Subject: RE: [Ipsec] Rekeying IKE_SAs with the CREATE_CHILD_SA exhange

From: [email-masked]
Date: Fri, 28 Oct 2005 14:58:14 +0300

Tero Kivinen wrote:
> > Is this your interpretation about what the spec currently
> > says, or a proposal to change the spec?  It seems to be
> > the latter, since section 2.18 does suggest that DH is 
> > not mandatory:
> > 
> >    SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
> 
> Yes, I think that picture is incorrect. 
> 
> > And if it's a change, the clarifications document is the
> > wrong place to do it -- you'll have to take it to the spec
> > authors and AD...
> 
> We are doing all kind of similar changes in the clarification 
> document already. I.e. Making one interpretation to be the one 
> accepted one when the IKEv2 document has contradictional sections.

Except in this case, the IKEv2 document does not seem to have
any contradictions.

> I think the clarification document section 5.1. is now correct, 
> i.e. key exchange payloads and Diffie-Hellman is required when 
> rekeying IKE SA. 
>
> Spec says that Diffie-Hellman Group is mandatory in the SA payloads
> negotiating IKE SA, and I think that strongly indicates that
> Diffie-Hellman is mandatory when creating or rekeying IKE SA.

The spec also says it's mandatory to include the ESN transform in 
the SA payloads negotiating a CHILD_SA, but this does not imply 
that the value "0" is not allowed. And there's no text saying that 
the DH transform would be an exception where the value 0 is forbidden.

> This is repeated 2 times in the IKEv2 document (section 3.3.2, and in
> 3.3.3). The only indication that it might be optional is the picture
> of the 2.18 having [] around it. Note that in 2.17 where it talks
> about IPsec SAs it explictly mentions that Diffie-Hellman is optional,
> and actually have 2 different pictures listing both cases.
>
> When we were creating IKEv2 we were trying to remove options as much
> as possible. This is one of those options that I do not think adds
> anything to the protocol, but is just one more useless option that
> needs to be tested.
> 
> After the first interop of IKEv2 we decided that it is mandatory to do
> Diffie-Hellman, and in the last interop, I think everybody was doing
> that. 

I agree with you that having this option is not very useful; what I
don't agree is that this would be a "clarification" that can be just
decided over coffee at an interop. The change history in the IKEv2
draft appendix strongly suggests that this was a technical decision
made a long time ago:

   H.1 Changes from IKEv2-00 to IKEv2-01 February 2002
   ...
   6) Removed requirement that Diffie-Hellman be repeated when 
   rekeying IKE_SA.

It might well be that the decision was not a good one, and needs 
to be changed. But this should be done according to proper 
procedures, just like the ESN transform change was done in March.

In other words, the Area Director and (ex-)WG chairs need to 
be in the loop, and preferably, a straw poll should be held
on the mailing list to check consensus.

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 28 Oct 2005 16:09:40 +0300

> procedures, just like the ESN transform change was done in March.

I do not remember why this decision would have been made, but I think
as this option just one option without any clear use, we should simply
remove it. We can remove it when we are progressing IKEv2 protocol
forward later in the standardization process (actually it will be
removed automatically unless two implementations implements it).

We did do lots of doing one thing, and then going back to the previous
version while doing IKEv2, and this might be just one of the leftovers
from those discussions.

> on the mailing list to check consensus.

I do not think we can or will change the IKEv2 draft now, but we can
add to the clarification document a text saying "this feature is not
supposed to be used, no need to implement this". You can add text
there saying, that you still think it is techincally allowed by the
IKEv2 draft, but as it is useless to do IKE SA rekey without
diffie-hellman, nobody should implement that feature. 
-- 
[email-masked]