Suite B Cryptographic Suites for IPsec
RFC 6379

 
Document Type RFC - Informational (October 2011; No errata)
Obsoletes RFC 4869
Was draft-law-rfc4869bis (individual in sec area)
Last updated 2013-03-02
Stream IETF
Formats plain text pdf html
Stream WG state (None)
Consensus Unknown
Document shepherd No shepherd assigned
IESG IESG state RFC 6379 (Informational)
Telechat date
Responsible AD spt
IESG note Paul Hoffman (paul.hoffman@vpnc.org) is the document shepherd.
Send notices to jsolinas@orion.ncsc.mil, lelaw@orion.ncsc.mil, draft-law-rfc4869bis@ietf.org, paul.hoffman@vpnc.org
Internet Engineering Task Force (IETF)                            L. Law
Request for Comments: 6379                                    J. Solinas
Obsoletes: 4869                                                      NSA
Category: Informational                                     October 2011
ISSN: 2070-1721

                 Suite B Cryptographic Suites for IPsec

Abstract

   This document proposes four cryptographic user interface suites
   ("UI suites") for IP Security (IPsec), similar to the two suites
   specified in RFC 4308.  The four new suites provide compatibility
   with the United States National Security Agency's Suite B
   specifications.  This document obsoletes RFC 4869, which presented
   earlier versions of these suites.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Not all documents
   approved by the IESG are a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc6379.

Copyright Notice

   Copyright (c) 2011 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Law & Solinas                 Informational                     [Page 1]
RFC 6379                Suite B Crypto for IPsec            October 2011

Table of Contents

   1. Introduction ....................................................2
   2. Requirements Terminology ........................................2
   3. New UI Suites ...................................................2
      3.1. Suite "Suite-B-GCM-128" ....................................3
      3.2. Suite "Suite-B-GCM-256" ....................................3
      3.3. Suite "Suite-B-GMAC-128" ...................................4
      3.4. Suite "Suite-B-GMAC-256" ...................................4
   4. Security Considerations .........................................4
   5. IANA Considerations .............................................5
   6. Changes from RFC 4869 ...........................................5
   7. References ......................................................5
      7.1. Normative References .......................................5
      7.2. Informative References .....................................6

1.  Introduction

   [RFC4308] proposes two optional cryptographic user interface suites
   ("UI suites") for IPsec.  The two suites, VPN-A and VPN-B, represent
   commonly used present day corporate VPN security choices and
   anticipated future choices, respectively.  [RFC4869] proposed four
   new UI suites based on implementations of the United States National
   Security Agency's Suite B algorithms (see [SuiteB]).

   As with the VPN suites, the Suite B suites are simply collections of
   values for some options in IPsec.  Use of UI suites does not change
   the IPsec protocols in any way.

   This document reduces the scope of the suites in [RFC4869] while
   retaining the original suite names.  A detailed list of the changes
   is given in Section 6.  This document obsoletes RFC 4869.

2.  Requirements Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].

3.  New UI Suites

   Each of the following UI suites provides choices for ESP (see
   [RFC4303]) and for Internet Key Exchange (IKEv2) (see [RFC5996]).
   The four suites are differentiated by the choice of cryptographic
   algorithm strengths, and a choice of whether the Encapsulating
   Security Payload (ESP) is to provide both confidentiality and
Show full document text