Subject: RE: [Ipsec] Rekeying IKE_SAs with the CREATE_CHILD_SA exhange

From: [email-masked]
Date: Fri, 28 Oct 2005 11:35:01 +0300

Tero Kivinen wrote:

> Not dummy KEi/KEr payloads. I say that the Diffie-Hellman
> is mandatory when you rekey IKE_SA. 

Is this your interpretation about what the spec currently
says, or a proposal to change the spec?  It seems to be
the latter, since section 2.18 does suggest that DH is 
not mandatory:

   SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)

And if it's a change, the clarifications document is the
wrong place to do it -- you'll have to take it to the spec
authors and AD...

> There is no point of doing IKE SA rekey if you do not do
> Diffie-Hellman at the same time, as that means that breaking
> the original IKE SA protection will also reveal these keys.
>
> There is reasons to do IPsec SA rekeys without doing the
> Diffie-Hellman, but I do not think any of those reasons apply 
> for the IKE SA.

Hmm... what about the other direction? If you rekey the IKE_SA 
without DH, and an attacker later gets the _new_ keys, does 
he also get the old keys? 

It seems the answer is no (assuming that you're not keeping
the old DH private value around)... so rekeying the IKE_SA 
without DH can be a useful operation, since it provides some
kind of forward secrecy...?

(However, it doesn't really matter if we don't fully agree 
on how useful this is; what matters is agreement on what
the spec actually says.) 

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 28 Oct 2005 13:30:12 +0300

>    SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)

Yes, I think that picture is incorrect. 

> wrong place to do it -- you'll have to take it to the spec

We are doing all kind of similar changes in the clarification document
already. I.e. Making one interpretation to be the one accepted one
when the IKEv2 document has contradictional sections.

I think the clarification document section 5.1. is now correct, i.e.
key exchange payloads and Diffie-Hellman is required when rekeying IKE
SA. 

> he also get the old keys? 

That depends how he manages to break the new keys. If the old SK_*
data is removed from the memory before he gets hold of the new keys,
then he will not get access to those old keys. If he manages to break
the Diffie-Hellman of the original exchange, then he will get
everything done by the peers after that point, including all later IKE
SA rekeys which do not do Diffie-Hellman. 

> on how useful this is; what matters is agreement on what

Spec says that Diffie-Hellman Group is mandatory in the SA payloads
negotiating IKE SA, and I think that strongly indicates that
Diffie-Hellman is mandatory when creating or rekeying IKE SA.

This is repeated 2 times in the IKEv2 document (section 3.3.2, and in
3.3.3). The only indication that it might be optional is the picture
of the 2.18 having [] around it. Note that in 2.17 where it talks
about IPsec SAs it explictly mentions that Diffie-Hellman is optional,
and actually have 2 different pictures listing both cases.

When we were creating IKEv2 we were trying to remove options as much
as possible. This is one of those options that I do not think adds
anything to the protocol, but is just one more useless option that
needs to be tested.

After the first interop of IKEv2 we decided that it is mandatory to do
Diffie-Hellman, and in the last interop, I think everybody was doing
that. 
-- 
[email-masked]