Subject: RE: [Ipsec] Comments of draft-eronen-ipsec-ikev2-clarifications-02.txt

From: [email-masked]
Date: Fri, 15 Apr 2005 11:10:59 +0300

Paul Hoffman wrote:
> 
> At 2:33 PM +0300 4/14/05, [email-masked] wrote:
>> I agree that including D-H transform in IKE proposals is mandatory
>> (this is clearly said in both 3.3.2 and 3.3.3), but is it allowed
>> to have NONE as the value?
> 
> Yes.
> 
>> If it is, including KE payload is not really mandatory...
> 
> Disagree: it is mandatory, but it doesn't give you any extra 
> security.
> 
>> Section 2.18 says that SKEYSEED for the new IKE_SA is calculated
>> as follows:
>>
>>    SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
>>
>> The square brackets in "[g^ir (new)]" seem to imply that NONE
>> would be allowed... but I do agree with you that it's not
>> very useful.
> 
> Agree on both.
> 
> Do others agree with this tentative conclusion, that the KE payload 
> is required for rekeying IKE SAs, even it is has a value of 0 
> (meaning NONE)?

The spec is quite clear that when you rekey CHILD_SAs without 
doing DH (i.e., you either omit the DH transform completely, or
include it with value 0), the KE payload is not included. 
Why would including the KE payload be mandatory when rekeying 
IKE_SAs without DH?

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Geoffrey Huang" <[email-masked]>
Date: Sat, 16 Apr 2005 18:47:38 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of [email-masked]
> Sent: Friday, April 15, 2005 1:11 AM
> To: [email-masked]; [email-masked]; [email-masked]
> Subject: RE: [Ipsec] Comments of 
> draft-eronen-ipsec-ikev2-clarifications-02.txt
> 
> Paul Hoffman wrote:
> > 
> >> (this is clearly said in both 3.3.2 and 3.3.3), but is it 
> allowed to 
> >> have NONE as the value?
> > 
> > Yes.
> > 
> > Disagree: it is mandatory, but it doesn't give you any 
> extra security.
> > 
> >> Section 2.18 says that SKEYSEED for the new IKE_SA is 
> calculated as 
> >> follows:
> >>
> >> The square brackets in "[g^ir (new)]" seem to imply that 
> NONE would 
> >> be allowed... but I do agree with you that it's not very useful.
> > 
> > Agree on both.
> > 
> > Do others agree with this tentative conclusion, that the KE 
> payload is 
> > required for rekeying IKE SAs, even it is has a value of 0 (meaning 
> > NONE)?
> 
> doing DH (i.e., you either omit the DH transform completely, 
> or include it with value 0), the KE payload is not included. 

Judging by Tero's pervious mail, this is not the conclusion he came to.  Nor
is it the conclusion I came to, but I completely missed the square brackets
around the g^ir (Paul had to point it out to me).

I think the draft is clear as mud here.  Making the transform mandatory and
giving it a value of 0 would make it consistent with how the ESN text will
be.

-g