Subject: RE: [Ipsec] Rekeying IKE_SAs with the CREATE_CHILD_SA exhange

From: [email-masked]
Date: Thu, 27 Oct 2005 13:41:20 +0300

This is actually one of those issues we haven't reached 
consensus yet.

It seems that we have consensus on the following:

  - It is mandatory to include one or more type 4 (D-H) transform 
    substructures in the SA payload when rekeying the IKE_SA
    (Section 3.3.3).

  - Doing a new Diffie-Hellman exchange is not mandatory when 
    rekeying the IKE_SA (e.g. Section 2.18 says that g^ir term
    is optional). Thus, although including a D-H transform
    substructure is mandatory, it can contain value "NONE".

  - Usually implementations will want to do a new D-H exchange
    when the IKE_SA is rekeyed; i.e., while NONE is allowed here, 
    it's probably not the most common case.

  - Doing D-H is not mandatory when rekeying or creating a CHILD_SA.
 
  - When you're rekeying or creating a CHILD_SA, and you're not
    doing D-H, the KEi/KEr payloads are not included.

My interpretation of the spec is that
 
  - When you're rekeying the IKE_SA, and you're not doing D-H,
    the KEi/KEr payloads are not included.

But at least Tero and Paul disagreed with this conclusion back
in April (i.e., you have to include a dummy KEi/KEr payloads
even when you're not doing D-H --- but only the IKE_SA case,
not in the CHILD_SA case)...

There hasn't been much discussion about this since, though..

Best regards,
Pasi 

--------------------
> From: Alejandro Perez Mendez
> Sent: 27 October, 2005 11:16
> To: IPsec WG
> Subject: [Ipsec] Rekeying IKE_SAs with the CREATE_CHILD_SA exhange
>
> In order to get a better clarification document, we report a
> misprint found in the Appendix A.
>       
> The clarifications document says in its section 5.1:
>
>    << KEi and KEr are required for rekeying an IKE_SA.>>
>       
> But in the "Appendix A. Exchanges and payloads" in the section
> "A.5. CREATE_CHILD_SA exchange for rekeying the IKE_SA" shows:
>
>    << A.5.  CREATE_CHILD_SA exchange for rekeying the IKE_SA
>
>    request             --> SA, Ni, [KEi]
>       
>    response            <-- SA, Nr, [KEr] >>
>       
> where KEi and KEr seems to be optionals.
>       
> Regards!
>       
> Alejandro Pérez Méndez
> Pedro J. Fernández Ruiz

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 27 Oct 2005 19:42:34 +0300

> not in the CHILD_SA case)...

Not dummy KEi/KEr payloads. I say that the Diffie-Hellman is mandatory
when you rekey IKE_SA. There is no point of doing IKE SA rekey if you
do not do Diffie-Hellman at the same time, as that means that breaking
the original IKE SA protection will also reveal these keys.

There is reasons to do IPsec SA rekeys without doing the
Diffie-Hellman, but I do not think any of those reasons apply for the
IKE SA.
-- 
[email-masked]

---

From: Alejandro Perez Mendez <[email-masked]>
Date: Thu, 27 Oct 2005 18:59:00 +0200

> Diffie-Hellman, but I do not think any of those reasons apply for the

I agree with both. I think that if DiffieHellman exchange is not
mandatory when rekeying an IKE_SA, then if one doesn't want to perform
that exchange he shouldn't include any KE payload. 
I also agree with Tero: there isn't any reason (IMHO) to make an IKE_SA
rekey without a DiffieHellman exchange.

-- 
Alejandro Perez Mendez <[email-masked]>