas Informational [Page 9]
RFC 5008 Suite B in S/MIME September 2007
Z is the shared secret value generated by ephemeral-static ECDH.
Leading zero bits MUST be preserved. In Suite B, Security Level
1, Z MUST be exactly 256 bits. In Suite B, Security Level 2, Z
MUST be exactly 384 bits.
Counter is a 32-bit unsigned number, represented in network byte
order. Its initial value MUST be 0x00000001 for any key
derivation operation. In Suite B, Security Level 1 and Security
Level 2, exactly one iteration is needed; the Counter is not
incremented.
ECC-CMS-SharedInfo is composed as described above. It MUST be DER
encoded.
To generate a key-encryption key, one KM block is generated, with a
Counter value of 0x00000001:
KEK = KM ( 1 ) = Hash ( Z || Counter=1 || ECC-CMS-SharedInfo )
In Suite B, Security Level 1, the key-encryption key MUST be the most
significant 128 bits of the SHA-256 output value. In Suite B,
Security Level 2, the key-encryption key MUST be the most significant
256 bits of the SHA-384 output value.
Note that the only source of secret entropy in this computation is Z.
The effective key space of the key-encryption key is limited by the
size of Z, in addition to any security level considerations imposed
by the elliptic curve that is used. However, if entityUInfo is
different for each message, a different key-encryption key will be
generated for each message.
5. AES CBC Content Encryption
This section specifies the conventions employed by implementations
that support content encryption using AES [AES] in Cipher Block
Chaining (CBC) mode [MODES]. The conventions in RFC 3565 [CMSAES]
are followed. In Suite B, Security Level 1, the AES-128 in CBC mode
MUST be used for content encryption. In Suite B, Security Level 2,
AES-256 in CBC mode MUST be used.
Within the CMS enveloped-data content type, content encryption
algorithm identifiers are located in the EnvelopedData
EncryptedContentInfo contentEncryptionAlgorithm field. The content
encryption algorithm is used to encipher the content located in the
EnvelopedData EncryptedContentInfo encryptedContent field.
The AES CBC content-encryption algorithm is described in [AES] and
[MODES]. The algorithm identifier for AES-128 in CBC mode is:
Housley & Solinas Informational [Page 10]
RFC 5008 Suite B in S/MIME September 2007
id-aes128-CBC OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 2 }
The algorithm identifier for AES-256 in CBC mode is:
id-aes256-CBC OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101) csor(3)
nistAlgorithm(4) aes(1) 42 }
The AlgorithmIdentifier parameters field MUST be present, and the
parameters field must contain AES-IV:
AES-IV ::= OCTET STRING (SIZE(16))
The 16-octet initialization vector is generated at random by the
originator. See [RANDOM] for guidance on generation of random
values.
6. Security Considerations
This document specifies the conventions for using the NSA's Suite B
algorithms in S/MIME. All of the algorithms have been specified in
previous documents, although a few new algorithm identifiers have
been assigned.
Two levels of security may be achieved using this specification.
Users must consider their risk environment to determine which level
is appropriate for their own use.
For signed and encrypted messages, Suite B provides a consistent
level of security for confidentiality and integrity of the message
content.
The security considerations in RFC 3852 [CMS] discuss the CMS as a
method for digitally signing data and encrypting data.
The security considerations in RFC 3370 [CMSALG] discuss
cryptographic algorithm implementation concerns in the context of the
CMS.
The security considerations in RFC 3278 [CMSECC] discuss the use of
elliptic curve cryptography (ECC) in the CMS.
The security considerations in RFC 3565 [CMSAES] discuss the use of
AES in the CMS.
Housley & Solinas Informational [Page 11]
RFC 5008 Suite B in S/MIME September 2007
7. References
7.1. Normative References
[AES] National Institute of Standards and Technology, "Advanced
Encryption Standard (AES)", FIPS PUB 197, November 2001.
[AESWRAP] National Institute of Standards and Technology, "AES Key
Wrap Specification", 17 November 2001. [See
http://csrc.nist.gov/encryption/kms/key-wrap.pdf]
[DSS] National Institute of Standards and Technology, "Digital
Signature Standard (DSS)", FIPS PUB 186-2, January 2000.
[ECDSA] American National Standards Institute, "Public Key
Cryptography For The Financial Services Industry: The
Elliptic Curve Digital Signature Algorithm (ECDSA)", ANSI
X9.62-1998, 1999.
[CMS] Housley, R., "Cryptographic Message Syntax (CMS)", RFC
3852, July 2004.
[CMSAES] Schaad, J., "Use of the Advanced Encryption Standard
(AES) Encryption Algorithm in Cryptographic Message
Syntax (CMS)", RFC 3565, July 2003.
[CMSALG] Housley, R., "Cryptographic Message Syntax (CMS)
Algorithms", RFC 3370, August 2002.
[CMSDH] Rescorla, E., "Diffie-Hellman Key Agreement Method", RFC
2631, June 1999.
[CMSECC] Blake-Wilson, S., Brown, D., and P. Lambert, "Use of
Elliptic Curve Cryptography (ECC) Algorithms in
Cryptographic Message Syntax (CMS)", RFC 3278, April
2002.
[IEEE1363] Institute of Electrical and Electronics Engineers,
"Standard Specifications for Public Key Cryptography",
IEEE Std 1363, 2000.
[MODES] National Institute of Standards and Technology, "DES
Modes of Operation", FIPS Pub 81, 2 December 1980.
[MSG] Ramsdell, B., "Secure/Multipurpose Internet Mail
Extensions (S/MIME) Version 3.1 Message Specification",
RFC 3851, July 2004.
Housley & Solinas Informational [Page 12]
RFC 5008 Suite B in S/MIME September 2007
[PKIX1] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
X.509 Public Key Infrastructure Certificate and
Certificate Revocation List (CRL) Profile", RFC 3280,
April 2002.
[PKIX1ALG] Bassham, L., Polk, W., and R. Housley, "Algorithms and
Identifiers for the Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation
List (CRL) Profile", RFC 3279, April 2002.
[SEC1] Standards for Efficient Cryptography Group, "Elliptic
Curve Cryptography", 2000. [See http://www.secg.org/
collateral/sec1.pdf.]
[SH] Schaad, J., and R. Housley, "Advanced Encryption Standard
(AES) Key Wrap Algorithm", RFC 3394, September 2002.
[SHA2] National Institute of Standards and Technology, "Secure
Hash Standard", FIPS 180-2, 1 August 2002.
[STDWORDS] S. Bradner, "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[X.208-88] CCITT. Recommendation X.208: Specification of Abstract
Syntax Notation One (ASN.1). 1988.
[X.209-88] CCITT. Recommendation X.209: Specification of Basic
Encoding Rules for Abstract Syntax Notation One (ASN.1).
1988.
[X.509-88] CCITT. Recommendation X.509: The Directory -
Authentication Framework. 1988.
7.2. Informative References
[EH] Eastlake 3rd, D. and T. Hansen, "US Secure Hash
Algorithms (SHA and HMAC-SHA)", RFC 4634, July 2006.
[RANDOM] Eastlake, D., 3rd, Schiller, J., and S. Crocker,
"Randomness Requirements for Security", BCP 106, RFC
4086, June 2005.
[SuiteB] National Security Agency, "Fact Sheet NSA Suite B
Cryptography", July 2005. [See http://www.nsa.gov/ia/
industry/crypto_Suite_b.cfm?MenuID=10.2.7)
Housley & Solinas Informational [Page 13]
RFC 5008 Suite B in S/MIME September 2007
Authors' Addresses
Russell Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA 20170
USA
EMail: housley@vigilsec.com
Jerome A. Solinas
National Information Assurance Laboratory
National Security Agency
9800 Savage Road
Fort George G. Meade, MD 20755
USA
EMail: jasolin@orion.ncsc.mil
Housley & Solinas Informational [Page 14]
RFC 5008 Suite B in S/MIME September 2007
Full Copyright Statement
Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Housley & Solinas Informational [Page 15]
Suite B Profile for Transport Layer Security (TLS)
Network Working Group M. Salter
Request for Comments: 5430 National Security Agency
Category: Informational E. Rescorla
Network Resonance
R. Housley
Vigil Security
March 2009
Suite B Profile for Transport Layer Security (TLS)
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Salter, et al. Informational [Page 1]
RFC 5430 Suite B for TLS March 2009
Abstract
The United States government has published guidelines for "NSA Suite
B Cryptography", which defines cryptographic algorithm policy for
national security applications. This document defines a profile of
Transport Layer Security (TLS) version 1.2 that is fully conformant
with Suite B. This document also defines a transitional profile for
use with TLS version 1.0 and TLS version 1.1 which employs Suite B
algorithms to the greatest extent possible.
Table of Contents
1. Introduction ....................................................2
2. Conventions Used in This Document ...............................3
3. Suite B Requirements ............................................3
4. Suite B Compliance and Interoperability Requirements ............4
4.1. Security Levels ............................................7
4.2. Acceptable Curves ..........................................8
4.3. Certificates ...............................................8
4.4. signature_algorithms Extension .............................9
4.5. CertificateRequest Message .................................9
4.6. CertificateVerify Message .................................10
4.7. ServerKeyExchange Message Signature .......................10
5. Security Considerations ........................................10
6. Acknowledgements ...............................................10
7. References .....................................................11
7.1. Normative References ......................................11
7.2. Informative References ....................................11
1. Introduction
The United States government has posted the Fact Sheet on National
Security Agency (NSA) Suite B Cryptography [NSA], and at the time of
writing, it states:
To complement the existing policy for the use of the Advanced
Encryption Standard (AES) to protect national security systems
and information as specified in The National Policy on the use of
the Advanced Encryption Standard (AES) to Protect National
Security Systems and National Security Information (CNSSP-15),
the National Security Agency (NSA) announced Suite B Cryptography
at the 2005 RSA Conference. In addition to the AES, Suite B
includes cryptographic algorithms for hashing, digital
signatures, and key exchange.
Suite B only specifies the cryptographic algorithms to be
used. Many other factors need to be addressed in determining
whether a particular device implementing a particular set of
Salter, et al. Informational [Page 2]
RFC 5430 Suite B for TLS March 2009
cryptographic algorithms should be used to satisfy a particular
requirement.
Among those factors are "requirements for interoperability both
domestically and internationally".
This document does not define any new cipher suites; instead, it
defines two profiles:
o A Suite B compliant profile for use with TLS version 1.2 [RFC5246]
and the cipher suites defined in [RFC5289]. This profile uses
only Suite B algorithms.
o A transitional profile for use with TLS version 1.0 [RFC2246] or
TLS version 1.1 [RFC4346] and the cipher suites defined in
[RFC4492]. This profile uses the Suite B cryptographic algorithms
to the greatest extent possible and provides backward
compatibility. While the transitional profile is not Suite B
compliant, it provides a transition path towards the Suite B
compliant profile.
2. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
3. Suite B Requirements
The Fact Sheet on Suite B Cryptography requires that key
establishment and authentication algorithms be based on Elliptic
Curve Cryptography, and that the encryption algorithm be AES [AES].
Suite B defines two security levels, of 128 and 192 bits.
In particular, Suite B includes:
Encryption: Advanced Encryption Standard (AES) [AES] --
FIPS 197 (with key sizes of 128 and 256 bits)
Digital Signature: Elliptic Curve Digital Signature Algorithm
(ECDSA) [DSS] - FIPS 186-2 (using the
curves with 256- and 384-bit prime moduli)
Key Exchange: Elliptic Curve Diffie-Hellman (ECDH) - NIST
Special Publication 800-56A [PWKE] (using the
curves with 256- and 384-bit prime moduli)
Salter, et al. Informational [Page 3]
RFC 5430 Suite B for TLS March 2009
The 128-bit security level corresponds to an elliptic curve size of
256 bits and AES-128; it also makes use of SHA-256 [SHS]. The 192-
bit security level corresponds to an elliptic curve size of 384 bits
and AES-256; it also makes use of SHA-384 [SHS].
Note: Some people refer to the two security levels based on the AES
key size that is employed instead of the overall security provided by
the combination of Suite B algorithms. At the 128-bit security
level, an AES key size of 128 bits is used, which does not lead to
any confusion. However, at the 192-bit security level, an AES key
size of 256 bits is used, which sometimes leads to an expectation of
more security than is offered by the combination of Suite B
algorithms.
To accommodate backward compatibility, a Suite B compliant client or
server can be configured to accept a cipher suite that is not part of
Suite B. However, whenever a Suite B compliant client and a Suite B
compliant server establish a TLS version 1.2 session, only Suite B
algorithms are employed.
4. Suite B Compliance and Interoperability Requirements
TLS version 1.1 [RFC4346] and earlier do not support Galois Counter
Mode (GCM) cipher suites [RFC5289]. However, TLS version 1.2
[RFC5246] and later do support GCM. For Suite B TLS compliance, GCM
cipher suites are REQUIRED to be used whenever both the client and
the server support the necessary cipher suites. Also, for Suite B
TLS compliance, Cipher Block Chaining (CBC) cipher suites are
employed when GCM cipher suites cannot be employed.
For a client to implement the Suite B compliant profile, it MUST
implement TLS version 1.2 or later, and the following cipher suite
rules apply:
o A Suite B compliant TLS version 1.2 or later client MUST offer at
least two cipher suites for each supported security level. For
the 128-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MUST be offered in this
order in the ClientHello message. For the 192-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 and
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MUST be offered in this
order in the ClientHello message. One of these cipher suites MUST
be the first (most preferred) cipher suite in the ClientHello
message.
Salter, et al. Informational [Page 4]
RFC 5430 Suite B for TLS March 2009
o A Suite B compliant TLS version 1.2 or later client that offers
backward compatibility with TLS version 1.1 or earlier servers MAY
offer an additional cipher suite for each supported security
level. If these cipher suites are offered, they MUST appear after
the ones discussed above. For the 128-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MAY be offered in the
ClientHello message. For the 192-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MAY be offered in the
ClientHello message.
o A Suite B compliant TLS version 1.2 or later client that offers
interoperability with non-Suite B compliant servers MAY offer
additional cipher suites. If any additional cipher suites are
offered, they MUST appear after the ones discussed above in the
ClientHello message.
For a client to implement the Suite B transitional profile, it MUST
implement TLS version 1.1 or earlier and the following cipher suite
rules apply:
o A Suite B transitional TLS version 1.1 or earlier client MUST
offer the cipher suite for the 128-bit security level, the cipher
suite for the 192-bit security level, or both. For the 128-bit
security level, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MUST be
offered in the ClientHello message. For the 192-bit security
level, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MUST be offered in the
ClientHello message. One of these cipher suites MUST be the first
(most preferred) cipher suite in the ClientHello message.
o A Suite B transitional TLS version 1.1 or earlier client that
offers interoperability with non-Suite B compliant servers MAY
offer additional cipher suites. If any additional cipher suites
are offered, they MUST appear after the ones discussed above in
the ClientHello message.
A Suite B compliant TLS server MUST be configured to support the 128-
bit security level, the 192-bit security level, or both security
levels. The cipher suite rules for each of these security levels is
described below. If a Suite B compliant TLS server is configured to
support both security levels, then the configuration MUST prefer one
security level over the other. In practice, this means that the
cipher suite rules associated with the cipher suites listed in
Section 4.1 for the preferred security level are processed before the
cipher suite rules for the less preferred security level.
Salter, et al. Informational [Page 5]
RFC 5430 Suite B for TLS March 2009
For a server to implement the Suite B conformant profile at the 128-
bit security level, the following cipher suite rules apply:
o A Suite B compliant TLS version 1.2 or later server MUST accept
the TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 cipher suite if it is
offered.
o If the preceding cipher suite is not offered, then a Suite B
compliant TLS version 1.2 or later server MUST accept the
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 cipher suite if it is
offered.
o If neither of the preceding two cipher suites is offered, then a
Suite B compliant TLS version 1.2 or later server that offers
backward compatibility with TLS version 1.1 or earlier clients MAY
accept the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA cipher suite if it
is offered.
o If the server is not offered any of the preceding three cipher
suites and interoperability with clients that are not compliant or
interoperable with Suite B is desired, then the server MAY accept
another offered cipher suite that is considered acceptable by the
server administrator.
For a server to implement the Suite B transitional profile at the
128-bit security level, the following cipher suite rules apply:
o A Suite B transitional TLS version 1.1 or earlier server MUST
accept the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA cipher suite if it
is offered.
o If the server is not offered the preceding cipher suite and
interoperability with clients that are not Suite B transitional is
desired, then the server MAY accept another offered cipher suite
that is considered acceptable by the server administrator.
For a server to implement the Suite B conformant profile at the 192-
bit security level, the following cipher suite rules apply:
o A Suite B compliant TLS version 1.2 or later server MUST accept
the TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 cipher suite if it is
offered.
o If the preceding cipher suite is not offered, then a Suite B
compliant TLS version 1.2 or later server MUST accept the
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 cipher suite if it is
offered.
Salter, et al. Informational [Page 6]
RFC 5430 Suite B for TLS March 2009
o If neither of the preceding two cipher suites is offered, then a
Suite B compliant TLS version 1.2 or later server that offers
backward compatibility with TLS version 1.1 or earlier clients MAY
accept the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA cipher suite if it
is offered.
o If the server is not offered any of the preceding three cipher
suites and interoperability with clients that are not compliant or
interoperable with Suite B is desired, then the server MAY accept
another offered cipher suite that is considered acceptable by the
server administrator.
For a server to implement the Suite B transitional profile at the
192-bit security level, the following cipher suite rules apply:
o A Suite B transitional TLS version 1.1 or earlier server MUST
accept the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA cipher suite if it
is offered.
o If the server is not offered the preceding cipher suite and
interoperability with clients that are not Suite B transitional is
desired, then the server MAY accept another offered cipher suite
that is considered acceptable by the server administrator.
Note that these rules explicitly permit the use of CBC cipher suites
in TLS version 1.2 connections in order to permit operation between
Suite B compliant and non-Suite B compliant implementations. For
instance, a Suite B compliant TLS version 1.2 client might offer TLS
version 1.2 with both GCM and CBC cipher suites when communicating
with a non-Suite B TLS version 1.2 server, which then selected the
CBC cipher suites. This connection would nevertheless meet the
requirements of this specification. However, any two Suite B
compliant implementations will negotiate a GCM cipher suite when
doing TLS version 1.2.
4.1. Security Levels
As described in Section 1, Suite B specifies two security levels:
128-bit and 192-bit. The following table lists the cipher suites for
each security level. Within each security level, the cipher suites
are listed in their preferred order for selection by a TLS version
1.2 implementation.
Salter, et al. Informational [Page 7]
RFC 5430 Suite B for TLS March 2009
+-----------------------------------------+----------------+
| Cipher Suite | Security Level |
+-----------------------------------------+----------------+
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | 128 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | 128 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | 128 |
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | 192 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | 192 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | 192 |
+-----------------------------------------+----------------+
4.2. Acceptable Curves
RFC 4492 defines a variety of elliptic curves. For cipher suites
defined in this specification, only secp256r1(23) or secp384r1(24)
may be used. These are the same curves that appear in FIPS 186-2
[DSS] as P-256 and P-384, respectively. For cipher suites at the
128-bit security level, secp256r1 MUST be used. For cipher suites at
the 192-bit security level, secp384r1 MUST be used. RFC 4492
requires that the uncompressed(0) form be supported. The
ansiX962_compressed_prime(1) point formats MAY also be supported.
Clients desiring to negotiate only a Suite B compliant connection
MUST generate a "Supported Elliptic Curves Extension" containing only
the allowed curves. These curves MUST match the cipher suite
security levels being offered. Clients that are willing to do both
Suite B compliant and non-Suite B compliant connections MAY omit the
extension or send the extension but offer other curves as well as the
appropriate Suite B ones.
Servers desiring to negotiate a Suite B compliant connection SHOULD
check for the presence of the extension, but MUST NOT negotiate
inappropriate curves even if they are offered by the client. This
allows a client that is willing to do either Suite B compliant or
non-Suite B compliant modes to interoperate with a server that will
only do Suite B compliant modes. If the client does not advertise an
acceptable curve, the server MUST generate a fatal
"handshake_failure" alert and terminate the connection. Clients MUST
check the chosen curve to make sure it is acceptable.
4.3. Certificates
Server and client certificates used to establish a Suite B compliant
connection MUST be signed with ECDSA. Digital signatures MUST be
calculated using either the P-256 curve along with the SHA-256 hash
algorithm or calculated using the P-384 curve along with the SHA-384
hash algorithm. For certificates used at the 128-bit security level,
the subject public key MUST use the P-256 curve and be signed with
Salter, et al. Informational [Page 8]
RFC 5430 Suite B for TLS March 2009
either the P-384 curve or the P-256 curve. For certificates used at
the 192-bit security level, the subject public key MUST use the P-384
curve and be signed with the P-384 curve.
In TLS version 1.0 and TLS version 1.1, the key exchange algorithm
used in the TLS_ECDHE_ECDSA-collection of cipher suites requires the
server's certificate to be signed with a particular signature scheme.
TLS version 1.2 offers more flexibility. This specification does not
impose any additional restrictions on the server certificate
signature or the signature schemes used elsewhere in the
certification path. (Often such restrictions will be useful, and it
is expected that this will be taken into account in practices of
certification authorities. However, such restrictions are not
strictly required, even if it is beyond the capabilities of a client
to completely validate a given certification path, the client may be
able to validate the server's certificate by relying on a trusted
certification authority whose certificate appears as one of the
intermediate certificates in the certification path.)
Likewise, this specification does not impose restrictions on
signature schemes used in the certification path for the client's
certificate when mutual authentication is employed.
4.4. signature_algorithms Extension
The signature_algorithms extension is defined in Section 7.4.1.4.1 of
TLS version 1.2 [RFC5246]. A Suite B compliant TLS version 1.2 or
later client MUST include the signature_algorithms extension. For
the 128-bit security level, SHA-256 with ECDSA MUST be offered in the
signature_algorithms extension. For the 192-bit security level, SHA-
384 with ECDSA MUST be offered in the signature_algorithms extension.
Other offerings MAY be included to indicate the signature algorithms
that are acceptable in cipher suites that are offered for
interoperability with servers that are not compliant with Suite B and
to indicate the signature algorithms that are acceptable for
certification path validation.
4.5. CertificateRequest Message
A Suite B compliant TLS version 1.2 or later server MUST include SHA-
256 with ECDSA and/or SHA-384 with ECDSA in the
supported_signature_algorithms field of the CertificateRequest
message. For the 128-bit security level, SHA-256 with ECDSA MUST
appear in the supported_signature_algorithms field. For the 192-bit
security level, SHA-384 with ECDSA MUST appear in the
supported_signature_algorithms field.
Salter, et al. Informational [Page 9]
RFC 5430 Suite B for TLS March 2009
4.6. CertificateVerify Message
A Suite B compliant TLS version 1.2 or later client MUST use SHA-256
with ECDSA or SHA-384 with ECDSA for the signature in the
CertificateVerify message. For the 128-bit security level, SHA-256
with ECDSA MUST be used. For the 192-bit security level, SHA-384
with ECDSA MUST be used.
4.7. ServerKeyExchange Message Signature
In the TLS_ECDHE_ECDSA-collection of cipher suites, the server sends
its ephemeral ECDH public key and a specification of the
corresponding curve in the ServerKeyExchange message. These
parameters MUST be signed with ECDSA using the private key
corresponding to the public key in the server's certificate.
A TLS version 1.1 or earlier server MUST sign the ServerKeyExchange
message using SHA-1 with ECDSA.
A Suite B compliant TLS version 1.2 or later server MUST sign the
ServerKeyExchange message using either SHA-256 with ECDSA or SHA-384
with ECDSA. For the 128-bit security level, SHA-256 with ECDSA MUST
be used. For the 192-bit security level, SHA-384 with ECDSA MUST be
used.
5. Security Considerations
Most of the security considerations for this document are described
in "The Transport Layer Security (TLS) Protocol Version 1.2"
[RFC5246], "Elliptic Curve Cryptography (ECC) Cipher Suites for
Transport Layer Security (TLS)" [RFC4492], "AES Galois Counter Mode
(GCM) Cipher Suites for TLS" [RFC5288], and "TLS Elliptic Curve
Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM)"
[RFC5289]. Readers should consult those documents.
In order to meet the goal of a consistent security level for the
entire cipher suite, in Suite B mode TLS implementations MUST ONLY
use the curves defined in Section 4.2. Otherwise, it is possible to
have a set of symmetric algorithms with much weaker or stronger
security properties than the asymmetric (ECC) algorithms.
6. Acknowledgements
Thanks to Pasi Eronen, Steve Hanna, and Paul Hoffman for their
review, comments, and insightful suggestions.
This work was supported by the US Department of Defense.
Salter, et al. Informational [Page 10]
RFC 5430 Suite B for TLS March 2009
7. References
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.
Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites
for Transport Layer Security (TLS)", RFC 4492, May 2006.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008.
[RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA-
256/384 and AES Galois Counter Mode (GCM)", RFC 5289,
August 2008.
[AES] National Institute of Standards and Technology,
"Specification for the Advanced Encryption Standard
(AES)", FIPS 197, November 2001.
[DSS] National Institute of Standards and Technology, "Digital
Signature Standard", FIPS 186-2, January 2000.
[PWKE] National Institute of Standards and Technology,
"Recommendation for Pair-Wise Key Establishment Schemes
Using Discrete Logarithm Cryptography (Revised)", NIST
Special Publication 800-56A, March 2007.
[SHS] National Institute of Standards and Technology, "Secure
Hash Standard", FIPS 180-2, August 2002.
7.2. Informative References
[RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
RFC 2246, January 1999.
[RFC4346] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.1", RFC 4346, April 2006.
[RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois
Counter Mode (GCM) Cipher Suites for TLS", RFC 5288,
August 2008.
[NSA] National Security Agency, "Fact Sheet NSA Suite B
Cryptography",
.
Salter, et al. Informational [Page 11]
RFC 5430 Suite B for TLS March 2009
Authors' Addresses
Margaret Salter
National Security Agency
9800 Savage Rd.
Fort Meade 20755-6709
USA
EMail: msalter@restarea.ncsc.mil
Eric Rescorla
Network Resonance
2064 Edgewood Drive
Palo Alto 94303
USA
EMail: ekr@rtfm.com
Russ Housley
Vigil Security
918 Spring Knoll Drive
Herndon 21070
USA
EMail: housley@vigilsec.com
Salter, et al. Informational [Page 12]
Request for Comments: 5430 National Security Agency
Category: Informational E. Rescorla
Network Resonance
R. Housley
Vigil Security
March 2009
Suite B Profile for Transport Layer Security (TLS)
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Salter, et al. Informational [Page 1]
RFC 5430 Suite B for TLS March 2009
Abstract
The United States government has published guidelines for "NSA Suite
B Cryptography", which defines cryptographic algorithm policy for
national security applications. This document defines a profile of
Transport Layer Security (TLS) version 1.2 that is fully conformant
with Suite B. This document also defines a transitional profile for
use with TLS version 1.0 and TLS version 1.1 which employs Suite B
algorithms to the greatest extent possible.
Table of Contents
1. Introduction ....................................................2
2. Conventions Used in This Document ...............................3
3. Suite B Requirements ............................................3
4. Suite B Compliance and Interoperability Requirements ............4
4.1. Security Levels ............................................7
4.2. Acceptable Curves ..........................................8
4.3. Certificates ...............................................8
4.4. signature_algorithms Extension .............................9
4.5. CertificateRequest Message .................................9
4.6. CertificateVerify Message .................................10
4.7. ServerKeyExchange Message Signature .......................10
5. Security Considerations ........................................10
6. Acknowledgements ...............................................10
7. References .....................................................11
7.1. Normative References ......................................11
7.2. Informative References ....................................11
1. Introduction
The United States government has posted the Fact Sheet on National
Security Agency (NSA) Suite B Cryptography [NSA], and at the time of
writing, it states:
To complement the existing policy for the use of the Advanced
Encryption Standard (AES) to protect national security systems
and information as specified in The National Policy on the use of
the Advanced Encryption Standard (AES) to Protect National
Security Systems and National Security Information (CNSSP-15),
the National Security Agency (NSA) announced Suite B Cryptography
at the 2005 RSA Conference. In addition to the AES, Suite B
includes cryptographic algorithms for hashing, digital
signatures, and key exchange.
Suite B only specifies the cryptographic algorithms to be
used. Many other factors need to be addressed in determining
whether a particular device implementing a particular set of
Salter, et al. Informational [Page 2]
RFC 5430 Suite B for TLS March 2009
cryptographic algorithms should be used to satisfy a particular
requirement.
Among those factors are "requirements for interoperability both
domestically and internationally".
This document does not define any new cipher suites; instead, it
defines two profiles:
o A Suite B compliant profile for use with TLS version 1.2 [RFC5246]
and the cipher suites defined in [RFC5289]. This profile uses
only Suite B algorithms.
o A transitional profile for use with TLS version 1.0 [RFC2246] or
TLS version 1.1 [RFC4346] and the cipher suites defined in
[RFC4492]. This profile uses the Suite B cryptographic algorithms
to the greatest extent possible and provides backward
compatibility. While the transitional profile is not Suite B
compliant, it provides a transition path towards the Suite B
compliant profile.
2. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
3. Suite B Requirements
The Fact Sheet on Suite B Cryptography requires that key
establishment and authentication algorithms be based on Elliptic
Curve Cryptography, and that the encryption algorithm be AES [AES].
Suite B defines two security levels, of 128 and 192 bits.
In particular, Suite B includes:
Encryption: Advanced Encryption Standard (AES) [AES] --
FIPS 197 (with key sizes of 128 and 256 bits)
Digital Signature: Elliptic Curve Digital Signature Algorithm
(ECDSA) [DSS] - FIPS 186-2 (using the
curves with 256- and 384-bit prime moduli)
Key Exchange: Elliptic Curve Diffie-Hellman (ECDH) - NIST
Special Publication 800-56A [PWKE] (using the
curves with 256- and 384-bit prime moduli)
Salter, et al. Informational [Page 3]
RFC 5430 Suite B for TLS March 2009
The 128-bit security level corresponds to an elliptic curve size of
256 bits and AES-128; it also makes use of SHA-256 [SHS]. The 192-
bit security level corresponds to an elliptic curve size of 384 bits
and AES-256; it also makes use of SHA-384 [SHS].
Note: Some people refer to the two security levels based on the AES
key size that is employed instead of the overall security provided by
the combination of Suite B algorithms. At the 128-bit security
level, an AES key size of 128 bits is used, which does not lead to
any confusion. However, at the 192-bit security level, an AES key
size of 256 bits is used, which sometimes leads to an expectation of
more security than is offered by the combination of Suite B
algorithms.
To accommodate backward compatibility, a Suite B compliant client or
server can be configured to accept a cipher suite that is not part of
Suite B. However, whenever a Suite B compliant client and a Suite B
compliant server establish a TLS version 1.2 session, only Suite B
algorithms are employed.
4. Suite B Compliance and Interoperability Requirements
TLS version 1.1 [RFC4346] and earlier do not support Galois Counter
Mode (GCM) cipher suites [RFC5289]. However, TLS version 1.2
[RFC5246] and later do support GCM. For Suite B TLS compliance, GCM
cipher suites are REQUIRED to be used whenever both the client and
the server support the necessary cipher suites. Also, for Suite B
TLS compliance, Cipher Block Chaining (CBC) cipher suites are
employed when GCM cipher suites cannot be employed.
For a client to implement the Suite B compliant profile, it MUST
implement TLS version 1.2 or later, and the following cipher suite
rules apply:
o A Suite B compliant TLS version 1.2 or later client MUST offer at
least two cipher suites for each supported security level. For
the 128-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MUST be offered in this
order in the ClientHello message. For the 192-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 and
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MUST be offered in this
order in the ClientHello message. One of these cipher suites MUST
be the first (most preferred) cipher suite in the ClientHello
message.
Salter, et al. Informational [Page 4]
RFC 5430 Suite B for TLS March 2009
o A Suite B compliant TLS version 1.2 or later client that offers
backward compatibility with TLS version 1.1 or earlier servers MAY
offer an additional cipher suite for each supported security
level. If these cipher suites are offered, they MUST appear after
the ones discussed above. For the 128-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MAY be offered in the
ClientHello message. For the 192-bit security level,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MAY be offered in the
ClientHello message.
o A Suite B compliant TLS version 1.2 or later client that offers
interoperability with non-Suite B compliant servers MAY offer
additional cipher suites. If any additional cipher suites are
offered, they MUST appear after the ones discussed above in the
ClientHello message.
For a client to implement the Suite B transitional profile, it MUST
implement TLS version 1.1 or earlier and the following cipher suite
rules apply:
o A Suite B transitional TLS version 1.1 or earlier client MUST
offer the cipher suite for the 128-bit security level, the cipher
suite for the 192-bit security level, or both. For the 128-bit
security level, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MUST be
offered in the ClientHello message. For the 192-bit security
level, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MUST be offered in the
ClientHello message. One of these cipher suites MUST be the first
(most preferred) cipher suite in the ClientHello message.
o A Suite B transitional TLS version 1.1 or earlier client that
offers interoperability with non-Suite B compliant servers MAY
offer additional cipher suites. If any additional cipher suites
are offered, they MUST appear after the ones discussed above in
the ClientHello message.
A Suite B compliant TLS server MUST be configured to support the 128-
bit security level, the 192-bit security level, or both security
levels. The cipher suite rules for each of these security levels is
described below. If a Suite B compliant TLS server is configured to
support both security levels, then the configuration MUST prefer one
security level over the other. In practice, this means that the
cipher suite rules associated with the cipher suites listed in
Section 4.1 for the preferred security level are processed before the
cipher suite rules for the less preferred security level.
Salter, et al. Informational [Page 5]
RFC 5430 Suite B for TLS March 2009
For a server to implement the Suite B conformant profile at the 128-
bit security level, the following cipher suite rules apply:
o A Suite B compliant TLS version 1.2 or later server MUST accept
the TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 cipher suite if it is
offered.
o If the preceding cipher suite is not offered, then a Suite B
compliant TLS version 1.2 or later server MUST accept the
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 cipher suite if it is
offered.
o If neither of the preceding two cipher suites is offered, then a
Suite B compliant TLS version 1.2 or later server that offers
backward compatibility with TLS version 1.1 or earlier clients MAY
accept the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA cipher suite if it
is offered.
o If the server is not offered any of the preceding three cipher
suites and interoperability with clients that are not compliant or
interoperable with Suite B is desired, then the server MAY accept
another offered cipher suite that is considered acceptable by the
server administrator.
For a server to implement the Suite B transitional profile at the
128-bit security level, the following cipher suite rules apply:
o A Suite B transitional TLS version 1.1 or earlier server MUST
accept the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA cipher suite if it
is offered.
o If the server is not offered the preceding cipher suite and
interoperability with clients that are not Suite B transitional is
desired, then the server MAY accept another offered cipher suite
that is considered acceptable by the server administrator.
For a server to implement the Suite B conformant profile at the 192-
bit security level, the following cipher suite rules apply:
o A Suite B compliant TLS version 1.2 or later server MUST accept
the TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 cipher suite if it is
offered.
o If the preceding cipher suite is not offered, then a Suite B
compliant TLS version 1.2 or later server MUST accept the
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 cipher suite if it is
offered.
Salter, et al. Informational [Page 6]
RFC 5430 Suite B for TLS March 2009
o If neither of the preceding two cipher suites is offered, then a
Suite B compliant TLS version 1.2 or later server that offers
backward compatibility with TLS version 1.1 or earlier clients MAY
accept the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA cipher suite if it
is offered.
o If the server is not offered any of the preceding three cipher
suites and interoperability with clients that are not compliant or
interoperable with Suite B is desired, then the server MAY accept
another offered cipher suite that is considered acceptable by the
server administrator.
For a server to implement the Suite B transitional profile at the
192-bit security level, the following cipher suite rules apply:
o A Suite B transitional TLS version 1.1 or earlier server MUST
accept the TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA cipher suite if it
is offered.
o If the server is not offered the preceding cipher suite and
interoperability with clients that are not Suite B transitional is
desired, then the server MAY accept another offered cipher suite
that is considered acceptable by the server administrator.
Note that these rules explicitly permit the use of CBC cipher suites
in TLS version 1.2 connections in order to permit operation between
Suite B compliant and non-Suite B compliant implementations. For
instance, a Suite B compliant TLS version 1.2 client might offer TLS
version 1.2 with both GCM and CBC cipher suites when communicating
with a non-Suite B TLS version 1.2 server, which then selected the
CBC cipher suites. This connection would nevertheless meet the
requirements of this specification. However, any two Suite B
compliant implementations will negotiate a GCM cipher suite when
doing TLS version 1.2.
4.1. Security Levels
As described in Section 1, Suite B specifies two security levels:
128-bit and 192-bit. The following table lists the cipher suites for
each security level. Within each security level, the cipher suites
are listed in their preferred order for selection by a TLS version
1.2 implementation.
Salter, et al. Informational [Page 7]
RFC 5430 Suite B for TLS March 2009
+-----------------------------------------+----------------+
| Cipher Suite | Security Level |
+-----------------------------------------+----------------+
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | 128 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | 128 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | 128 |
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | 192 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | 192 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | 192 |
+-----------------------------------------+----------------+
4.2. Acceptable Curves
RFC 4492 defines a variety of elliptic curves. For cipher suites
defined in this specification, only secp256r1(23) or secp384r1(24)
may be used. These are the same curves that appear in FIPS 186-2
[DSS] as P-256 and P-384, respectively. For cipher suites at the
128-bit security level, secp256r1 MUST be used. For cipher suites at
the 192-bit security level, secp384r1 MUST be used. RFC 4492
requires that the uncompressed(0) form be supported. The
ansiX962_compressed_prime(1) point formats MAY also be supported.
Clients desiring to negotiate only a Suite B compliant connection
MUST generate a "Supported Elliptic Curves Extension" containing only
the allowed curves. These curves MUST match the cipher suite
security levels being offered. Clients that are willing to do both
Suite B compliant and non-Suite B compliant connections MAY omit the
extension or send the extension but offer other curves as well as the
appropriate Suite B ones.
Servers desiring to negotiate a Suite B compliant connection SHOULD
check for the presence of the extension, but MUST NOT negotiate
inappropriate curves even if they are offered by the client. This
allows a client that is willing to do either Suite B compliant or
non-Suite B compliant modes to interoperate with a server that will
only do Suite B compliant modes. If the client does not advertise an
acceptable curve, the server MUST generate a fatal
"handshake_failure" alert and terminate the connection. Clients MUST
check the chosen curve to make sure it is acceptable.
4.3. Certificates
Server and client certificates used to establish a Suite B compliant
connection MUST be signed with ECDSA. Digital signatures MUST be
calculated using either the P-256 curve along with the SHA-256 hash
algorithm or calculated using the P-384 curve along with the SHA-384
hash algorithm. For certificates used at the 128-bit security level,
the subject public key MUST use the P-256 curve and be signed with
Salter, et al. Informational [Page 8]
RFC 5430 Suite B for TLS March 2009
either the P-384 curve or the P-256 curve. For certificates used at
the 192-bit security level, the subject public key MUST use the P-384
curve and be signed with the P-384 curve.
In TLS version 1.0 and TLS version 1.1, the key exchange algorithm
used in the TLS_ECDHE_ECDSA-collection of cipher suites requires the
server's certificate to be signed with a particular signature scheme.
TLS version 1.2 offers more flexibility. This specification does not
impose any additional restrictions on the server certificate
signature or the signature schemes used elsewhere in the
certification path. (Often such restrictions will be useful, and it
is expected that this will be taken into account in practices of
certification authorities. However, such restrictions are not
strictly required, even if it is beyond the capabilities of a client
to completely validate a given certification path, the client may be
able to validate the server's certificate by relying on a trusted
certification authority whose certificate appears as one of the
intermediate certificates in the certification path.)
Likewise, this specification does not impose restrictions on
signature schemes used in the certification path for the client's
certificate when mutual authentication is employed.
4.4. signature_algorithms Extension
The signature_algorithms extension is defined in Section 7.4.1.4.1 of
TLS version 1.2 [RFC5246]. A Suite B compliant TLS version 1.2 or
later client MUST include the signature_algorithms extension. For
the 128-bit security level, SHA-256 with ECDSA MUST be offered in the
signature_algorithms extension. For the 192-bit security level, SHA-
384 with ECDSA MUST be offered in the signature_algorithms extension.
Other offerings MAY be included to indicate the signature algorithms
that are acceptable in cipher suites that are offered for
interoperability with servers that are not compliant with Suite B and
to indicate the signature algorithms that are acceptable for
certification path validation.
4.5. CertificateRequest Message
A Suite B compliant TLS version 1.2 or later server MUST include SHA-
256 with ECDSA and/or SHA-384 with ECDSA in the
supported_signature_algorithms field of the CertificateRequest
message. For the 128-bit security level, SHA-256 with ECDSA MUST
appear in the supported_signature_algorithms field. For the 192-bit
security level, SHA-384 with ECDSA MUST appear in the
supported_signature_algorithms field.
Salter, et al. Informational [Page 9]
RFC 5430 Suite B for TLS March 2009
4.6. CertificateVerify Message
A Suite B compliant TLS version 1.2 or later client MUST use SHA-256
with ECDSA or SHA-384 with ECDSA for the signature in the
CertificateVerify message. For the 128-bit security level, SHA-256
with ECDSA MUST be used. For the 192-bit security level, SHA-384
with ECDSA MUST be used.
4.7. ServerKeyExchange Message Signature
In the TLS_ECDHE_ECDSA-collection of cipher suites, the server sends
its ephemeral ECDH public key and a specification of the
corresponding curve in the ServerKeyExchange message. These
parameters MUST be signed with ECDSA using the private key
corresponding to the public key in the server's certificate.
A TLS version 1.1 or earlier server MUST sign the ServerKeyExchange
message using SHA-1 with ECDSA.
A Suite B compliant TLS version 1.2 or later server MUST sign the
ServerKeyExchange message using either SHA-256 with ECDSA or SHA-384
with ECDSA. For the 128-bit security level, SHA-256 with ECDSA MUST
be used. For the 192-bit security level, SHA-384 with ECDSA MUST be
used.
5. Security Considerations
Most of the security considerations for this document are described
in "The Transport Layer Security (TLS) Protocol Version 1.2"
[RFC5246], "Elliptic Curve Cryptography (ECC) Cipher Suites for
Transport Layer Security (TLS)" [RFC4492], "AES Galois Counter Mode
(GCM) Cipher Suites for TLS" [RFC5288], and "TLS Elliptic Curve
Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM)"
[RFC5289]. Readers should consult those documents.
In order to meet the goal of a consistent security level for the
entire cipher suite, in Suite B mode TLS implementations MUST ONLY
use the curves defined in Section 4.2. Otherwise, it is possible to
have a set of symmetric algorithms with much weaker or stronger
security properties than the asymmetric (ECC) algorithms.
6. Acknowledgements
Thanks to Pasi Eronen, Steve Hanna, and Paul Hoffman for their
review, comments, and insightful suggestions.
This work was supported by the US Department of Defense.
Salter, et al. Informational [Page 10]
RFC 5430 Suite B for TLS March 2009
7. References
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.
Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites
for Transport Layer Security (TLS)", RFC 4492, May 2006.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008.
[RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA-
256/384 and AES Galois Counter Mode (GCM)", RFC 5289,
August 2008.
[AES] National Institute of Standards and Technology,
"Specification for the Advanced Encryption Standard
(AES)", FIPS 197, November 2001.
[DSS] National Institute of Standards and Technology, "Digital
Signature Standard", FIPS 186-2, January 2000.
[PWKE] National Institute of Standards and Technology,
"Recommendation for Pair-Wise Key Establishment Schemes
Using Discrete Logarithm Cryptography (Revised)", NIST
Special Publication 800-56A, March 2007.
[SHS] National Institute of Standards and Technology, "Secure
Hash Standard", FIPS 180-2, August 2002.
7.2. Informative References
[RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
RFC 2246, January 1999.
[RFC4346] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.1", RFC 4346, April 2006.
[RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois
Counter Mode (GCM) Cipher Suites for TLS", RFC 5288,
August 2008.
[NSA] National Security Agency, "Fact Sheet NSA Suite B
Cryptography",
Salter, et al. Informational [Page 11]
RFC 5430 Suite B for TLS March 2009
Authors' Addresses
Margaret Salter
National Security Agency
9800 Savage Rd.
Fort Meade 20755-6709
USA
EMail: msalter@restarea.ncsc.mil
Eric Rescorla
Network Resonance
2064 Edgewood Drive
Palo Alto 94303
USA
EMail: ekr@rtfm.com
Russ Housley
Vigil Security
918 Spring Knoll Drive
Herndon 21070
USA
EMail: housley@vigilsec.com
Salter, et al. Informational [Page 12]
Subscribe to:
Posts (Atom)