I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims

signature scheme ECDSA-256 not supported by private key

Now I am wondering if that is due to incompatibilities in the IKE daemon or cryptographic incompatibilities. In other words, is it generally impossible to use secp256k1 keys for ECDSA or is it only impossible with that specific IKE daemon?


This is because RFC 4754 only defines three ECDSA signature schemes for use with IKE, each using exactly one predefined elliptic curve:

  • ECDSA-256: secp256r1
  • ECDSA-384: secp384r1
  • ECDSA-521: secp521r1

Therefore, it is currently not possible to use private keys/certificates with other curves for authentication with IKE.

A solution to this problem is currently being standardized.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.