Extend RFC-7427 Signature Authentication support to IKEv2 with ECDSA: Difference between revisions

From Libreswan
Jump to navigation Jump to search
No edit summary
No edit summary
 
(33 intermediate revisions by the same user not shown)
Line 4: Line 4:
As part of Google summer of Code work in 2017 described in , RFC-7427 Digital Signature Authentication was implemented with support for RSA. This work is an extension to support ECDSA. Implementation of ECDSA requires the modification of the existing Libreswan public key code to fix  the RSA only parts so that it is able to accept different new types of keys in the future ( not just limited to ECDSA ). This will ensure compliance to RFC-7427 and RFC-8247.
As part of Google summer of Code work in 2017 described in , RFC-7427 Digital Signature Authentication was implemented with support for RSA. This work is an extension to support ECDSA. Implementation of ECDSA requires the modification of the existing Libreswan public key code to fix  the RSA only parts so that it is able to accept different new types of keys in the future ( not just limited to ECDSA ). This will ensure compliance to RFC-7427 and RFC-8247.


As per RFC-4754, ECDSA signatures are smaller than RSA signatures of similar cryptographic strength.
ECDSA public keys (and certificates) are smaller than similar strength DSA keys, resulting in improved communications efficiency. 
Furthermore, on many platforms, ECDSA operations can be computed more quickly than similar strength RSA or DSA operations for a security analysis of key sizes across public key algorithms.


== Implementation  ==
== Implementation  ==
   
   
To make Libreswan RFC 7427 compliant, the following items have been implemented :
To make Libreswan RFC 7427 and RFC 8247 compliant, the following items have been implemented :


1.  Hash Algorithm Notification
1.  Fixing the RSA only public key code


Notify payload of type SIGNATURE_HASH_ALGORITHMS is sent inside the IKE_SA_INIT exchange.
Major code changes were done in ikev2_keys.c , x509.c and secrets.c. New structures are defined for Private and public ECDSA key parameters.
The supported hash algorithms like SHA1, SHA2 and IDENTITY are exchanged by the initiator and responder in this notify payload. The negotiated hash algorithm is the one that is supported by both parties. This hash algorithm is used to generate the signature sent in the Authentication payload. The decision of sending the Hash Algorithm notification when Libreswan is the initiator is based on checking which Signature algorithm is configured in the "authby" parameter in ipsec.conf. When Libreswan is the responder, it responds with a hash algorithm notification only if it has received one and SHA-1 was sent in it.
Most functions that had a specific check for rsa are now able to also handle ecdsa as public key algorithm. This involves checking if a certificate is of type ecdsa and extracting the public key from it and storing it in the NSS Database. Code changes are made to obtain the keyid and ckaid of the ECDSA public keys. These IDs are used to retrieve the public key from pluto secrets and extract the private key from the certificate respectively. New public key algorithm and policy , PUBKEY_ALG_ECDSA and POLICY_ECDSA are introduced respectively.


2. Authentication payload
2. Signature Verification


A new Authentication Method called ''Digital Signature'' is sent in the IKE_AUTH message exchange. Earlier, the Authentication Data field inside the Authentication payload contained only the signature value. Now, the signature value is prefixed with an ASN.1 object indicating the algorithm used to generate the signature. The ASN.1 object contains the algorithm identification OID, which identifies both the signature algorithm and the hash algorithm used for calculating the signature. [https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-12 IANA registry] specifies the values to be used. The initial Digital Signature Authentication method implementation for Libreswan only includes support for the RSA with SHA-1 hash algorithm.
To verify a signature from the peer, the public key of the peer has to be retrieved from pluto_pubkeys and check if the keyed matches.
Inorder to verify the hash received by the peer, we also compute our own hash using the PRF(SK_d,ID[ir]). The computed hash, received Signature and the retrieved Public are then used by NSS API : ECDSA_VerifyDigest to verify the Signature. The ECDSA Signature is DER encoded and is as follows :


The following items are not yet implemented :
Ecdsa-Sig-Value  ::=  SEQUENCE  {
          r    INTEGER,
          s    INTEGER
  }


* Support for Signature Algorithms ECDSA and RSASSA-PSS
Therefore before using the ECDSA_VerifyDigest API, the Signature must be DER decoded to obtain the integers r and s. EC_FillParams is used to fill the ecParams of the public key.
* Support for Hash Algorithm SHA-2


3. Test Suite changes
3. Signature generation


The Test Suite was extended by adding test cases to verify feature functionality and perform interoperability tests. Negative tests cases were added using impairments that emulate clients that do not support the Digital Signature Authentication scheme as specified by the RFC 7427, to confirm connectivity with clients not supporting the new Authentication Method.
Private key is retrieved using the API PK11_FindKeyByKeyID or PK11_FindKeyByAnyCert through the CKAID.
Signature generation is performed by using the PK11_Sign API
 
4. Test Suite changes
 
The Test Suite was extended by adding test cases to verify feature functionality and perform interoperability tests with strong swan.
 
== Configuring ECDSA in Libreswan  ==
 
Support for configuring  authby=ecdsa
 
Possible options for setting ecdsa as the public key to be used for Digital Signature Authentication with appropriate SHA2 hash algorithm are as follows :
 
authby = ecdsa/ecdsa-sha2_256, ecdsa-sha2_384, ecdsa-sha2_512


== Issues encountered ==
== Issues encountered ==
[https://datatracker.ietf.org/doc/draft-ietf-ipsecme-rfc4307bis/ The RFC 4307bis] mandates the usage of RSASSA-PSS along with Digital Signature Authentication. However the older flavour PKCS v1.5 may still be supported. But a way to indicate to the peer, which flavour of RSA should be used is not yet described. Since no other client supports RSASSA-PSS, interoperability tests cannot be performed.
NSS looks for specific x509v3 certificate extensions in the end certificates and It is unclear which one is exactly missing in the certificates being used.
This error has be be debugged further (as there is little information from the nss logs):
SECERR: 35 (0x23): Certificate extension not found.
It was found that this error was set and not cleared by NSS.
It was solved by checking for errors only when private key retrieved was not equal to NULL.


== Future work ==
== Future work ==
* Support for Signature algorithms ECDSA and RSASSA-PSS
Implementation of ECDSA requires the extension of the Libreswan's public key code to remove the hardwiring for RSA. Implementation of RSASSA-PSS would have to use different NSS library method call. The implementation is waiting for [https://datatracker.ietf.org/doc/draft-ietf-ipsecme-rfc4307bis/ RFC 4307bis] to clarify the usage of PSS.


* Support for Hash algorithm SHA-2.
Interoperability with Apple and Elvis Plus
SHA2 needs an extended parser for the authby = keyword, in ipsec.conf.


== Source code ==
== Source code ==


[https://github.com/libreswan/libreswan/commit/14c76638612226ab87f8fe14cb8b94282f729651 Feature implementation]
https://github.com/libreswan/libreswan/commit/12f2f1a03de214e1e3ecf5cfa84950f09a8d35c4
 
https://github.com/libreswan/libreswan/commit/c6a711c091974b323feb61b3ea5c86713b80ea63


[https://github.com/libreswan/libreswan/commit/272301a82178ea1a2c8afd39f26e2e024ef21853 Addition and modification of test cases]


This project work was sponsored by Google as part of the Google Summer of Code 2017 Program.
This project work was sponsored by Google as part of the Google Summer of Code 2018 Program.
The implementation for this project is done by Sahana Prasad (sahana.prasad07@gmail.com) under the tutelage of Paul Wouters.
The implementation for this project is done by Sahana Prasad (sahana.prasad07@gmail.com) under the tutelage of Paul Wouters and Andrew Cagney


[[ Use Cases and Requirements document for ECC/ECDSA support ]]
== Additional Work during GSoC 2018==
Implementation of RSA-PSS and support for SHA2 and it's variants. The work was started before GSoC 2018 but was fully completed and tested during the GSoC 2018 period.
Work is described in this project page [[RSA-PSS Support in compliance with RFC 7427 and RFC 8247]].

Latest revision as of 13:19, 11 February 2019

Introduction

As part of Google summer of Code work in 2017 described in , RFC-7427 Digital Signature Authentication was implemented with support for RSA. This work is an extension to support ECDSA. Implementation of ECDSA requires the modification of the existing Libreswan public key code to fix the RSA only parts so that it is able to accept different new types of keys in the future ( not just limited to ECDSA ). This will ensure compliance to RFC-7427 and RFC-8247.

As per RFC-4754, ECDSA signatures are smaller than RSA signatures of similar cryptographic strength. ECDSA public keys (and certificates) are smaller than similar strength DSA keys, resulting in improved communications efficiency. Furthermore, on many platforms, ECDSA operations can be computed more quickly than similar strength RSA or DSA operations for a security analysis of key sizes across public key algorithms.

Implementation

To make Libreswan RFC 7427 and RFC 8247 compliant, the following items have been implemented :

1. Fixing the RSA only public key code

Major code changes were done in ikev2_keys.c , x509.c and secrets.c. New structures are defined for Private and public ECDSA key parameters. Most functions that had a specific check for rsa are now able to also handle ecdsa as public key algorithm. This involves checking if a certificate is of type ecdsa and extracting the public key from it and storing it in the NSS Database. Code changes are made to obtain the keyid and ckaid of the ECDSA public keys. These IDs are used to retrieve the public key from pluto secrets and extract the private key from the certificate respectively. New public key algorithm and policy , PUBKEY_ALG_ECDSA and POLICY_ECDSA are introduced respectively.

2. Signature Verification

To verify a signature from the peer, the public key of the peer has to be retrieved from pluto_pubkeys and check if the keyed matches. Inorder to verify the hash received by the peer, we also compute our own hash using the PRF(SK_d,ID[ir]). The computed hash, received Signature and the retrieved Public are then used by NSS API : ECDSA_VerifyDigest to verify the Signature. The ECDSA Signature is DER encoded and is as follows :

Ecdsa-Sig-Value  ::= SEQUENCE { 

          r     INTEGER,
          s     INTEGER
 }

Therefore before using the ECDSA_VerifyDigest API, the Signature must be DER decoded to obtain the integers r and s. EC_FillParams is used to fill the ecParams of the public key.

3. Signature generation

Private key is retrieved using the API PK11_FindKeyByKeyID or PK11_FindKeyByAnyCert through the CKAID. Signature generation is performed by using the PK11_Sign API

4. Test Suite changes

The Test Suite was extended by adding test cases to verify feature functionality and perform interoperability tests with strong swan.

Configuring ECDSA in Libreswan

Support for configuring authby=ecdsa

Possible options for setting ecdsa as the public key to be used for Digital Signature Authentication with appropriate SHA2 hash algorithm are as follows :

authby = ecdsa/ecdsa-sha2_256, ecdsa-sha2_384, ecdsa-sha2_512

Issues encountered

NSS looks for specific x509v3 certificate extensions in the end certificates and It is unclear which one is exactly missing in the certificates being used. This error has be be debugged further (as there is little information from the nss logs): SECERR: 35 (0x23): Certificate extension not found. It was found that this error was set and not cleared by NSS. It was solved by checking for errors only when private key retrieved was not equal to NULL.

Future work

Interoperability with Apple and Elvis Plus

Source code

https://github.com/libreswan/libreswan/commit/12f2f1a03de214e1e3ecf5cfa84950f09a8d35c4

https://github.com/libreswan/libreswan/commit/c6a711c091974b323feb61b3ea5c86713b80ea63


This project work was sponsored by Google as part of the Google Summer of Code 2018 Program. The implementation for this project is done by Sahana Prasad (sahana.prasad07@gmail.com) under the tutelage of Paul Wouters and Andrew Cagney

Additional Work during GSoC 2018

Implementation of RSA-PSS and support for SHA2 and it's variants. The work was started before GSoC 2018 but was fully completed and tested during the GSoC 2018 period. Work is described in this project page RSA-PSS Support in compliance with RFC 7427 and RFC 8247.

Retrieved from "https://libreswan.org/wiki/index.php?title=Extend_RFC-7427_Signature_Authentication_support_to_IKEv2_with_ECDSA&oldid=21485"