Subject: RE: [MSEC] comments on IPSEC RSA signature draft

From: <[email-masked]>
Date: Mon, 16 Aug 2004 14:26:47 -0400

Hi George,

Some questions/comments inline.

Thanks,
Atul

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of ext George Gross
> Sent: Monday, August 16, 2004 10:57 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [MSEC] comments on IPSEC RSA signature draft
>
> I realize that the intent here is to get the benefit of "lightweight"
> public key cryptography without the baggage of PKI. So I 
> agree that this
> flavor of digital signature ESP/AH is an important design goal.

If X.509 certificate are allowed, as you suggest, how is it lightweight
public key cryptography without the baggage of PKI?

> ISSUE 4: In section 5 there is the statement:
> 
>    "Use of this transform with a pair-wise key management 
> system such as
>    the Internet Key Exchange [IKEv2] is NOT RECOMMENDED.  The value of
>    using this transform for a pair-wise connection is limited,
>    considering the performance impact."
> 
> This statement precludes a policy that uses a digital 
> signature for its
> non-repudiation characteristic. This may be useful in an 
> application for
> which legal or economic policy requires that it can 
> substantiate that only
> one of the two parties could have sent the signed message. I 
> would suggest
> revising the text to say that local policy may elect to use 
> this mechanism
> for non-repudiation provided the public key length is 
> increased for the
> (presumably) longer period that the signature must be kept secure.

I had a question/comment here: In the case of IPsec, can we talk
of transitive non-repudiation? IKE can use authentication mechanism
which allows public-key cryptography and hence non-repudiation. Since
keys (shared secrets) generated as a result of IKE are used in IPsec, 
non-repudiation of IKE can imply non-repudiation of IPsec? Just a 
thought/question/doubt.

If that is true, then we have an option of non-repudiation in IPsec
already.
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: George Gross <[email-masked]>
Date: Mon, 16 Aug 2004 13:33:13 -0400 (EDT)

Hi Atul,

> public key cryptography without the baggage of PKI?

My goal here was to discover whether existing certified public keys are
allowed/not allowed by the spec.

I do not want to require traditional X.509 public keys for all use cases.
HOwever, as an option, it seems to me that you may want that capability
when two conditions both hold true:

1) your policy does not trust that the key management protocol will
distribute trustworthy ephemeral public keys (e.g the vendor happened to
not give the user a knob to set the key length to match local policy).

2) your cryptographic group already trusts a PKI and the application's
policy deems that the overhead of using an enrolled strong public/private
key pair is acceptable (e.g you only occasionally sign the "critical"
packets).

I saw no reason to preclude this usage case and I wanted the spec to
clarify that it was allowed.

<snip>

> non-repudiation of IKE can imply non-repudiation of IPsec? Just a

Technically speaking, the term "non-repudiation" as we've been using it is
abit sloppy. Non-repudiation is really a legal process that only gets
interpreted correctly in a court of law by assembling evidence.

The pair-wise secret MAC authentication key generated by IKE is not likely
to suffice for a non-repudiation process. If one party recorded the IKE-v2
mutual authentication messages, that might be useful as non-repudiation
evidence if it included the peer's signature. As a degenerate case, one of
the IKE-v2 parties could present an anonymous self-signed public key
certificate and then do a weak authentication using EAP methods. Then the
evidence arguably becomes weaker.

> If that is true, then we have an option of non-repudiation in IPsec

all shades of grey until a court rules ;o)

hth,
	George