Subject: [Ipsec] Changing PRFs when rekeying the IKE_SA

From: Paul Hoffman <[email-masked]>
Date: Tue, 14 Jun 2005 12:26:00 -0700

Greetings again. The IKEv2 clarifications document has the following section:

3.5  Changing PRFs when rekeying the IKE_SA

    When rekeying the IKE_SA, Section 2.18 says that "SKEYSEED for the
    new IKE_SA is computed using SK_d from the existing IKE_SA as
    follows:

       SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)"

    If the old and new IKE_SA selected a different PRF, it is not clear
    which PRF should be used.

We need to pick one or the other. I propose that we pick the *new* 
prf, because the two sides have agreed to use it for the new SA. Does 
anyone have any objections?

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 14 Jun 2005 15:42:23 -0400

> anyone have any objections?

so, cryptographer-types have, in my presence, expressed fairly strong
objection to using the same key bits with multiple algorithms on the
theory that it constitutes bad practice and might lead to
hard-to-analyze weaknesses.

in the absence of a clarification that would lead me to assume that I'd
should use the old prf/prf+ with the old SK_d to generate the new
SKEYSEED.

							- Bill

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 14 Jun 2005 12:46:36 -0700

>should use the old prf/prf+ with the old SK_d to generate the new

That logic works for me as well.

--Paul Hoffman, Director
--VPN Consortium

---

From: Geoffrey Huang <[email-masked]>
Date: Tue, 14 Jun 2005 13:40:57 -0700

I think it should be the old prf as well; not necessarily because of
what Bill mentioned, but because the rekey operation happens under the
auspices of the old IKE SA.  To this end, since the child exchange
really happens under the old IKE SA, I believe it should use the old
PRF.

-g

---

From: Hugo Krawczyk <[email-masked]>
Date: Wed, 15 Jun 2005 06:23:44 +0300 (IDT)

Both Bill and Geoffrey are correct. It is the key from the existing
session that spawns and authenticates the new (re-keyed) session, so both
SK_d and prf must taken from the existing "old" session.

Hugo

On Tue, 14 Jun 2005, Geoffrey Huang wrote:

> auspices of the old IKE SA.To this end, since the child exchange
> > >objection to using the same key bitswith multiple algorithms on the