RFC 7427 - Signature Authentication in the Internet Key Exchange Version 2 (IKEv2)

Overview

Positive

what Ze has

Neutral

measures that are neither good news nor bad

The 8 shares marked as a part above are the whole of the 4 gated MUSTs: they add to 100%. Proven by a recorded break is a share of TAGGED UNITS, a different population, so it is not one of them.

At a glance

Enrolment

Enrolled: Signature Authentication in IKEv2: three MUST-level requirements. RFC7427-3-4 (Section 3 permits the Digital Signature method only once a SIGNATURE_HASH_ALGORITHMS notify has been sent and received by each peer) is tested both polarities: computeX509Auth (internal/component/ike/engine/auth.go) refuses the method on an empty sa.RemoteHashAlgos and emits method 14 once one arrived (TestRFC7427DigitalSignatureNeedsTheNotify, TestAuthX509UsesMethod14), while PSK auth uses method 2 (TestAuthPSKCompute), and ze always sends the notify (buildSignatureHashAlgosNotify). RFC7427-4-1 (Section 4: the signer picks one algorithm the other peer sent) is tested both polarities over selectSignatureAlgorithm and computeX509Auth (TestRFC7427SignatureAlgorithmIsOneThePeerSent, TestRFC7427AuthRefusesAnAlgorithmThePeerDidNotSend). RFC7427-3-1 (ANSI X9.62 hash truncation) is {not-applicable}: ze delegates ECDSA to Go crypto/ecdsa (ecdsa.SignASN1/VerifyASN1), which does the truncation; ze implements none itself. No MUST gap remains gated. docs/features/rfc-status.md carries no RFC 7427 row, which its grandfathering permits and which no change here alters.

What the public ledger says

No row in the public ledger, so its summary declares `| Support | - |` and docs/features/rfc-status.md carries no row for RFC 7427.

Coverage

Positive and negative tests (3): RFC7427-4-1, RFC7427-3-4, RFC7427-3-5

Annotated (including scoped evidence) (1): RFC7427-3-1

Requirements

Gaps and untested MUSTs

Proof state

A tagged unit reads unproven where no discrimination record exists for it: nothing in this tree has been observed to break it, so the claim its tag makes is unproven.

RFC7427-4-1

When calculating the digital signature, a peer MUST pick one algorithm sent by the other peer. (§4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: signing with a hash algorithm the peer did not list in its SIGNATURE_HASH_ALGORITHMS notify. TestRFC7427SignatureAlgorithmIsOneThePeerSent asserts selectSignatureAlgorithm returns errNoMutualHashAlgo for every list lacking a usable algorithm (SHA-1 alone, SHA2-384 alone for P-256, SHA2-256 alone for P-384, nil) and that the chosen identifier equals the one the peer sent; TestRFC7427AuthRefusesAnAlgorithmThePeerDidNotSend asserts computeX509Auth returns errNoMutualHashAlgo for a P-384 key against {2} and an RSA key against {1}. Both polarities. Residual: no computeX509Auth-level positive reads the AlgorithmIdentifier in AuthData, so the wiring from select to the encoded payload is proven only through the refusal path.

RFC7427-3-4

the peer is only allowed to use this authentication method if the Notify payload of type SIGNATURE_HASH_ALGORITHMS has been sent and received by each peer. (§3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Received: TestRFC7427DigitalSignatureNeedsTheNotify (errNoSignatureHashAlgos with no received list, method 14 once one arrived). Sent: TestRFC7427IKESAInitSendsTheSignatureHashAlgorithmsNotify parses Ze's real IKE_SA_INIT request and the real response Ze's responder builds, each carrying exactly one SIGNATURE_HASH_ALGORITHMS notify listing 2,3,4; the cookie/INVALID_KE repeat goes through the same buildSAInitRequest. TestAuthX509UsesMethod14 positive, PSK uses method 2.

RFC7427-3-5

If both ends send and receive SIGNATURE_HASH_ALGORITHMS Notify payloads, and signature authentication is to be used, then the authentication method specified in this Authentication payload MUST be used. (§3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: with the notify exchanged and signature authentication in use, emitting a legacy AUTH method (1 RSA, 3 DSS) instead of Digital Signature (14). TestRFC7427DigitalSignatureMethodIsUsed asserts auth.AuthMethod == wire.AuthMethodDigitalSig with RemoteHashAlgos set (red on any other method) and, as the negative, that with no notify received computeX509Auth returns an error and a nil payload rather than falling back to a legacy method.

RFC7427-3-1

For hash truncation, the method specified in ANSI X9.62:2005 [X9.62] MUST be used. (§3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC7427-3-1, so no unit is bound to it.

Extraction sign-off

Sections

Excluded sentences

Superseded

No document obsoletes RFC 7427, so its obligations are stated where they were written.